Home | Databases | WorldLII | Search | Feedback Laws of the Republic of Korea

LAW ON THE PROTECTION AND USE OF LOCATION INFORMATION

Law on the protection and use of location information

Established on January 27, 2005. Law No. 7372

Partially Amended on September 27, 2006. Law No. 8002 Partially Amended on April 11, 2007. Law No. 8367 Partially Amended on May 25, 2007. Law No. 8486

Partially Amended on December 21, 2007. Law No. 8775 Partially Amended on February 29, 2008. Law No. 8867 Chapter 1 General Provisions

Article 1 (Purpose) The purpose of this law is to protect privacy against the leak, abuse and misuse of location information, promote a safe environment for using location information andre invigorate the use of location information, and thus contribute to the improvement of national life and the promotion of public welfare.

Article 2 (Definition) The terms used in this law are defined as follows:

1. "Location information" refers to information about the place where a portable object or individual exists or existed at a certain time, collected by means of the telecommunication equipments and telecommunication line equipments pursuant to the provisions in Articles 2-2 and 2-3 of the Framework Act on Telecommunications.

2. "Personal location information" refers to the location information of a certain person (including the information that can be easily combined with other information to know the location of a certain person even if the location information alone is not sufficient to know the location of this person).

3. "Personal location information subject" refers to the person who is identified with the personal location information.

4. "Data confirming the collection of location information"refers to data regarding the person who requested the collection of location information, the date of collection, and the method of collection (excluding location - 2 -

information).

5. "Data confirming the use and provision of location information"refers to data regarding the person receiving the location information, the path of acquisition thereof, the data of use and provision and the method of use and provision (excluding location information).

6. "Location information business" refers to the act of running the business of collecting location information and providing it for location-based service providers.

7. "Location-based service business" refers to the act of running the business of providing services based on location information (referred to as "location-based service" hereinafter).

8. "Location information system" refers to the combination of computer hardware, software, database and human resources that are closely connected to one another organically so that location information can be collected, saved, analyzed, used and provided via IT networks stipulated in Subclause 1 of Article 2-1 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. for the sake of the location information business and the location-based service business.

Article 3 (Devising policies to protect and use location information) The Korea Communications Commission must devise the following policies to ensure safe protection and sound use of location information after consultation with the heads of relevant central administrative agencies.

1. The basic direction of the policies to protect and use location information

2. Matters concerning the protection of location information

3. Matters concerning the use of location information for public purposes

4. Matters concerning development and standardization of technology related to the location information business and the location-based service business

5. Matters concerning the safety and reliability of the location information businessand the location-based service business

- 3 -

6. Matters concerning the improvement and evaluation of the quality of the location information businessand the location-based service business

7. Other matters necessary for the protection and use of location information

Article 4(Relationship to other laws) Unless there are special provisions in other laws concerning the collection, storage, protection and use of location information, this law shall govern.

Chapter 2 Permission of the location information business, etc. Article 5 (Permission of the location information business, etc. )

Those who want to run the location information business must obtain the permission of the Korea Communications Committee pursuant to the Presidential Decree in regard to firm name, address of the main office, type and description of location information business, and key facilities for business including the location information system.

When the Korea Communications Commission gives permission pursuant to the provisions in Clause 1, it must undergo the preliminary deliberation of the information and communication policy deliberation committee pursuant to the provisions in Article 44-2 of the Framework Act on Telecommunications. When the Korea Communications Commission gives permission pursuant to the provisions in Clause 1, it must deliberate on the following:

1. Appropriateness of the location information business

2. Planned technical and managerial measures relating to protection of personal location information

3. Appropriateness of the size of facilities relating to the location information business

4. Financial and technical capabilities

5. Other matters necessary for running the business - 4 -

When the Korea Communications Commission gives permission pursuant to the provisions in Clause 1, it can attach preconditions to R&D for improvement of the accuracy and reliability of location information, fair competition or protection of personal location information.

Only corporations can obtain the permission pursuant to the provisions in Clause 1.

Matters concerning the application guideline and procedure relating to the permission described in Clause 1 and detailed deliberation criteria pursuant to the provisions in Clause 3 shall be stipulated by the Presidential Decree. In case those who obtained the permission for the location information business (referred to as the "location information provider" hereinafter)pursuant to the provisions in Clause 1 wishes to change the permitted location information system (only if this change lowers the level of technology for protection of personal location information than when the permission was obtained), they shall obtain the permission of the Korea Communications Commission for this change as stipulated by the Presidential Decree, and if it wishes to change firm name or location of the main office, it must report this change to the Korea Communications Commission. Article 6 (Reasons for disqualification of executives) None of the following can become an executive of the location information provider:

1. Minors, incompetents or quasi-incompetents

2. bankrupts who are not reinstated

3. Anyone who violated this law, the Act on promotion of information and communications network utilization and information protection, etc, the Framework Act on Telecommunications, telecommunication business or the Radio Waves Act and was sentenced imprisonment upward of incarceration, and for whom the execution of this sentence is completed (including cases where the execution is deemed completed) or the execution was exempted for less than three years.

4. Anyone who violated this law, the Act on promotion of information - 5 -

and communications network utilization and information protection, etc, Framework Act on Telecommunications, telecommunication business or the Radio Waves Act and had a sentence upward of incarceration suspended and is now on probation

5. Anyone who violated this law, the Act on promotion of information and communications network utilization and information protection, etc, Framework Act on Telecommunications, telecommunication business or the Radio Waves Act, and was fined less than three years ago

6. Anyone who had their permission cancelled or business closed pursuant to the provisions in Article 13-1 less than three years ago. In case of corporations it refers to the person who performed an act that cause the cancellation of permission or closing of the business and the representative.

In case an executive comes under Clause 1, or was found to be as such at the time of appointment, he/she shall retire. The acts, in which the retired executive pursuant to the provisions in Clause 2 was involved, shall remain in effect.

Article 7 (Transfer of location information business and merger of corporations) Anyone who wishes to take over all or part of the business of the location information provider, or merger or split the corporation which is the location information provider (including split/merger. The same hereinafter) must obtain the approval of the Korea Communications Commission as stipulated by the Presidential Decree.

The transferee approved pursuant to the provisions in Clause 1 or the corporation established by the merger or split or existing after the merger or split shall succeed to the status of the transferor or the corporation as the location information provider prior to the merger or split. Article 8 (Suspension, discontinuation, etc. of the location information business) If the location information provider wishes to suspend all or part of the business, it must determined the suspension period and obtain the approval of the Korea Communications Commission, and notify it to - 6 -

the personal location information subjects by 30 days prior to the date of suspension. In this case the suspension period may not exceed 6 months, and destroy personal location information at the same time as the suspension begins (if part of the business is suspended, only personal location information relating to the suspended business shall be destroyed).

If the location information provider wishes to discontinue all or part of the business, it must obtain the approval of the Korea Communications Commission, and notify it to the personal location information subjects by 30 days prior to the date of discontinuation, and destroy personal location information and data confirming the collection of location information at the same time as the discontinuation begins (if part of the business is discontinued, only personal location information and data confirming the collection of location information relating to the discontinued business shall be destroyed). Required matters relating the approved suspension or discontinuation of the location information business and the destruction of personal location information pursuant to the provisions in Clauses 1 and 2 shall be stipulated by the Presidential Decree.

Article 9 (Reporting of the location-based service business) Those who wish to run the location-based service business must report firm name, location of the main office, business type, key facilities for business including the location information system to the Korea Communications Commission as stipulated by the Presidential Decree.

Those who were ordered to discontinue the business pursuant to the provisions in Article 13-1 less than a year ago (including the representative in case of a corporation)may not report the business pursuant to the provisions in Clause 1.

If thosewho reported the location-based service business pursuant to Clause 1 (referred to as "location-based service provider" hereinafter) wishes to change firm name, location of the main office or location - 7 -

information system among the reported information (only if this change lowers the level of technology for protection of personal location information than when the reporting was done), they shall report the change to the Korea Communications Commission as stipulated by the Presidential Decree.

If the location information provider attached documents necessary for reporting the location-based service business when it applied for permission pursuant to Article 5-1, it shall be deemed to have reported the location-based service business pursuant to Article 9-1.

Article 10 (Transfer of the location-based service business, merger of corporations, etc.) In case all or part of the location-based service provider's business is transferred or inherited, or the corporation which is the location-based service provider is merged or split, the transferee, inheritor or the corporation established or existing after the merger or split must report it to the Korea Communications Commission pursuant to the Presidential Decree. The transferee or inheritor who reported pursuant to the provisions in Clause 1, or corporation established by or after merger or split shall succeed to the status of the transfer or, inheritage or the corporation of the corporation as the location-based serviced provider prior to the merger or split.

Article 11 (Suspension, discontinuation, etc. of the location-based service business) If the location-based service provider wishes to suspend all or part of the business, it must determined the suspension period and notify it to the personal location information subjects by 30 days prior to the date of suspension, and report it to the Korea Communications Commission. In this case the suspension period cannot exceed 6 months, and must destroy personal location information at the same time as the suspension begins (if part of the business is suspended, only personal location information relating to the suspended business shall be - 8 -

destroyed).

If the location-based service provider wishes to discontinue all or part of the business, it must notify it to the personal location information subjects by 30 days prior to the date of discontinuation, and report it to the Korea Communications Commission. In this case personal location information and data confirming the use and provision of personal location information must be destroyed at the same time as discontinuation (if part of the business is discontinued, only personal location information and data confirming the use and provision of personal location information relating to the discontinued business shall be destroyed).

Necessary matters relating to the reporting of the suspension or discontinuation of the location-based service business and the destruction of personal location information pursuant to the provisions in Clauses 1 and 2 shall be determined by the Presidential Decree.

Article 12 (Reporting of service agreements, etc.) The location information provider and the location-based service provider (referred to as "location information provider, etc." hereinafter) must determine the fees and conditions relating to the collection, use and provision of location information (referred to as "service agreement" hereinafter) and report it to the Korea Communications Commission. If it needs to be changed, the same shall apply. In case the Korea Communications Commission believes that the service agreement of the location information provider, etc. is likely to infringe on the protection of personal location information, fair competition or public interests, it can order the location information provider, etc. to change the service agreement. Article 13 (Cancellation of permission and discontinuation, suspension, etc. of business) In case the location information service provider, etc. comes under any of the following, the Korea Communications Commission may cancel the permission or license, order the - 9 -

discontinuation of the business or the suspension of all or part of the business with the suspension period not exceeding 6 months (referred to as "suspension of the business" hereinafter). However, if Clause 1 applies, it must cancel the permission or license, or order the discontinuation of the business.

1. In case the permission, change permission or approval pursuant to Clauses 5 and 7 of Article 5 or Clause 1 of Article 7 was obtained by means of fraud or other dishonest means, or reported pursuant to the provisions in Clause 1 of Article 9;

2. In case the business is not resumed without any valid reason after the passage of the suspension period pursuant to Clause 1 of Article 8 or Clause 1 of Article 11

3. In case there was a serious change to the facilities related to the collection of location information and the technical and managerial measures related to the protection of location information, and accordingly makes it impossible to continuously provide services;

4. In case the managerial and technical measures pursuant to Clause 1 of Article 16, or the data confirming the collection, use and provision of location information pursuant to Clause 2 of the same Article (referred to as "data confirming the collection, use and provision of location information" hereinafter) failed to be maintained;

5. In case location information was collected, used or provided in ways not specified in the service agreement or without any consent in violation of the provisions in Clause 1 of Article 18 or Clause 1 of Article 19

6. In case personal location information was collected, used or provided in excess of the agreed scope in violation of the provision in Clause 2 of Article 18 or Clause 4 of Article 19 and

7. In case personal location information was used or provided to a third party in excess of the scope expressly specified in the service agreement or notified scope in violation of the provisions in Article 21. The details of the administrative measures stipulated in Clause 1 shall be determined by the Presidential Decree in consideration of the type and degree of the violation.

- 10 -

Article 14 (Imposition of surcharges, etc.)

In case the suspension of business pursuant to the provision in Clause 1 of Article 13 is likely to greatly damage the interests of personal location information subjects, the Korea Communications Commission may impose a surcharge up to 3/100 of the sales of the location information business or location-based service business instead of the business suspension order.

Necessary matters concerning the criteria and procedure for imposition of surcharges, such as assessment of the sales mentioned in Clause 1 shall be determined by the Presidential Decree.

In case those who are supposed to pay the surcharge pursuant to the provisions in Clause 1 fail to pay the amount by the due date, the Korea Communications Commission may collect additional charges form the day after the due date according to the rate determined by the Presidential Decree, which does not exceed 8/100 of the surcharge, for the surcharges in arrears.

In case the person obligated to pay the surcharge fails to pay it by the due date, the Korea Communications Commissioned the person to pay the amount by a certain deadline, and if the surcharge and the additional charges pursuant to the provisions in Clause 3 are not paid by the deadline, it shall collect the amount in accordance with the exemplary disposition of nonpayment of national taxes. Chapter 3 Protection of location information

Paragraph 1 General provisions

Article 15 (Prohibition of collection of location information, etc.) No one may collect, use or provide the location information of a person or mobile object without the consent of the person or the owner of the object. However, if an emergency relief agency requests emergency relief or the issuance of a warning pursuant to the provisions in Article 29, or other laws stipulates otherwise, an exception shall be made. No one shall receive the personal location information of another - 11 -

person by deceiving the location information provider, e.g. copying the telecommunication devices of others or stealing information. Those who lend objects with devices capable of collecting location information must notify the borrower the fact that the objects have a built-in location information collection device.

Article 16 (Protection of location information, etc.) The location information provider, etc. must take managerial measures, such as establishing guidelines on the handling and management of location information to prevent the leakage, alteration and impairment of location information, or designating those with access authority, and take technical measures, such as installing a firewall or using encryption software. In this case, the details of the managerial measures and technical measures shall be determined by the Presidential Decree.

The location information provider, etc. must make sure that data confirming the collection, use and provision of location information will be automatically recorded and preserved by the location information system.

To protect location information and prevent the abuse and misuse of location information, the Korea Communications Commission may allow relevant public officials to examine the details of the technical and managerial measures pursuant to Clause 1 and the recording and preservation status pursuant to Clause 2 as stipulated by the Presidential Decree.

The public official who examines the preservation status pursuant to the provisions of Clause 3 must have the certificate indicating the authority and show it to people concerned.

Article 17 (Prohibition of leaking of location information, etc.) The location information provider, etc., its current or past employees may not leak, alter, impair or disclose any location information acquired in the line of duty.

- 12 -

Paragraph 2 Protection of personal location information Article 18 (Collection of personal location information) In case the location information provider wishes to collect personal location information, it must specify the following in the service agreement in advance, and obtain the consent of personal location information subjects.

1. The firm name, address, phone number and other contact information of the location information provider

2. The right of personal location information subjects and legal agents (only when the consent of the legal agents must be obtained pursuant to the provisions in Clause 1 of Article 25) and how to exercise it

3. The details of the services the location information provider wishes to provide for the location-based service provider

4. The grounds and retention period of the data confirming the collection of location information

5. Other matters necessary for protection of personal location information as stipulated by the Presidential Decree

In case personal location information subjects consent pursuant to the provisions in Clause 1, they may defer consent as to the scope of the collection of personal location information and part of the service agreement.

In case the location information provider wishes to collect personal location information, it must collect the least amount of information necessary for attaining the purpose of collection. Article 19 (Use or provision of personal location information) In case the location-based service provider wishes to use personal location information to provide services, it must specify the following in the service agreement in advance, and obtain the consent of personal location information subjects.

1. The firm name, address, phone number and other contact information of the location-based service provider

2. The right of personal location information subjects and legal agents (only when the consent of the legal agents must be obtained pursuant to - 13 -

the provisions in Clause 1 of Article 25)and how to exercise it

3. The details of the location-based services the location-based service provider wishes to provide

4. The grounds and retention period of the data confirming the collection of location information

5. Other matters necessary for protection of personal location information as stipulated by the Presidential Decree

In case the location-based service provider wishes to provide personal location information for a third party designated by personal location information subjects, it must specify the information specified in Clause 1 in the service agreement, and notify who will receive the information and the purpose to personal location information subjects and obtain their consent.

In case the location-based service provider wishes to provide personal location information for a third party designated by personal location information subjects pursuant to the provisions in Clause 2, it must immediately notify who will receive the information and the purpose to personal location information subjects each time

If the personal location information subjects consent pursuant to the provisions in Clauses 1 and 2, it may defer consent as to the purpose of using and providing personal location information, the scope of those who will receive the information, and part of the location-based service. Article 20 (Location information provider's provision of personal location information, etc.) The location-based service provider, who obtained the consent of personal location information subjects pursuant to the provisions in Clause 1 or 2 of Article 19, may request personal location information from the location information provider who collected this information to achieve the purpose of using or providing the said information as stipulated in Clause 1 or 2 of Article 19. In this case, the location information provider may not refuse to provide the information without any valid reason.

The procedure and method of the location information provider's providing personal location information for the location-based service - 14 -

provider pursuant to the provisions in Clause 1 shall be determined by the Presidential Decree. Article 21 (Restriction of the use and provision of personal location information, etc.) Except for cases where there was a consent of personal location information subjects or except for the following cases, the location information provider, etc. may not use personal location information or the data confirming the collection, use or provision of location information beyond the scope specified or notified in the service agreement pursuant to Clause 1 of Article 18 and Clauses 1 and 2 of Article 19, or provide it for a third party.

1. In case data confirming the collection, use and provision of location information is necessary to assess the fees related to the provision of location information and location-based services; and

2. In case data is processed in such a way that cannot identify any specific person and provided for the purpose of statistics, academic research or market research

Article 22 (Notification of transfer of business, etc.) Those who received the rights and obligations of the location information provider as a result of the transfer, merger or inheritance of all or part of the business (referred to as "transfer, etc." hereinafter) must notify the following to personal location information subjects within 30 days as stipulated by the Presidential Decree.

1. The transfer, etc. of all or part of the business

2. The name, address, phone number and other contact information of those who succeeded to the rights and obligations of the location information provider, etc. and

3. Other matters necessary for the protection of personal location information protection as stipulated by the Presidential Decree. Article 23 (Destruction of personal location information, etc.) When the purpose of collecting, using or providing personal location information is accomplished, the location information provider, etc. Must immediately - 15 -

destroy any personal location information other than the data confirming the collection, use and provision of location information that must be recorded and preserved pursuant to the provisions in Clause 2 of Article 16. Paragraph 3 Rights of personal location information subjects, etc. Article 24 (Rights of personal location information subjects, etc.) Personal location information subjects may withdraw all or part of the consent stipulated in Clause 1 of Article 18 and Clause 1 and 2 of Article 19 at any time in regard to the location information provider. Personal location information subjects may request the location information provider at any time to temporarily suspend the collection, use or provision of location information. In this case, the location information provider may not refuse this request, and take technical measures to this end.

Personal location information subjects may request the location information provider for the right to read or the notification of the following data, and if the said data has any error, the former may request the latter for correction. In this case, the location information provider, etc. may not refuse this request without any valid reason.

1. Data confirming the collection, use and provision of personal location information and

2. The reason why personal location information was provided for a third party pursuant to the provisions of this law or other laws and the details In case personal location information subjects withdraw all or part of the consent pursuant to the provisions in Clause 1, the location information provider, etc. must immediately destroy collected personal location information and data confirming the collection, use and provision of location information collection (if part of the consent is withdrawn, only the personal location information and data confirming the use and provision of location information corresponding to the withdrawn shall be destroyed).

Article 25 (Rights of legal representatives) In case the location - 16 -

information provider, etc. wishes to collect personal location information from children under the age of 14, use and provide this information pursuant to the provisions in Clause 1 of Article 18, Clauses 1 and 2 of Article 19, or Article 21, it must obtain the consent of their legal agents. The provisions in Clause 2 of Article 18, Clause 4 of Article 19 and Article 24 shall apply in case the legal agents consent pursuant to the provisions in Clause 1. In this case, "personal location information subjects" shall be "legal agents."

Article 26 (Use of location information for protection of children under 8 years of age, etc.) In case the legal guardians of those who come under any of the following (referred to as "children under the age of 8, etc." hereinafter) consent to the collection, use or provisions of personal location information of children under the age of 8 for the protection of their life or body, it shall be deemed as consented to by the children themselves.

1. Children under the age of 8

2. Incompetents

3. Those with mental disabilities pursuant to the provisions in Subclause 2 of Clause 2 of Article 2 of the Welfare of Disabled Persons Act and with severe disabilities described in Clause 2 of Article 2 of the Employment Promotion Vocational Rehabilitation of Disabled Persons Act (only those who are registered disabled persons pursuant to the provisions in Article 32 of the Welfare of Disabled Persons Act) The legal guardian of children under the age of 8 described in Clause 1refers to any of the following who are de facto protectors of children of under the age of 8.

1. The legal agents of children under the age of 8 or legal guardians pursuant to the provisions in Article 3 of the Act on the guardianship of minors in protective facilities

2. Legal agents of incompetents and

3. The legal agents of those mentioned in Subclause 3 of Clause 1 or the heads of facilities for disabled persons pursuant to the provisions in Subclause 1 of Subclause 1 of Article 58 of the Welfare of Disabled - 17 -

Persons Act (only those facilities installed and operated by the state or local governments), the heads of rehabilitation facilities for mentally-disordered persons according to the provisions in Clause 4 of Article 3 of the Mental Health Act Article 3 (only those facilities installed and operated by the state or local governments), the heads of mental recuperation facilities pursuant to the provisions in Clause 5 of Article 3 of the Mental Health Act.

The requirements for the consent pursuant to the provisions in Clause 1 shall be determined by the Presidential Decree. The provisions in Articles 18, 22 and 24 shall apply pursuant to the provisions in Clause 2 when the legal guardians consent. In this case, "personal location information subjects" shall be "legal guardians." Article 27 (Compensation for damages) In case personal location information subjects sustained damages because the location information provider, etc. violated the provisions in Articles 15 and 26, they may claim damages against the location information provider, etc. In this case, the location information provider, etc. may not be exempted from responsibilities unless they prove that there was no intention or mistake on its part.

Article 28 (Mediation of disputes, etc.) In case the parties fail to or cannot reach an agreement as to a dispute related to location information, the location information provider or the location-based service provider may ask the Korea Communications Commission for arbitration.

In case the parties fail to or cannot reach an agreement as to a dispute related to location information, the location information provider, etc. and users may ask the personal information dispute coordination committee for arbitration pursuant to the provisions in Article 33 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

- 18 -

Chapter 4 Use of personal location information for emergency relief Article 29 (Use of personal location information for emergency relief) To protect life and bodies from imminent dangers, emergency relief agencies (referred to as "emergency relief agencies" hereinafter) pursuant to Clause 7 of Article 3 of the Framework Act on the Management of Disasters and Safety decide whether the situation is an emergency and may request the location information provider to provide personal location information in case personal location information subjects, their spouses, or relatives removed less than twice or the guardian (referred to as "spouses, etc." hereinafter) pursuant to the provisions in Article 928 of the Civil Act make emergency relief requests. In this case, spouses, etc. may not make emergency relief requests for purposes other than emergency relief. The emergency relief requests of personal location information subjects or their spouses pursuant to the provisions in Clause 1 shall be made only by calls based on special phone numbers assigned by the Presidential Decreefor the sake of maintaining public order and increasing public interests.

The location information provider in receipt of the request mentioned in Clause 1may collect personal location information without the consent of personal location information subjects, and the requests of the emergency relief agencies may not be turned down because personal location information subjects did not consent.

In case the location information provider provides personal location information for emergency relief agencies pursuant to the provisions in Clause 1, it must immediately notify the provision of personal location information to pertinent personal location information subjects. To warn personal location information subjects in disaster areas or potential disaster areas, e.g. typhoon, heavy rain, fire and abc (atomic, biological and chemical) accidents, of the dangers to their life or body, the emergency relief agencies may request the location information provider to send a warning as stipulated by the Presidential Decree, and the location information provider in receipt of this request may not turn - 19 -

down the request for issuance of a warning because the personal location information subjects in the danger areas did not consent.

The emergency relief agencies or the current or past emergency relief workers may not use the personal location information provided for the sake of emergency relief for purposes other than emergency relief. Necessary matters concerning the emergency relief request pursuant to the provisions in Clause 1, and the method and procedure of issuing warnings pursuant to the provisions in Clause 5 shall be determined by the Presidential Decree.

Article 30 (Request for and personal location information and method thereof) In case the emergency relief agencies request the location information provider for personal location information pursuant to the provisions in Clause 1 of Article 29, they must use the location information system to do so, and in case the location information provider receives the request from emergency relief agencies and provides personal location information, it must used the location information system to do so.

Necessary matters concerning the request of emergency relief agencies pursuant to the provisions in Clause 1 shall be determined by the Presidential Decree.

Article 31 (Reduction and exemption of costs) In case the location information provider issues a warning pursuant to the provisions in Clause 5 of Article 29, or provides personal location information for emergency relief agencies pursuant to the provisions in Clause 1 of Article 30, it may reduce or exempt the costs.

Article 32 (Submission of statistical data, etc.) The location information provider must submit the statistics concerning the issuance of a warning pursuant to the provisions in Clause 5 of Article 29 and the provision of personal location information pursuant to the provisions in Clause 1 of Article 30to the Korea Communications Commission semiannually. - 20 -

Chapter 5 Promotion of the infrastructure for use of location information, etc.

Article 33 (Technology development, etc.) To efficiently develop technologies and devices related to the collection, use and provision of location information, the Korea Communications Commission may have related research institutes stipulated by the Presidential Decree engage in activities, such as R&D, technical cooperation, technology transfer or technical guidance (referred to as "R&D, etc." in this Article). In this case, The Korea Communications Commission must consult with the heads of related central administrative agencies. The Korea Communications Commission may assist the research institutes, engaged in R&D, etc. mentioned in Clause 1, with all or part of the costs.

Article 34 (Standardization) After consultation with related central administrative agencies, the Korea Communications Commission may establish the standards regarding the collection, use and provision of location information for the sake of the protection and use thereof, and notify them. However, as far as Korean Industrial Standards are established in accordance with Article 10 of the Industrial Standardization Act, these standards shall apply.

The Korea Communications Commission may recommend that the location information provider, etc. or the manufacturer or supplier of products related to location information comply with the standards pursuant to the provisions in Clause 1. Necessary matters concerning the target, method and procedure of the standardization mentioned in Clause 1 shall be determined by the Presidential Decree. The Korea Communications Commission may support the standardization activities relating to the collection, use and provision of - 21 -

location information. Article 35 (Promotion of use of location information) After consultation with the heads of related central administrative agencies, the Korea Communications Commission may engage in the business for efficient utilization and promotion of related technologies and application services in various areas like the public sector, industries and welfare for the purpose of protecting and using location information as stipulated by the Presidential Decree. The Korea Communications Commission may provide those engaged in the business mentioned in Clause 1 with necessary technical and financial assistance.

Article 36 (Location information deliberation committee) To discuss matters concerning the promotion of a safe environment for using location information and promote the use of location information for public purposes, a location information deliberation committee shall be installed under the Korea Communications Commission.

The committee shall deliberate on the following:

1. Matters concerning key location information policies

2. Matters concerning location information support policies and support systems

3. Matters concerning improvement of location information systems

4. Matters concerning the use of location information for public purposes

5. Matters concerning cooperation among related agencies in regard to location information

6. Matters concerning R&D on the protection and use of location information

7. Other important matters related to location information that the chairperson presents for deliberation

The committee shall consist of 20 or so members including the chairperson.

The chairperson shall be the vice-chairperson of the Korea - 22 -

Communications Commission, and the following shall be the members.

1. Those public officials of the Ministry of Education, Science and Technology, the Ministry of Public Administration and Security, the Ministry of Land, Transport and Maritime Affairs, the National Emergency Management Agency, the National Police Agency and the Korea Coast Guard above level 3 (including public officials in designated and special government services above level 3) who are appointed by the heads of relevant agencies

2. Those location information providers, representatives of location-based service providers, representatives of users and private-sector location information experts who are appointed by the chairperson of the Korea Communications Commission

The term of office of the member mentioned in Clause 2 of Article 4 shall be three years and reappointment is possible. The committee may install a subcommittee and a special committee if necessary.

Other matters concerning the composition and operation of the committee shall be determined by the Presidential Decree. Article 37 (Public hearing) In case the Korea Communications Commission wishes to obtain the permission, have the approval cancelled, or the business discontinued pursuant to the provisions in Article 13, it must hold a public hearing. Article 38 (Delegation of authorities) The Korea Communications Commission may entrust part of the authorities stipulated in this law to the head of the agency or the head of the Communication Office as stipulated by the Presidential Decree. Chapter 6 Penal provisions

Article 39 (Penal provisions) Those described below shall be imprisoned for up to 5 years or fined up to KRW50 million.

- 23 -

1. Anyone who engages in location information business without permission in violation of the provisions in Clause 1 of Article 5 or obtained permission by means of fraud or other dishonest means;

2. Anyone who leaked, altered, impaired or disclosed personal location information in violation of the provisions in Article 17

3. Anyone who violated the provisions in Clauses 1 and 2 of Article 18 or Clauses 1, 2 and 4 of Article 19, and collected, used or provided personal location information without the consent of personal location information subjects or beyond the agreed scope, and received the personal location information for profits or dishonest purposes

4. Anyone who violated the provisions in Article 21 and used personal location information or provided it for a third party beyond the scope specified in the service agreement or notified scope; and

5. Anyone who violated the provisions in Clause 6 of Article 29 and used personal location information for purposes other than emergency relief. Article 40 (Penal provisions) Those described below shall be imprisoned for up to 3 years or fined up to KRW30 million.

1. Anyone who violated the provisions in Clause 7 of Article 5 and engaged in the location information business without obtaining the change permission or reporting the change or obtained the change permission or reported the change by means of fraud or other dishonest means;

2. Anyone who violated the provisions in Clause 1 of Article 9 and engaged in the location-based service without reporting the business or reported the business by means of fraud or other dishonest means;

3. Anyone who violated the business discontinuation order stipulated by the provisions in Clause 1 of Article 13

4. Anyone who violated the provisions in Clause 1 of Article 15, and collected, used or provided personal location information without obtaining the consent of the person; and

5. Anyone who violated the provisions in Clause 2 of Article 15, and received personal location information of other persons by copying their telecommunication devices or stealing information to deceive the location - 24 -

information provider.

Article 41 (Penal provisions) Those described below shall be imprisoned for up to 1 year or fined up to KRW20 million.

1. Anyone who violated the provisions in Clauses 1 and 2 of Article 8, Clauses 1 and 2 of Article 11, Article 23 or Clause 4 of Article 24, and failed to destroy personal location information

2. Anyone who violated the provisions in Clause 3 of Article 9, and engaged in the location-based service business without reporting change or reported change by means of fraud or other dishonest means;

3. Anyone who violated the business suspension order as stipulated in the provisions in Clause 1 of Article 13

4. Anyone who violated the provisions in Clause 1 of Article 16, and failed to take technical and managerial measures, or violated the provisions in Clause 2 of Article 16 and failed to ensure that the data confirming the collection, use and provision of location information is automatically recorded and preserved in the location information system and

5. Anyone who violated the provisions in Clause 3 of Article 29and turned down the requests of emergency relief agencies or violated the provisions in Clause 5 of Article 29 and refused to issue a warning. Article 42 (Dual punishment) If the representative of a corporation, or the agent or employee of a corporation or person violated the provisions in Articles 39 and 41 in regard to the business of the corporation or person, the violator shall be punished and the corporation or person shall be fined as follows:

Article 43 (Fines) Those described below shall be fined up to KRW20 million.

1. Anyone who violated the conditions for permission pursuant to the Clauses 4 of Article 5

2. Anyone who violated the provisions in Clause 1 of Article 7 and takes over the business or merged or split the business without approval - 25 -

3. Anyone who violated the provisions in Clause 1 or Clause 2 of Article 8and suspended or discontinued all or part of the business without approval

4. Anyone who violated the provisions in Clause 1 of Article 20 and refused to provide personal location information and

5. Anyone who violated the provisions in Clause 2 of Article 24 and turned down the temporary suspension request or failed to take technical measures.

Those described below shall be fined up to KRW10 million:

1. Anyone who violated the provisions in Clause 1 of Article 10 and failed to report the transfer, inheritance, merger or split of the business

2. Anyone who violated the provisions in Clause1 or 2 of Article 11and failed to report the suspension or discontinuation of all or part of the business

3. Anyone who violated the provisions in Clause 1 of Article 12 and failed to report the service agreement or the change thereof, or violated the service agreement change order pursuant to the provisions in Clause 2 of Article 12

4. Anyone who violated the provisions in Clause 1 of Article 15 and collected, used or provided location information of mobile objects without the consent of the owner, or violated the provisions in Clause 3 of Article 15 and failed to notify that the objects come with location information collection devices;

5. Anyone who violated the provisions in Clause 1 of Article 18 or Clause 1 of Article 19 and failed to perform the duty of specifying the service agreement

6. Anyone who violated the provisions in Clause 3 of Article 18 and collected personal location information

7. Anyone who violated the provisions in Clause 2 or 3 of Article 19and failed to notify;

8. Anyone who violated the provisions in Article 22 and failed to notify the transfer of business

9. Anyone who violated the provisions in Clause 3 of Article 24 and turned down the request for reading, notification or correction; - 26 -

10. Anyone who violated the provisions in Clause 1 of Article 25and collected, used or provided personal location information without the consent of the legal agent

11. Anyone who made a false emergency relief request pursuant to the provisions in Clause 1 of Article 29 and

12. Anyone who violated the provisions in Clause 4 of Article 29and failed to notify the provision of personal location information. Anyone who violated the provisions in Article 32and failed to submit statistical data shall be fined up to KRW5 million. The fines pursuant to Clause 1, Subclauses 1, 10 and 13 of Clause 2, and Clause 3 shall be imposed and collected as stipulated by the Presidential Decree. If anyone refuses to pay the fines pursuant to the provisions in Clause 4 may submit a formal objection to the Korea Communications Commission within 30 days of receiving the notification of the fine.

In case anyone who was fined pursuant to the provisions in Clause 4 files an objection pursuant to the provisions in Clause 5, the Korea Communications Commission must immediately notify it to the competent court, and the competent court in receipt of this notification shall make a decision on the fine pursuant to the Non-contentious Case Litigation Procedure Act.

If no objection was raised by the deadline specified in Clause 5 and the fines are not paid, the fines shall be collected in accordance to the exemplary disposition of nonpayment of national taxes. The fines pursuant to the provisions in Subclause 11 of Clause 2 shall be imposed and collected as stipulated by the Presidential Decree. The provisions in Clauses 5 and 7 shall apply to imposition of fines pursuant to the provisions in Clause 8. In this case, the "Korea Communications Commission" and "exemplary disposition of nonpayment of national taxes" shall be the "chief of the fire department or fire station" and "exemplary disposition of nonpayment of local taxes"respectively.

- 27 -

Supplementary provisions (Effective date) This law shall go into effect 6 months after promulgation. However, the provisions in Articles 29 and 32, Clause 5 of Article 41, Subclause 11 and 12 of Clause 2 of Article 43, and Clause 8 of Article 43 shall go into effect on the day of promulgation. (Interim measures concerning the permission of the location information business) Those engaged in the location information business at the time when this law is enforced must obtain the permission of the Minister of Information and Communication pursuant to Clause 1 of Article 5 within 3 months of the date when this law goes into effect. (Interim measures concerning the reporting of the location-based service business) Those engaged in the location-based service business at the time when this law is enforced must report to the Minister of Information and Communication pursuant to the provisions in Clause 1 of Article 9 within 3 months of the date when this law goes into effect. (Interim measures concerning service agreement) Those engaged in the location information business or location-based service business at the time when this law is enforced must establish the service agreement pursuant to the provisions in Clause 1 of Article 12, and report to the Minister of Information and Communication within 3 months of the date when this law goes into effect.

Supplementary provisions This law shall go into effect on the date of promulgation. Supplementary provisions (Welfare of Disabled Persons Act)

Article 1 (Effective date) This law shall go into effect 6 months after promulgation.

Article 2 and Article 4 omitted

Article 5 (Amendment of other laws) and omitted - 28 -

Part of the law concerning the protection and use of location information shall be amended as follows:

"Article 29 of the Welfare of Disabled Persons Act "of the provisions in Subclause 3 of Clause 1 of Article 26 shall be "Article 32 of the Welfare of Disabled Persons Act," and "Subclause 1 of Clause 1 of Article 48 of the Welfare of Disabled Persons Act" of the provisions in Subclause 3 of Clause 2 of the same Article shall be Subclause 1 of Clause 1 of Article 58 of the "Welfare of Disabled Persons Act."

and omitted

Article 6 omitted

Supplementary provisions (Industrial Standardization Act)

Article 1 (Effective date) This law shall go into effect one year after promulgation.

Article 2 through Article 8 omitted

Article 9 (Amendment of other laws) through omitted Part of the law concerning the protection and use of location information shall be amended as follows:

Among the provisos of Clause 1 of Article 34, the "standards for which Korean Industrial Standards are established pursuant to the provisions in Article 10 of the Industrial Standardization Act" shall be the "standards for which Korean Industrial Standards are established pursuant to the provisions in Article 12 of the Industrial Standardization Act." through <22> omitted

Article 10 omitted

Supplementary provisions This law shall go into effect 6 months after promulgation. Supplementary provisions - 29 -

Article 1 (Effective date ) This law shall go into effect from the date of promulgation. However, Clause 8 of Article 7 of the Supplementary provisions shall go into effect on April 18, 2008. Article 2 and Article 6 omitted

Article 7 (Amendment of other laws) and omitted Part of the law concerning the protection and use of location information shall be amended as follows:

The "Minister of Information and Communication" of Clause 3 of Article 5 and Clause 4 of Article 43 shall be the "Korea Communications Commission."

In parts other than the Subclauses of Article 3, the text other than Clauses 2 and 4 of Article 5, Clause 2 of Article 12, and Clause 1 of Article 13, and Clauses 1, 3 and 4 of Article 14, Clause 3 of Article 16, the front part and back part of Clause 1 of Article 33 and Clause 2, the text of Clause 1 of Article 34, Clauses 2 and 4, Clauses 1 and 2 of Article 35, Article 37, Article 38 and Clause 6 of Article 43, the "Minister of Information and Communication" shall be the "Korea Communications Commission."

In Clauses 6 and 7 of Article 5, Clause 1 of Article 7, Clause 3 of Article 8, Clauses 1 and 3 of Article 9, Clause 1 of Article 10, Clause 3 of Article 11, Clause 3 of Article 16, Clause 2 of Article 20, Clause 4 of Article 29 and Clause 3 of Article 34, the "Decree of the Ministry of Information and Communication" shall be the "Presidential decree." In Clauses 5 and 7 of Article 5, Clause 1 of Article 7, Clauses 1 and 2 of Article 8 and Clause 1 of Article 36, the "Minister of Information and Communication" shall be the "Korea Communications Commission." In Clauses 1 and 3 of Article 9, Clause 1 of Article 10, the front part of Clause 1 of Article 11, the back part of Clause 2 of Article 11, Clause 1 of Article 12, Article 32 and Clause 5 of Article 43, "to the Minister of Information and Communication" shall be "to the Korea Communications Commission."

In Clause 2 of Article 12 "to the location information provider, etc. after deliberation of the Communication Commission pursuant to the provisions in Article 37 of the Framework Act on Telecommunications" shall be "to - 30 -

the location information provider, etc."

In Clause 1 of Article 28 "to the Communications Commission pursuant to Article 37 of the Framework Act on Telecommunications" shall be "to the Korea Broadcasting Commission."

In Clause 4 of Article 36 "the Minister of Information and Communication" shall be "the vice commissioner of the Korea Communications Commission," and in Subclause 1 of the same Clause, "the Ministry of Science and Technology, the Ministry of Government Affairs and Home Affairs, the Ministry of Construction and Transportation" shall be "the Ministry of Education, Science and Technology, the Ministry of Public Administration and Security, the Ministry of Land, Transport and Maritime Affairs," and in Subclause 2 of the same Clause, "the Minister of Information and Communication" shall be "the Commissioner of the Korea Communications Commission." InArticle 38, "entrusted to the chief of the relevant agency" shall be "entrusted to the chief of the relevant agency or the Communication Office."

In Clause 9 of Article 43, "with the Minister of Information and Communication" shall be "with the Korea Communications Commission." and (20) omitted

Article 8 and Article 12 omitted