Controversy over the status of insurance planners as ‘personal information processors’… “It depends on who sells it.”

Applicable to personal information processor when entrusted with work by primary insurance company
The key to independent customer information collection, management and operation

The insurance industry's status as a personal information processor was put on the chopping block after the Supreme Court ruled that an exclusive insurance agent belonging to a primary insurance company who was accused of using customers' personal information to change insurance details was not a 'personal information processor.' As corporate insurance agencies (GAs) are pursuing the introduction of specialized insurance sales companies, the analysis is that the identity of the personal information processor varies depending on whether they are independent or entrusted.

According to the financial and legal circles on the 30th, the Supreme Court recently overturned the original decision that convicted Mr. A, an exclusive planner who stole customer personal information and modified insurance contracts, as a personal information processor, and remanded the case back to the Seoul Central District Court. Previously, the first and second trials viewed designer A as a 'personal information processor' and sentenced him to 10 months in prison and two years of probation.

The Supreme Court's reason for overturning the original judgment was that it was necessary to determine whether a person is a personal information processor based on who has the authority to ultimately determine the purpose and means of processing personal information. The key point of the ruling is that the status of personal information processor must have ‘decision authority’ regarding the processing of personal information.

This ruling is also having an impact on the GA industry, which is pushing for the introduction of insurance sales companies, advocating for the so-called ‘separation of manufacturing and sales’ that separates product manufacturing and sales.

Kim Yong-tae, president of the Korea GA Association, said that insurance companies will focus on product development and asset management, and that sales and follow-up management will be handled by a separate specialized company. Experts analyzed that although it will vary depending on the method of introduction, if an insurance sales company establishes its own database to manage customer information and determine a sales strategy, there is a possibility that it will have the status of a personal information processor.

Jeong Jin-yeol, a lawyer at LK Bipyeongsan Law Firm, said, “If product planning and sales are completely separated, the status of the personal information processor is likely to become an insurance sales company.” Currently, GA focuses on agency and brokerage work, but the interpretation is that professional companies have independent responsibility and authority for sales.

Shin Hye-jin, lawyer at Daeryun Law Firm, explained, "If an insurance sales company is entrusted with work from an insurance company and processes customer information, the insurance company maintains its status as a personal information processor as a consignor. On the other hand, if it independently collects and manages customer information and conducts business activities based on this, there is a possibility of forming a joint personal information processor relationship with the insurance company."

An official from the GA Association said, "How and how personal information will be handled when introducing an insurance sales company is something that will be discussed by the authorities or in the process of introducing laws, so it is not possible to judge at this time." However, he added, "If a sales company becomes a company, it will be at the level of a quasi-financial company, so a more strengthened personal information maintenance system will be needed than the GA type, which is an agency."

However, analysis followed that this ruling does not completely eliminate the designer's responsibility. The Supreme Court ruled that even if the defendant is not a personal information processor, he or she may be subject to the penalty provisions under Article 74 of the Personal Information Protection Act. Article 74 stipulates that if an agent or employee of a corporation commits a violation in relation to work, a fine shall be imposed not only on the offender but also on the corporation.

The burden on insurance companies has grown further. Attorney Shin said, "Just because a planner is not a personal information processor does not mean that the agent is completely exempt from punishment. From the insurance company's perspective, this ruling clearly assigned the status and responsibility as a personal information processor, so responsibility for overall management of customer personal information collected and processed through insurance planners has been strengthened." He then emphasized, “Insurance companies, GAs, and planners all need to clearly understand the meaning of the ruling and reexamine their personal information management systems appropriate to their respective legal status.”

[View full article]
Controversy over the status of insurance planners as 'personal information processors'... “It depends on the seller” (Shortcut)