Under PIPA, every personal data controller (which means any person, any government entity, company, individual or other person that, directly or through a third party, controls and / or processes personal information in order to operate personal information files as part of its activities) must designate a chief privacy officer (“CPO”). The CPO must be an employee or executive of the company.

In addition, personal data controllers that meet certain criteria are required to designate a CPO with: 

• at least three years of experience in personal information protection; and
• a combined career of at least six years in personal information protection, data protection and information technology. 

More specifically, the obligation to designate a CPO with the foregoing qualifications is applicable to an entity whose annual sales revenue or income amounts to at least KRW 150 billion, and: 

• processes sensitive information or unique identification information of at least 50,000 data subjects, or processes personal information of at least 1 million data subjects;
• is a school under the Higher Education Act with at least 10,000 enrolled students as of December 31 of the immediately preceding year;
• is a tertiary hospital under the Medical Service Act; or
• is a public institution operating a personal information processing system which meets the standards set by the PIPC.

There are no nationality or residency requirements for the CPO. 

If a CPO is not designated, the personal information processing entity may be subject to a maximum administrative fine of KRW 10 million under the PIPA.

The recently amended PIPA mandates that personal data controllers meeting certain thresholds – to be specified in the forthcoming Presidential Decree currently undergoing the legislative process – must obtain approval from the Board of Directors for the appointment, change or dismissal of a CPO, and formally report such designation to the PIPC. 

Furthermore, to establish a continuous and robust personal information safety management system, the CPO’s role has been significantly strengthened. The CPO’s obligations under the amended PIPA are as follows:

• establishing and implementing plans for the protection of personal information;
• managing specialized personnel and securing necessary budgets for the protection of personal information;
• reporting the current status and key matters of personal information protection to the business owner, representative and the Board of Directors;
• performing periodic investigations and improving the status and practices of the processing of personal information;
• handling complaints and dealing with damage pertaining to the processing of personal information;
• establishing internal control systems for preventing leakage, misuse and abuse of personal information;
• establishing and implementing training sessions for the protection of personal information;
• protecting, managing, and monitoring personal information files;
• establishing, amending, and implementing a privacy policy;
• managing materials concerning the protection of personal information; and
• destroying personal information for which the purpose of processing has been achieved or for which the retention period has expired.