[Lee Jong-woo's Economic Reading] Personal Information Protection and Data Activation Are Not Opposing Concepts

Not Only Direct Identification Codes Recognized as Personal Information
Restrictions on Purpose of Use Under Data 3 Act
Companies Should Be Allowed to Use Freely

The First Industrial Revolution, which began in the late 1700s, was won by those who created or first used the steam engine. The Third Industrial Revolution, which started in the 1970s, was dominated by those who established standards related to computers and controlled software. The fact that the United States became the world leader in IT and Microsoft holds a monopolistic dominance is an example of this.

So, who will be the winner of the Fourth Industrial Revolution? The side that seizes data supremacy is highly likely to dominate the global economy. This is because the success or failure of businesses will depend on how accurately they analyze and predict the world through the vast amounts of data generated by smartphones, CCTV, and various sensors. The reason is simple: only with a foundation of data can one understand what services people need, and only by building products on this foundation can success be achieved. That is why top global companies like Amazon, Google, Facebook, and Alibaba invest heavily in building data centers and expanding servers.

Data also serves as the foundation for companies that were unimaginable in the past. Uber became the world's largest transportation service company with just a data service platform, without owning a single vehicle or repair shop. Airbnb similarly became the world's largest global accommodation service company without owning a single hotel or condo.

Data supremacy also applies to artificial intelligence (AI). AI requires machines to have the ability to make judgments like humans, which can only be built with a source material of data. AI operates by repeatedly learning from an astronomical amount of reliable, high-quality data.

How advanced is South Korea's data industry? According to the 2018 global digital competitiveness ranking released by the International Institute for Management Development (IMD) in Switzerland, South Korea ranks only 31st out of 63 countries in big data utilization. Although it is ahead of Germany (41st) and Japan (56th), it lags behind major advanced countries such as the United States, Denmark, and the United Kingdom. The reason for this lag is that companies do not use data in decision-making. This aligns with a survey showing that only 10% of institutions and companies in South Korea utilized big data by 2018.

Due to sluggish data utilization, investment is also insufficient. As of October last year, there are about 9,700 startups worldwide using big data. The total investment amount is $80 billion, with the United States leading at $62.7 billion, followed by China and the United Kingdom at $5.14 billion and $3.24 billion respectively. Investment in South Korean big data companies is only $280 million, ranking 13th globally. This shows that domestic data investment is incomparable to that of advanced countries.

To overcome this sluggishness, a change in corporate perception of data is essential. So far, data has not played a significant role in increasing corporate sales or profits. This is because the scale of data accumulation is small and the technological level is low. Nevertheless, the pace of development is fast; in global companies, data utilization in management and IT sectors reaches 30%. As data utilization in internal operations, management, and infrastructure construction is expected to increase, South Korean companies need strategies to prepare for this.

For government and corporate cooperation in the industry to be possible, companies must have a willingness to actively utilize data. In May last year, the South Korean government announced plans to create a data-based ecosystem by collaborating between public and private sectors to analyze, distribute data, and discover innovative services. Led by the Ministry of Science and ICT, 150 billion won will be invested over three years to establish 10 sector-specific platforms and 100 institution-specific centers. Since the data industry is central to the innovation economy, more government investment is expected in the future.

On the legal front, enforcement decrees and regulations must be prepared to ensure the smooth implementation of the Data 3 Act, scheduled to take effect in July. In particular, it is necessary to define the scope of pseudonymous information usage. Pseudonymous information refers to falsifying exact information so it cannot be identified, such as changing a name to 'Ganada' or a phone number to '010-1234-5678.' Pseudonymous information has been delayed in implementation because it can be re-identified when combined with other pseudonymous information. Recently, the government created an opportunity to utilize pseudonymous information by allowing only government-designated specialized institutions to perform data linkage to prevent re-identification through data combination.

To support companies entering Europe, responses to the European Union (EU) General Data Protection Regulation (GDPR) must also be finalized. The EU implemented the GDPR in May 1998, allowing only countries with equivalent protection systems to participate in the data market. South Korea has not yet participated in the $80 billion European data market because the independence of its personal information protection control tower has not been secured. In contrast, Japan amended its Personal Information Protection Law in 2015 to meet EU standards and is conducting data business accordingly. Currently, South Korean companies must obtain individual EU approvals to conduct data business in Europe, which is practically impossible.

Protecting personal information and activating data use are not contradictory concepts. Finding a balance between personal information protection and utilization can largely solve the problem. For this, it is necessary to refer to Japan's example. Japan broadly recognizes the scope of personal information. Even if it is not a direct identification code, if combined with other information to infer an individual's identity, the data is classified as personal information. However, Japan allows information to be used in various ways. In contrast, South Korea's Data 3 Act limits the purpose of personal information use to 'statistical compilation, scientific research, public interest record preservation, etc.' This inevitably raises issues about how far companies can use information for commercial purposes, which needs to be clarified.

The scope of public information utilization should be expanded so that financial institutions and general companies can freely use it. However, companies using data must enhance internal control systems such as personal information protection and security incident prevention to ensure people believe their personal information is protected. Otherwise, problems like personal information leaks will continue as they do now. The data era can only be built on a foundation of trust.