A recent Supreme Court decision has ignited debate over whether insurance agents qualify as 'data controllers' under personal information protection laws.
The case involved an exclusive insurance agent, identified as A, who was indicted for using customer personal information to modify insurance policies. The lower courts had found A guilty as a data controller. However, the Supreme Court overturned the verdict, ruling that the determination of data controller status depends on who has the ultimate authority to decide the purpose and means of processing personal data.
According to financial and legal sources on April 30, the ruling has broad implications for the insurance industry, particularly for the push to separate product manufacturing from sales—a model known as 'jeppanbunri' that would introduce specialized insurance sales companies.
"If product planning and sales are completely separated, the insurance sales company is likely to assume the role of data controller," said Jeong Jin-yeol, a lawyer at LKB Pyeongsan Law Firm.
Shin Hye-jin, a lawyer at Daeryun Law Firm, noted that if the sales company is merely entrusted by the insurer to process customer data, the insurer retains its data controller status. But if the sales company independently collects and manages customer data and uses it for its own sales activities, it could become a joint data controller with the insurer.
A representative from the GA (General Agent) association refrained from commenting, stating, "We cannot determine whether the scope of data processing will expand or remain similar without seeing the final regulations. The law hasn't even passed yet."
The decision is expected to influence the ongoing debate over the introduction of dedicated insurance sales companies and their responsibilities under personal information protection laws.