Information and Communications Network Act Amendment
Overview
The Information and Communications Network Act (Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.) is a key law enacted in South Korea to ensure the safe use of information and communications networks and protect personal information. The recent amendment was prepared to respond to the rapid development of digital technology, particularly the spread of artificial intelligence (AI) and social media, as well as the sophistication of cybercrime. The main thrust of this amendment is to strengthen the responsibilities of personal information processors, guarantee user rights, and increase the level of punishment for the distribution of illegal information and cyber defamation. Discussed from 2024 to 2025, the amendment is evaluated as an important legislative measure to fill legal gaps in the digital environment and ensure the safe internet use of the people.
Main Contents
1. Strengthening Personal Information Protection
The amendment stipulates more stringent procedures for consent to the collection and use of personal information. In particular, it requires a clear distinction between essential and optional information when obtaining consent and simplifies the consent withdrawal process. Additionally, personal information processors must report data breaches to users and the Personal Information Protection Commission within 24 hours, and penalties for violations are raised to up to 3% of annual revenue. This is a significant increase from the previous 1% and is a measure to substantially enhance corporate data protection obligations.
2. Regulation of Cyber Defamation and Illegal Information
The amendment strengthens penalties for cyber defamation, allowing for imprisonment of up to 7 years or a fine of up to 50 million won if harm occurs due to the spread of false information. Furthermore, to prevent the distribution of illegal information (e.g., deepfake sexual exploitation material, drug transaction information, gambling site promotions), platform operators are obligated to implement monitoring measures, and violations may result in service suspension or fines. In particular, a labeling obligation for AI-generated content has been introduced, requiring users to be able to recognize that the information was created by AI.
3. Protection of User Rights
The amendment strengthens users' right to know and right to self-determination of information. Information and communications service providers must regularly and transparently disclose the status of personal information processing to users, and users can more easily exercise their rights to access, correct, and delete their data. Additionally, to protect the personal information of children under 14, the consent procedure for legal guardians has been strengthened, and services targeting children must take special protective measures.
4. Expansion of Platform Operator Responsibilities
Large platform operators (e.g., portals, social media, e-commerce companies) are required to implement technical and administrative measures to prevent the distribution of illegal information. The amendment designates operators with more than 10 million annual users as 'large-scale information and communications service providers' and applies separate regulations. These operators must report their performance in blocking illegal information quarterly, and violations may result in fines of up to 1% of annual revenue.
5. AI and Algorithm Regulation
With the advancement of AI technology, the amendment demands transparency and fairness of algorithms. Information and communications service providers must disclose the main criteria of recommendation algorithms and take corrective actions if they produce discriminatory or biased results. Additionally, prior consent is required for AI-based personal information analysis (e.g., profiling), prohibiting the analysis of sensitive information without user consent.
Latest Trends
From the second half of 2024 to early 2025, the Information and Communications Network Act Amendment was actively discussed in the National Assembly. In December 2024, the amendment passed the National Assembly's Science, Technology, Information, Broadcasting, and Communications Committee, and after some provisions were revised in the plenary session in January 2025, it is scheduled to be finally passed in March 2025. Key issues were the monitoring obligations of platform operators and the scope of AI regulation. In particular, as sex crimes using deepfake technology emerged as a social problem, the amendment strengthened punishment provisions for the creation and distribution of deepfake content. Additionally, in February 2025, the Personal Information Protection Commission held briefings for companies ahead of the amendment's implementation, encouraging preparation for the new regulations. While the industry welcomes the strengthening of personal information protection, there are also concerns about the regulatory burden on small and medium-sized enterprises. Meanwhile, to align with global trends, a 'data portability right' clause similar to the EU's GDPR is being additionally discussed.
Related Topics
- [[Personal Information Protection Act]]
- [[Cyber Defamation]]
- [[Deepfake Regulation]]
- [[Platform Regulation]]
- [[AI Ethics]]
---
AI-generated document · Community improves together