Stricter Personal Information Responsibility for Overseas Operators... Domestic Representative Requirements Clarified

Enforcement Decree Amendment of the Personal Information Protection Act Approved at Cabinet Meeting

From now on, overseas operators will also be required to designate a domestic representative responsible for handling personal information processing work. Local government-funded and invested institutions will also be included among public institutions subject to the Personal Information Protection Act.

The Personal Information Protection Commission announced on the 16th that a revised enforcement decree of the Personal Information Protection Act containing these provisions was approved at a Cabinet meeting. This amendment outlines detailed standards that large-scale overseas operators must follow when designating, managing, and supervising a domestic representative. The revised decree is scheduled to take effect on October 2.

Personal Information Protection Commission logo.

The domestic representative designation system was introduced to ensure that overseas operators providing services in Korea address complaints and provide remedies for damages related to Korean citizens’ personal information. In April, an amendment to the Personal Information Protection Act was passed, establishing requirements for overseas operators to designate a domestic representative and specifying their management and supervision responsibilities. This came in response to concerns that the domestic representative system was being operated in a largely formal manner.

Under the revised law, if an overseas operator (headquarters) has a corporation established in Korea or a domestic corporation over which it exercises dominant influence, it must designate one of these domestic corporations as its domestic representative. The law also imposes an obligation to manage and supervise the domestic representative to ensure that its work is performed diligently.

Through this enforcement decree revision, specific designation requirements and the details of management and supervision have been clarified. The requirements for a “domestic corporation exercising dominant influence over executive composition or business operations” include: ▲ a corporation that can appoint or dismiss the CEO, or appoint or has the authority to appoint at least 50 percent of the executives; ▲ a corporation that has invested at least 30 percent of the total issued shares or total capital contribution.

Additionally, the scope of public institutions under the Personal Information Protection Act has been expanded to include local government-funded and invested institutions. This aims to strengthen the responsibility for personal information protection at these institutions, which are established and operated with financial support from local governments. Newly designated public institutions must register their personal information files within 60 days from the effective date. If subject to a personal information impact assessment, they must conduct the assessment and submit the results within two years from the effective date.

A representative from the Personal Information Protection Commission stated, "This enforcement decree revision will provide substantial assistance in remedying damages related to the handling of personal information for Korean citizens and strengthening personal information protection at local government-funded and invested institutions."

Lee Jungryul, Secretary General of the Personal Information Protection Commission, said, "We will continue to provide guidance to overseas operators and local government-funded and invested institutions regarding the changes resulting from this enforcement decree revision, and will strive to ensure the stable establishment of the revised domestic representative system through regular inspections and ongoing support."