South KoreaPersonal Information Protection Act, sensitive information and biometric data
Act No. 10465 (as amended by Act No. 19234, 2023) Art. 23; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, ), Art. 18
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that derives a faceprint, voiceprint, or other unique biometric identifier from a Korean data subject, including one derived from a photo, video, or audio recording, must treat it as sensitive information under PIPA Art. 23 and obtain separate, specific consent before processing it.
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PIPC), Republic of Korea (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pipc.go.kr/np/cmm/fms/FileDown.do?atchFileId=FILE_000000000560337&fileSn=0&fileExtsn=pdf
- Guidance body
- Personal Information Protection Commission (PIPC), Republic of Korea
- Open questions
- Does biometric data that a model derives from a face but never matches to a known person fall within personal information resulting from specific technical processing of physical, physiological or behavioral characteristics "for the purpose of uniquely identifying that individual" under Article 18, item 3 of the Enforcement Decree of the Personal Information Protection Act?
What it makes you log
Logging duty
Article 23(2) makes a controller that processes sensitive information take the safety measures under Article 29, and Article 29 lists preserving access records among those measures. Article 23 and Enforcement Decree Article 18, the sections this row cites, name no record contents, period, audit or reader of the record. Decree Article 30(1)5 spells out the access record (date and time of access and details of processing), but that sits in a text the row does not cite and is left out of this row. The sections carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- Implicit
- As of
- Provision
- Personal Information Protection Act, Article 23(2)
- Trigger
- personal_data_processing
What this law does
Art. 23 bars processing sensitive information without separate consent or statutory authorization, listing ideology, belief, health, sex life, and trade union or political affiliation directly and delegating further categories to the Enforcement Decree.
Decree Art. 18 adds DNA information, criminal history records, information revealing racial or ethnic origin, and biometric information, defined technology neutrally as data from specific technical processing of physical, physiological, or behavioral characteristics used to uniquely identify a person. That definition covers a faceprint and a voiceprint alike without naming either, and does not exclude an identifier derived from a photo, video, or audio recording.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .