KFTC Announces and Implements Regulations on Digital Forensic Investigation Procedures

These new rules are intended to increase transparency in the forensic investigation procedures and measures, protect investigated companies’ due process rights, and enhance the security of the collected digital evidence.  

We anticipate that the Forensic Review Rules would enhance the KFTC’s investigation expertise and efficiency.

Significance:

This recent regulatory development comes in the wake of the KFTC’s September 2017 establishment of a new division named “Digital Investigation and Analysis,” housed under its Competition Policy Bureau, and the hiring of a number of technical personnel capable of conducting forensic review.  

Since then, the newly hired forensic experts have been fully engaged and conducting more expansive and aggressive evidence gathering during the initial stage of KFTC investigations.  As such, the KFTC is expected to increasingly utilize its forensic capabilities in future investigations.  In light of this, it will be more important than ever for companies to have in place appropriate procedures and systems for managing documents and give employees clear guidelines on how to manage documents before, during and following a KFTC investigation.

Key Points of the New Forensic Review Rules:

1.   Increased transparency in forensic investigation procedures and measures

The Forensic Review Rules provides detailed procedures regarding the KFTC’s collection, delivery, registration, analysis, management and disposal of forensic evidence.  These rules and standards are designed to protect the integrity of the data and enhance evidentiary value and ensure that the chain of custody remains fully documented after the KFTC’s seizure of the relevant documents.  

For example, the KFTC is required to prepare a note on the content, collection date and hash value of seized materials, must record and manage a list of documents that are destroyed, and must (upon request by the company) provide written confirmation that data have been destroyed.

2.   Stronger protection of due process for investigated companies 

Previously, investigated companies were only entitled to request a copy of extracted documents and protection of personal information.  However, under the Forensic Review Rules, investigated companies may now request that the KFTC collect digital data in their presence and they participate in the data collecting and imaging process.  

Further, they are entitled to receive a copy of extracted image files.  The KFTC is required to accede unless it has a justifiable basis for refusing the request.  

Investigated companies may also request the KFTC to protect personal information, trade secrets and other sensitive information included in seized documents, and the KFTC must engage in good faith discussion with the company regarding the appropriate method of protection.

3.   Enhanced security for collected materials

The Forensic Review Rules provides principles and standards for keeping seized digital data secure and preventing data misuse/disclosure and other security breaches for purposes other than permitted.  For example, the KFTC is required to collect only the minimum amount of data necessary, and officials must not use the data for other purposes or divulge the data to other parties.  

Once the collected data have been registered in a digital forensic system and the analysis of the materials and evidence has been completed, any data remaining in the system must be destroyed to prevent any leakage.  

Also, those who wish to access and use the saved information must explain the reasons for requesting access and receive approval from the Director of the Digital Investigation and Analysis Division, and a log on the basis for and time/date of access must be preserved.

4.   Clarification on R&R among relevant divisions

The Digital Investigation Division will be exclusively responsible for forensic investigations, except that the case management team will be responsible for initially searching, reviewing and seizing digital materials during an on-site investigation.

http://www.kimchang.com/frame2.jsp?lang=2&b_id=88&m_id=81&mode=view&idx=18318&page=1