1 Year Since Launch, Personal Information Commission Accelerates Establishment of Privacy Laws Related to New Technologies

1st Anniversary Press Conference of the Personal Information Protection Commission

Yoon Jong-in, Chairman of the Personal Information Protection Commission, is delivering a greeting at the press conference commemorating the 1st anniversary of the Personal Information Protection Commission, held on the morning of Wednesday, August 4, at the government office located in Jongno-gu, Seoul, in a non-face-to-face online meeting format.

[Asia Economy Reporter Eunmo Koo] As digital transformation in daily life accelerates due to COVID-19, raising concerns about personal information protection, the Personal Information Protection Commission (PIPC), launched as a control tower, has marked its first anniversary. Over the past year, the PIPC has achieved results such as raising awareness of personal information protection and expanding the use of pseudonymized information. Moving forward, the commission plans to expedite the legislation of amendments to the Personal Information Protection Act and actively promote core policies, including establishing personal information protection regulations related to new technologies.

On the morning of the 4th, the PIPC held an online press briefing to mark its first anniversary, sharing major policy achievements and discussing the commission’s future policy directions. The PIPC was established last August as a central administrative agency by unifying personal information protection functions that had been dispersed across the Ministry of the Interior and Safety, the Korea Communications Commission, and others.

One Year Since Launch: Strengthening Personal Information Protection Amid COVID-19 Crisis... Strict Sanctions on Violations

Chairman Yoon Jong-in first pointed out that the PIPC was launched after the COVID-19 pandemic and contributed to strengthening the protection of personal information processed during quarantine procedures. Chairman Yoon said, “We strengthened protective measures for personal information handled throughout COVID-19 quarantine, including the introduction of personal safety numbers, improvements to handwritten entry logs, simplification of consent procedures for electronic entry logs, and system inspections. We have worked to firmly protect the public’s valuable personal information to alleviate concerns about privacy infringement.”

He also emphasized that violations of the law were strictly sanctioned to encourage safe handling. The PIPC imposed the largest-ever fine (6.7 billion KRW) on the global company Facebook for illegal activities and, for the first time, sanctioned new technology companies such as the developer of the AI ‘Iruda,’ investigating and taking action on a total of 106 cases.

Chairman Yoon clarified the principle that personal information protection laws will be strictly enforced regardless of whether the business operator is domestic or overseas. However, he noted, “Even in the case of Facebook, it is true that difficulties arise in obtaining necessary materials during investigations due to the characteristics of overseas operators.” He added, “Through the second amendment to the Personal Information Protection Act, we will raise the basis for imposing fines from the current 3% of related sales to 3% of total sales and improve the fairness and efficiency of investigations and sanctions in line with global standards.”

He also evaluated efforts to support the safe utilization of data to enhance its value. He highlighted the achievement of the European Union’s (EU) initial adequacy decision under the General Data Protection Regulation (GDPR). Chairman Yoon said, “With the establishment of the PIPC, the independence of the supervisory authority required by the EU was secured, leading to the initial adequacy decision by the EU, which had been stalled since 2017. We expect this will significantly reduce the time and cost burdens for domestic companies entering EU member countries.”

He also mentioned that the effectiveness of pseudonymized information utilization is becoming visible. Chairman Yoon explained, “The PIPC has laid the institutional foundation by designating a total of 17 specialized data integration agencies to promote the spread of pseudonymized information use. We have driven an increase in data integration cases and diversification of integration fields by promoting seven pilot projects in five major areas closely related to public life, such as predicting and managing complications in lung cancer survivors.” The number of pseudonymized information integration cases increased significantly from 30 last year to 105 as of July this year.

Preparing Amendments to the Personal Information Protection Act... Expanding Protection Legislation Related to New Technologies

The PIPC plans to continue focusing on establishing its status and role as the ‘national control tower’ for personal information policy. To this end, the commission emphasized that it has prepared the second amendment to the Personal Information Protection Act to strengthen data subject rights in the digital era, including the introduction of the right to data portability, and to ensure consistency with global regulations by shifting from penalty-based sanctions to economic penalties.

The PIPC plans to expedite the related legislative process. Chairman Yoon said, “The second amendment has completed internal government consensus and will be submitted to the National Assembly after passing the Cabinet meeting. Currently, 26 legislative bills have been submitted to the National Assembly, and we will work to integrate and review these bills to ensure passage within this year.”

He added, “Alongside legislative promotion in the National Assembly, we will prepare subordinate legislation such as enforcement ordinances related to the main contents of the amendment and implement follow-up measures, including establishing governance for the introduction and operation of MyData across all sectors related to the introduction of the right to data portability.”

Given the rapid digital transformation after COVID-19, the PIPC also plans to focus on establishing personal information protection legislation related to new technologies. First, by September, it aims to prepare a revised guideline for the protection of bioinformation, and in November, it plans to prepare new legislation related to autonomous vehicles and smart cities. Additionally, the commission will foster and support specialized research and development (R&D) for personal information protection, such as supporting the development of Privacy Enhancing Technology (PET) that enhances safe personal information protection, which the public can tangibly experience.

Chairman Yoon said, “Rather than being a fast follower, we aim to play the role of a first mover. Through the preparation of personal information protection guidelines responding to new technological developments, we plan to actively support achieving a balance between personal information protection and safe utilization in the digital transformation era.”

Previously, the PIPC revised the ‘Video Information Processing Device Guidelines’ to allow guardians to view original CCTV footage from daycare centers when confirming child abuse cases, and prepared the ‘AI Personal Information Protection Self-Inspection Checklist’ to support AI companies in properly handling personal information when developing and operating services.

Surge in Personal Information Infringement Cases... Limitations Due to Insufficient Personnel

Yoon Jong-in, Chairman of the Personal Information Protection Commission (second from the right in the photo), is conducting a Q&A session on major policies under the jurisdiction of the Personal Information Protection Commission at a press conference marking the first anniversary of the Commission's launch. The event was held on the morning of Wednesday, August 4, at the government office building located in Jongno-gu, Seoul, in a non-face-to-face online meeting format.

With the rapid digital transformation due to COVID-19, the number of personal information infringement investigations is rapidly increasing. Along with the spread of AI technology and the use of pseudonymized information, the role of the PIPC is expected to grow further. Although the commission’s role is expanding, concerns have been raised about work overload due to insufficient personnel. Currently, the total number of PIPC staff is around 150.

When the PIPC was launched last year, it received a total of 337 infringement investigation cases transferred from the Ministry of the Interior and Safety and the Korea Communications Commission, which previously handled personal information infringement investigations. Over the past year, it has deliberated, resolved, and taken action on 106 cases. However, due to the rapid digital transformation caused by COVID-19, personal information infringement cases, consultations, and reports have surged, and administrative demand related to investigations and sanctions is also rapidly increasing, thereby increasing the PIPC’s workload.

Chairman Yoon said, “The PIPC is mobilizing maximum personnel and resources to conduct infringement investigations, but it is true that there are some limitations in response personnel compared to the rapidly increasing infringement cases. Since there is a consensus on the need for additional personnel, we are consulting with the Ministry of the Interior and Safety and other related ministries about increasing investigators.”

This content was produced with the assistance of AI translation services.