South Korea proposes significant changes to personal data protection laws
South Korea is taking steps to enhance personal data protection. The Personal Information Protection Commission (PIPC) has released a draft decree proposing important changes to the Personal Information Protection Act. The decree aims to strengthen consent requirements, unify online/offline data processing standards, and establish criteria for assessing violations. It also introduces stricter regulations for data breaches, cross-border transfers, and the public sector.
The Personal Information Protection Commission (PIPC) in South Korea has released a draft decree for public consultation, proposing changes to the Personal Information Protection Act (PIPA). The draft decree aims to enhance citizens’ rights to control the processing of their personal data. It emphasizes the importance of obtaining freely given consent from data subjects and ensuring clear communication about their right to consent. The draft decree also seeks to establish a “technology-neutral” approach, unifying online and offline personal data processing regulations to align with the digital society.
Furthermore, the draft decree introduces criteria for assessing the severity of Personal Information Protection Act (PIPA) violations, including the nature and degree of the violation, the type of personal data affected, and the impact on the data subject. It also requires timely notification of data breaches to the PIPC and affected data subjects within 72 hours, regardless of the breach’s scale.
Regarding cross-border data transfers, the PIPC will have the authority to issue stop orders to prevent or halt non-compliant transfers. The draft decree also imposes stricter data protection standards on the public sector, including personal data file registrations, impact assessments, and implementing safety measures.
Businesses processing personal data in South Korea will be affected by these proposed amendments and need to ensure compliance before the updated law takes effect. The public can provide comments and feedback on the draft decree until 28 June 2023.
About author
DW Team
The GIP Digital Watch Observatory team, consisting of over 30 digital policy experts from around the world, excels in the fields of research and analysis on digital policy issues. The team is backed by the creative prowess of Creative Lab Diplo and the technical expertise of the Diplo tech team.