As a general rule, a personal data controller may not provide personal information to a third party without obtaining the prior opt in consent of the data subject.

Exceptions to the general rule above apply in the following cases:

• Where there exists special provisions in any Act or it is necessary to fulfil an obligation imposed by or under any Act and subordinate statute;
• Where it is necessary for a public institution to perform its affairs provided for in any Act and subordinate statute, etc;
• Where it is deemed manifestly necessary for the protection of life, bodily and property interests of a data subject or a third party where imminently endangered;
• Where it is necessary to attain the legitimate interests of a personal data controller, the interest of which is manifestly superior to the rights of the data subject. In such cases, processing shall be allowed only to the extent the processing is substantially related to the legitimate interests of the personal information controller and does not go beyond a reasonable scope; and
• Where it is urgently necessary for the public safety and security, public health, etc.

Under the PIPA, a personal data controller must obtain consent after it notifies the data subject of:

• recipient of personal information;
• purposes for which the recipient of personal information uses such information;
• particulars of personal information to be provided;
• period during which the recipient retains and uses personal information;
• the fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.

When a business transfer occurs, the personal data controller may transfer personal information without consent; provided that it must provide its data subjects a chance to opt out by providing a notice of:

• expected personal information transfer;
• contact information of the recipient of the personal information, including the name, address, telephone number and other contact details of the recipient; and
• means and process by which the data subjects may refuse to consent to the transfer of personal information.

In addition to the restrictions set out above, consent must be received as a general rule for the cross-border transfer of personal information under the PIPA, however, consent need not be received in the following cases:

• Where there are special provisions on cross-border transfers under laws, treaties or other international agreements;
• Where delegation of processing or storage is necessary for the execution and performance of agreements with data subjects and such details are disclosed in the privacy policy or notified to the data subjects via email, etc.;
• Where the recipient of personal information has taken all necessary measures, such as authentication and safety measures required by the PIPC, such as ISMS-P; or
• Where the countries or international organizations that personal information is transferred to are recognized by the PIPC as having an adequate level of protection.

When obtaining consent for cross-border transfers, personal data controllers must notify the following:

• Specific information to be transferred overseas;
• Destination country;
• Date, time, and method of transmission;
• Name and the contact information of the third party;
• Third party's purpose of use of the personal information and the period of retention and usage; and
• Method and procedure for rejecting the cross-border transfer and the consequences thereof.