Details of the inquiry
I recently became responsible for information protection work, and as the person in charge I wonder what the related laws are.
I am worried about whether we are violating related laws while operating paid services on the company’s website and smartphone app.
Where and how should we start? If the company does not take action, will a major problem arise immediately?
If there are cases from other companies, introducing some of them would be a great help.
In general, legal issues at the company level are reviewed through the legal team or a law firm that is under contract.
Legal issues related to the company’s business are very serious matters that can determine the continuity of the company’s operations.
Therefore, general legal issues should proceed only after the legal team or a law firm reviews every related legal element at the business-planning stage.
(1) Request a formal legal review from the legal team or a law firm – inquire about the points of concern as the person in charge
(2) Share what was considered in operating the website and smartphone app services, or re-review amended laws
If there is no legal team or a contracted specialist law firm, you can receive specialist consulting.
Through a specialist consulting service on laws related to the information protection sector, compliance for system operation can be identified comprehensively.
Here, compliance includes the numerous statutory provisions that an organization must observe in order to conduct business, together with related enforcement decrees, enforcement rules, notifications and standards, guidelines, and similar materials.
Through specialist consulting, a detailed inspection is possible that covers every statutory provision, including parts that are in violation or that have the potential for violation.
– What laws are related to the company’s operation of web/app services?
– What statutory provisions exist in each related law?
– What technical standards or guidelines exist for complying with the related statutory provisions?
– What violations need to be remediated urgently?
– What happens with administrative fines or penalty surcharges?
(*) Through a detailed understanding of the current status as above, serious legal violations can be remediated in advance, and tangible and intangible costs that could arise later can be reduced in advance.
As the information protection officer, you can organize a TF with the people involved and identify the issues yourselves.
First, you can briefly look up on the internet what the related laws are.
Representative information protection laws are the Information and Communications Network Act and the Personal Information Protection Act, and when electronic commerce occurs, more laws are involved, including the Electronic Financial Transactions Act.
If you first collect preliminary information as the person in charge, it will feel too much for one person to handle. We recommend reporting this matter to your superior and forming a TF.
(1) How far should the scope of related laws extend?
– You need to identify what related laws exist besides the Information and Communications Network Act and the Personal Information Protection Act.
(2) What are the relevant statutory provisions among the related laws?
– You need to identify and interpret the statutory provisions of the related laws from the company’s perspective. At this time, you should maintain an objective viewpoint as much as possible.
(3) What methods exist for complying with the related statutory provisions?
– You need to identify specific standards, notifications, and guidelines for complying with the legal standards technically.
* Business and related inquiries: T) 02-322-4688, F) 02-322-4646, E) info@wikisecurity.net