Obligations to display the identity of online shopping mall operators
Matters to display
- When operating an online shopping mall, information prescribed under relevant laws and regulations shall be displayed on the initial screen of the shopping mall to enable consumers to easily identify the business operator. However, the user agreement of the online shopping mall may be provided for consumers to access through a linked page (Article 10(1) of the Act on the Consumer Protection in Electronic Commerce, etc. and Article 7(1) of the Enforcement Regulations of the Act on the Consumer Protection in Electronic Commerce, etc.).
Sanctions for violations
- Any person who violates such duties shall be punished with an administrative fine and ordered to take corrective measures by the Fair Trade Commission. A person who fails to comply with the corrective order may be commanded to fully or partially suspend the business for a fixed period of up to one year, or be imposed penalty surcharges (Article 32(4) and Article 34(1) of the Act on the Consumer Protection in Electronic Commerce, etc.).
Obligation to prepare and explain the terms and conditions
The definition of the terms and conditions
- If a business person and a customer agree on a matter in a manner that is different from what is stipulated in the terms and conditions, the agreement shall prevail over such terms and conditions (Article 4 of the Act on the Regulation of Terms and Conditions).
Obligations to state, deliver, and explain the terms of conditions
- A business operator shall clearly state to his/her customers the details of the relevant terms and conditions in a way that is generally expected for the type of contract in question and shall, upon request of the customer, deliver a copy of the terms and conditions to the customer (Article 3(2) of the Act on the Regulation of Terms and Conditions).
- Important details of the terms and conditions shall be provided in a way that enables consumers to understand. However, this obligation shall not apply where it is considerably difficult to explain them due to the nature of the contract (Article 3(3) of the Act on the Regulation of Terms and Conditions).
- Any person who violates such obligations shall be punished with an administrative fine not exceeding KRW 5 million (Subparagraphs 1 and 2 of Article 34(3) of the Act on the Regulation of Terms and Conditions), and a person who enters into a contract, in violation of the above obligations, shall not claim that the relevant terms and conditions constitute the content of the contract (Article 3(4) of the Act on the Regulation of Terms and Conditions).
Use of standard terms and conditions
- An online shopping business operator may prepare the terms and conditions by using the standard terms and conditions for electronic transactions (Internet cybermalls) prescribed by the Fair Trade Commission (Standard Terms and Conditions of the Fair Trade Commission No. 10023, announced and enforced on Jun. 26, 2015).
- A person who uses indication of standard terms and conditions while using any terms and conditions of a contract that are different from the standard terms and conditions, in violation of such obligation shall be punished with an administrative fine not exceeding KRW 50 million (Subparagraph 1 of Article 34(1) of the Act on the Regulation of Terms and Conditions), and the terms and conditions of a contract that are more disadvantageous to customers than the standard terms and conditions shall be made invalid (Article 19-3(9) of the Act on the Regulation of Terms and Conditions).
Obligation for public disclosure of policy on the processing of personal information
Preparation of the personal information processing policy
- An online shopping mall operator shall establish a policy on the processing of personal information (hereinafter referred to as the “Personal Information Processing Policy”) that contains the following matters (Article 30(1) of the Personal Information Protection Act and Article 31(1) of the Enforcement Decree of the Personal Information Protection Act).
· Purpose of processing personal information
· Period of processing and retaining personal information
· Matters concerning the provision of personal information to a third party (only when applicable)
· Matters concerning the destruction procedure and method of personal information (in cases where personal information needs to be preserved, the basis for preservation and the items of personal information preserved should be included)
· Matters concerning the entrustment of personal information processing (only when applicable)
· Matters concerning the rights and obligations of the information subject and the legal representative and how to exercise them
· The name of the person in charge of personal information protection or the name and contact information such as phone number of the department handling personal information protection tasks and related grievances
· Matters concerning the installation, operation and rejection of devices that automatically collect personal information such as Internet access data files (only when applicable)
· Items of personal information to be processed
· Matters concerning the measures to ensure the safety of personal information
Disclosure of the personal information processing policy
- When an online shopping mall operator establishes or revises the personal information processing policy, the content shall be posted on the personal information controller's website to ensure that the users easily recognize the same (Article 30(2) of the Personal Information Protection Act and Article 31(2) of the Enforcement Decree of the Personal Information Protection Act).
- If it is not possible to post the established or revised policy on the website, the personal information controller shall disclose the established or revised policy in at least one of the following manners (Article 30(2) of the Personal Information Protection Act and Article 31(3) of the Enforcement Decree of the Personal Information Protection Act):
· Posting at an easily noticeable location, such as the workplace of the personal information controller;
· Publishing in the official gazette (only in the case the personal information controller is a public institution), or a general daily newspaper, general weekly newspaper or online newspaper circulating mainly over the City/Do where the personal information controller's workplace is located;
· Publishing at a periodical, newsletter,PR magazine, or invoice to be published under the same title at least twice ayear and distributed to the data subjects on a continual basis; and
· Stipulating in an agreement,etc. for the supply of goods and services executed between the personalinformation controller and the data subjects and providing a copy of the sameto the data subject.
Sanctions for violations
- Any person who fails to establish or disclose the policy on the processing of personal information shall be punished with an administrative fine not exceeding KRW 10 million (Subparagraph 7 of Article 75(4) of the Personal Information Protection Act).