Law note · South Korea
Personal Information Protection Act, sensitive information and biometric data
Art. 23 bars processing sensitive information without separate consent or statutory authorization, listing ideology, belief, health, sex life, and trade union or political affiliation directly and delegating further categories to the Enforcement Decree.
Decree Art. 18 adds DNA information, criminal history records, information revealing racial or ethnic origin, and biometric information, defined technology neutrally as data from specific technical processing of physical, physiological, or behavioral characteristics used to uniquely identify a person. That definition covers a faceprint and a voiceprint alike without naming either, and does not exclude an identifier derived from a photo, video, or audio recording.
What it asks of an app
- An app that derives a faceprint, voiceprint, or other unique biometric identifier from a Korean data subject, including one derived from a photo, video, or audio recording, must treat it as sensitive information under PIPA Art. 23 and obtain separate, specific consent before processing it.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, trains_models, crawls_web
Primary source: official statute and Enforcement Decree text, KLRI English translation