Duty LXD-0109
Crawls the web, in South Korea
Copyright Act, Arts. 91-98 (database producer's right)since 2 lines
Copyright Act of the Republic of Korea (Act No. 432, as amended), Arts. 91-98 · Read the law's page
- Do not reproduce, distribute, broadcast, or transmit all or a substantial part of a database another party made a substantial investment to build, verify, or present.
- Treat systematic or repeated collection of individually non-substantial parts of such a database as reaching a substantial part where it conflicts with the database's ordinary use or unfairly harms the producer.
Copyright Act, Prohibition of Neutralizing Technological Protection Measures (Articles 2(28), 104-2, 104-8 and 136(3))since 2 lines
Copyright Act of the Republic of Korea, Arts. 2(28) and 104-2 · Read the law's page
- Do not, without proper authority and intentionally or negligently, remove, alter or bypass a technological protection measure that the right holder, or a person with the right holder's consent, has applied to effectively prevent or deter access to a work protected by the Copyright Act, unless one of the exceptions in Article 104-2, paragraph 1 applies.
- Do not manufacture, import, distribute, transmit, sell, rent, offer to the public, advertise for sale or rental, or hold for distribution a device, product or part, or provide a service, that is promoted for neutralizing a technological protection measure, has only a limited commercial purpose or use other than neutralizing it, or is mainly designed, made or adapted to enable or facilitate neutralizing it.
Information and Communications Network Act, Report on Computer Security Incidentssince 3 lines
Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, ) · Read the law's page
- Immediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated.
- A person who operates an information and communications network, a provider of information and communications services included, must analyze the cause of the incident, respond based on the results of that analysis, and take measures to keep the resulting damage at bay (Article 48-4(1)).
- Preserve data when the Minister of Science and ICT orders it, and submit on the Minister's demand the data needed to analyze the incident's cause; submitting false data or refusing to submit it is separately finable, and failing to preserve data after an order to do so is a criminal offense (Article 73, item 6).
- The reporting and data duties below bind a provider of information and communications services, the Act's own broad term for a person who, for profit, provides information or acts as an intermediary in providing information using a telecommunications business operator's services, with no revenue or user threshold gating these duties; a separate certification duty in this Act binds only a designated information and communications service provider identified by revenue or user count and is not raised here. The cause-analysis duty in Article 48-4(1) reaches any person who operates an information and communications network, a provider included.
Personal Information Protection Act, Art. 15(1)(6), legitimate interestssince 2 lines
Personal Information Protection Act (Act No. 10465, as amended by Act No. 19234), Art. 15(1)(6) · Read the law's page
- Collect and use personal information without consent on this ground only where it is necessary to attain your legitimate interests and those interests are manifestly superior to the data subject's rights.
- Keep that processing substantially related to your legitimate interests and within a reasonable scope.
Information and Communications Network Act, Article 48 (network intrusion and anti-circumvention)since 3 lines
Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 21305, as amended), Art. 48 · Read the law's page
- Do not access an information and communications network without authorization, or beyond the scope of granted authorization, to collect data.
- Do not build, install, or distribute a tool whose purpose is to bypass a network's normal access-control or authentication procedures.
- Scraping a public, unauthenticated page without defeating an access control has not itself been held to violate this article (Supreme Court, Yanolja Co. v. GC Company, 2021Do1533, ).
Unfair Competition Prevention and Trade Secret Protection Act, Art. 2(1) items ka and pa (data misappropriation and general catch-all)since 4 lines
Unfair Competition Prevention and Trade Secret Protection Act (Act No. 21065, as amended), Art. 2(1)(ka), (pa) · Read the law's page
- Do not acquire data by theft, fraud, unauthorized access, or other wrongful means, or use or disclose data acquired that way.
- Do not use, disclose, or provide to a third party, beyond a contractual access limit and for wrongful profit or to harm the data holder, data you accessed under that limit.
- Do not create, provide, or distribute a technology or device whose main purpose is to circumvent a technical measure protecting data.
- Separately, do not use the outcome of another person's substantial investment or effort for your own business, in a manner contrary to fair commercial practice, without authorization.