Cookie, logs, IP information, etc. may also be regulated by the PIPA as personal information, if combined with other information may enable the identification of a specific individual person easily.

The protection of location information is governed by the LIA.

Under the LIA, any person who intends to collect, use, or provide location information of a person or mobile object shall obtain the prior consent of the person or the owner of the object, unless:

• there is a request for emergency relief or the issuance of a warning by an emergency rescue and relief agency;
• there is a request by the police for the rescue of the person whose life or physical safety is in immediate danger; or
• there exist special provisions in any Act.

Any person (entity) who intends to provide services based on location information (“Location-based Service Provider”) shall report to the Korea Communications Commission (“KCC”). Further, any person (entity) who intends to collect location information and provide the collected location information to Location-based Service Providers (“Location Information Provider”) shall obtain a license from the KCC.

If a Location Information Provider intends to collect personal location information, it must specify the following information in its service agreement, and obtain the consent of the subjects of personal location information:

• Name, address, phone number and other contact information of the Location Information Provider;
• Rights held by the subjects of personal location information and their legal agents and methods of exercising the rights;
• Details of the services the Location Information Provider intends to provide to Location-based Service Providers;
• Grounds for and period of retaining data confirming the collection of location information; and
• Methods of collecting location information.

If a Location-based Service Provider intends to provide location-based services by utilizing personal location information provided by a Location Information Provider, it must specify the following information in its service agreement, and obtain the consent of the subjects of personal location information:

• Name, address, phone number and other contact information of the Location-based Service Provider;
• Rights held by the subjects of personal location information and their legal agents and methods of exercising the rights;
• Details of the location-based services;
• Grounds for and period of retaining data confirming the use and provision of location information; and
• Matters concerning notifying the personal location information subject of the provision of location information to a third party as below.

If a Location-based Service Provider intends to provide location information to a third party, in addition to the above, it must notify the subjects of personal location information of the third party who will receive the location information and the purpose of this provision.