"Please Send My Personal Information to Other Companies" Introduction of the Right to Request Personal Data Transfer

Personal Information Protection Commission Submits Amendment to the Personal Information Protection Act to the National Assembly
Introduction of Personal Information Transfer Request Right and Digital-Centered Legal System Reform

[Asia Economy Reporter Eunmo Koo] From now on, individuals will be able to autonomously distribute and utilize their personal information.

The Personal Information Protection Commission announced on the 28th that the amendment to the "Personal Information Protection Act," which was agreed upon within the government at the Cabinet meeting, has been approved and is scheduled to be submitted to the National Assembly within this month. This amendment is the first comprehensive revision led by the government since the enactment of the Personal Information Protection Act in 2011, reflecting diverse opinions from industry, civic groups, and related ministries.

According to the amendment, a new "right to request personal information transfer" will be established, allowing individuals to request the transfer of their information to themselves or third parties. Until now, even if person A wanted to use a new service from company C based on their data accumulated in company B's online shopping mall, data transfer was not possible, making service use difficult. However, under the amendment, A can transfer their data from company B to company C to use new services, and company C can develop and commercialize new data-based services.

The government expects that by introducing the right to request transfer into the general Personal Information Protection Act, the MyData business, currently promoted only in some sectors such as finance and public services, will expand into various fields. It also anticipates alleviating the monopoly phenomenon where data is concentrated in some platform companies and establishing a foundation for diverse economic actors such as startups to safely utilize data.

Furthermore, with the advancement of new technologies such as artificial intelligence (AI), automated decisions are widely used for taxation, welfare eligibility determination, credit rating evaluation, etc. A new "right to respond to automated decisions" will also be established, allowing individuals to refuse or request explanations regarding such decisions.

The right to respond to automated decisions was created to guarantee the data subject's right to respond in order to prevent infringement of individual fundamental rights by automated decisions made against the individual's will. The government plans to introduce the right to refuse and the right to request explanations for automated decisions while clearly defining the scope of application, balancing industrial utility and data subject rights.

Regulations that have caused confusion and double burdens for the general public and companies, such as dual regulation of online and offline and outdated regulations on personal video information processing that do not keep pace with changes in new technology environments, will also be significantly revised to align with digital transformation.

First, despite the blurred boundary between online and offline services, there have been criticisms about dual regulations?offline regulations (general provisions) and online regulations (special provisions)?causing confusion and double burdens in legal application for companies. For example, when a company collects personal information without consent, offline companies face fines up to 50 million KRW, while online companies face fines up to 3% of related sales.

Going forward, the special provisions for information and communication services will be abolished and unified under general provisions, applying the principle of "same act, same regulation" to all personal information processors. Systems such as compensation guarantees, designation of domestic agents, and notification of personal information usage, which were only under special provisions, will be converted to general provisions and expanded to all sectors.

The operational standards for mobile video devices will also be clarified. The current law regulates only fixed video devices (CCTV), so when collecting or using personal information with mobile video devices such as drones or autonomous vehicles, general provisions apply, requiring individual consent from data subjects, which has been criticized for limiting flexible industrial responses.

In the future, using mobile video information processing devices for business purposes in public places to capture personal video information will generally be restricted. However, exceptions will be allowed if there is consent, special legal provisions, or if the subject was aware of the filming and did not express refusal.

Additionally, to respond to changes such as the increase in cross-border transfer of personal information due to the expansion of e-commerce, the system for cross-border transfer of personal information will be improved to meet global standards, and penalties for legal violations will be eased along with the revision of the fine system.

The amendment allows cross-border transfers only to countries or companies recognized as protecting personal information at a level equivalent to Korea’s, and provides grounds to suspend cross-border transfers if violations occur or protection levels are deemed insufficient. Unlike international standards, the current law focuses on penalizing individuals responsible rather than companies regarding personal information protection.

To address these issues, penalties on individuals will be eased while economic responsibilities on companies will be strengthened. In particular, fines will be adjusted to a global standard based on total sales (up to 3%), ensuring proportionality to the violation and effectiveness in preventing infringements. However, reflecting opinions from industry and related agencies, it is clarified that companies that have taken safety measures will be exempt from fines even if personal information is leaked.

Moreover, the amendment includes improvements such as supporting voluntary protection activities by economic actors like companies and revitalizing dispute mediation. Participation of parties in dispute mediation procedures will be mandatory, the independence of internal personal information protection officers will be strengthened, and a foundation for supporting voluntary protection activities will be established through designation of self-regulatory organizations and establishment of federations.

Yoon Jong-in, Chairperson of the Personal Information Protection Commission, stated, "Considering that this amendment was difficult to prepare through coordination with various stakeholders to proactively respond to the digital transformation era, we hope for swift discussions in the National Assembly." He added, "We will continue to improve protection for vulnerable groups such as children and adolescents, and for sensitive information, biometric information, and video information that greatly affect citizens' lives, to ensure that the public’s right to self-determination over personal information is more substantially guaranteed."

This content was produced with the assistance of AI translation services.