[Asia Economy Reporter Osangdo] The government is accelerating the subordinate legislation to ensure the successful implementation of the 'Data 3 Act,' which passed the National Assembly on the 9th. The enforcement decree and enforcement rules prepared by the government will include sector-specific guidelines on the use and protection of pseudonymized information.
The Ministry of the Interior and Safety, the Korea Communications Commission, the Financial Services Commission, and the Personal Information Protection Commission held a joint briefing at the Government Seoul Office on the 21st to announce follow-up measures regarding the Data 3 Act. The Data 3 Act refers to the amendments to the Personal Information Protection Act, the Credit Information Act, and the Information and Communications Network Act concerning the use of personal information.
The Data 3 Act was stalled in the Legislation and Judiciary Committee of the National Assembly amid political confrontation between ruling and opposition parties, but was approved in the plenary session earlier this month after the new year. The core of the Data 3 Act is to specify the grounds for using pseudonymized information and to unify the law enforcement system. It allows the use of information without the consent of the data subject under appropriate safety measures for statistical compilation, scientific research, and public interest record preservation.
To this end, the government plans to clearly define the scope of use of ‘pseudonymized information’ in the newly introduced enforcement decree and rules. The methods and procedures for data linkage of pseudonymized information will also be specified in detail. Pseudonymized information refers to information processed by deleting or replacing parts of personal information so that individuals cannot be identified without additional information.
Safety measures will also be strengthened when pseudonymized information is used. Since the possibility of re-identification increases as multiple pseudonymized data are linked, data linkage will be designated to be conducted only by specialized institutions appointed by the state to prevent re-identification. Furthermore, principles such as prioritizing anonymization when exporting linked data externally will be established and included in the enforcement decree.
Additionally, the scope in which pseudonymized information can be provided to third parties without the consent of the data subject will be communicated through guidelines and legal interpretation manuals.
Moreover, to reduce the burden on companies operating in the European Union (EU), the adequacy assessment procedure under the EU’s General Data Protection Regulation (GDPR) will be completed in line with the enforcement of the law. The government plans to visit the EU Commission and the European Parliament early next month to issue a joint statement regarding this matter.
The adequacy assessment is a system by which the EU evaluates the level of personal data protection in partner countries based on the GDPR. If the assessment is passed and an adequacy decision is made, companies in the respective country are allowed to transfer personal data collected in the EU overseas. Otherwise, individual companies bear the administrative burden of signing standard contracts.
The relevant ministries plan to finalize the amendments to the enforcement decree and enforcement rules by March at the latest. The follow-up legislative procedures, which take four to five months, will also be promptly prepared in detail. Reflecting the characteristics of each sector such as medical information and credit information, a draft will be created by April focusing on specific cases, and the final version will be prepared by July when the Data 3 Act is enforced.
This work will be promoted through the joint 'Legislative and Institutional Improvement Task Force' established within the Data Economy Activation Task Force (TF) composed of related ministries.
Yoon Jong-in, Vice Minister of the Ministry of the Interior and Safety, said, "Although the Data 3 Act has established an institutional foundation to prepare for the Fourth Industrial Revolution, it is important to present clear standards and interpretations," adding, "We will present specific guidelines under the fundamental premise of balancing personal information protection and data utilization."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
