Information and Communications Network Act
Overview
The Information and Communications Network Act (full name: Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.) is a law enacted in South Korea to ensure the safe use of information and communications networks and the protection of personal information. Since its enactment in 2001, it has been amended multiple times in response to the rapid development of the digital environment, establishing norms in cyberspace. This law comprehensively regulates the responsibilities of information and communications service providers, the protection of users' rights, and the prevention and response system for cyber intrusion incidents.
Main Contents
Background and Purpose of Enactment
The Information and Communications Network Act was enacted to address various legal issues arising from the spread of the internet and information and communications technology. Its main purposes are to promote the use of information and communications networks, protect the personal information of users of information and communications services, and foster a sound information and communications environment. This law provides a legal basis for responding to various cybercrimes, including the distribution of illegal information via information and communications networks, personal information leaks, cyber defamation, and hacking.
Personal Information Protection Provisions
One of the core aspects of the Information and Communications Network Act is its provisions on personal information protection. Information and communications service providers must obtain consent when collecting, using, or providing users' personal information and cannot use it for purposes other than those for which it was collected. Additionally, they must disclose their personal information processing policies and implement technical and managerial protective measures. In the event of a personal information leak, they must notify users and the Korea Internet & Security Agency (KISA) without delay, and violations may result in fines and criminal penalties. Notably, a 2014 amendment introduced fines of up to 500 million won for personal information leaks, and a 2023 amendment strengthened the obligation to designate a personal information protection officer.
Response to Cyber Intrusions
The Information and Communications Network Act prohibits and penalizes cyber intrusion activities such as hacking, virus distribution, and distributed denial-of-service (DDoS) attacks. Information and communications service providers must establish incident response plans and build and operate security systems. Furthermore, in the event of an intrusion incident, they must analyze the cause and prepare measures to prevent recurrence. The government operates a reporting and response system for cyber intrusion incidents through KISA and implements measures to strengthen the protection of major information and communications infrastructure.
Regulation of Illegal Information Distribution
The Information and Communications Network Act prohibits the distribution of illegal information, including obscene material, illegal gambling, defamation, and harmful content for youth. Information and communications service providers must promptly delete or block access to illegal information upon discovery and may receive corrective orders following deliberation by the Korea Communications Standards Commission. Additionally, users who distribute illegal information are subject to criminal penalties, and recently, penalties for the distribution of deepfake sexual exploitation material have been strengthened.
Responsibilities and Penalties
Penalties for violations of the Information and Communications Network Act vary. Fines for personal information leaks can reach up to 500 million won, and criminal penalties may include imprisonment for up to 5 years or a fine of up to 50 million won. Cyber intrusion activities (e.g., hacking, virus distribution) are punishable by imprisonment for up to 7 years or a fine of up to 70 million won. Distribution of illegal information is punishable by imprisonment for up to 3 years or a fine of up to 30 million won. In particular, a 2024 amendment strengthened penalties for the production and distribution of deepfake sexual exploitation material to imprisonment for at least 5 years.
Recent Trends
From 2024 to 2025, the Information and Communications Network Act has been continuously amended to respond to changes in the digital environment. Key trends are as follows. First, regulations have been strengthened in response to advances in artificial intelligence (AI) technology, with new provisions on AI-based personal information processing and deepfake content. A September 2024 amendment classified the production and distribution of deepfake sexual exploitation material as a serious crime and increased the level of penalties. Second, the responsibilities of platform operators have been expanded, requiring large platforms (e.g., YouTube, Naver) to mandatorily introduce self-monitoring systems to prevent the distribution of illegal information. Third, to strengthen personal information protection, the consent procedures for personal information processing by information and communications service providers have become stricter, and from 2025, separate consent for sensitive information such as biometric data and location information has become mandatory. Fourth, the cyber intrusion response system has been advanced, with the recommendation to introduce AI-based intrusion detection systems and the obligation to report intrusion incidents within 24 hours. Finally, to strengthen international cooperation, extraterritorial application provisions for overseas operators have been expanded, requiring foreign companies providing services to Korean users to comply with the Information and Communications Network Act.
Related Topics
- [[Personal Information Protection Act]]
- [[Cybercrime]]
- [[Korea Communications Standards Commission]]
- [[Korea Internet & Security Agency]]
- [[Deepfake]]
---
AI auto-generated document · Improved by the community