"Data 3 Laws Nullified by Enforcement Decree: 'Earrings if Hung on Ear, Nose Rings if Hung on Nose'"

[Asia Economy Reporter Seulgina Jo] "Looking at the enforcement decree alone, there is nothing we can do. If that's the case, why revise the law?"

With just over two months until the enforcement of the Data 3 Laws (Personal Information Protection Act, Network Act, and Credit Information Act), the related industry is strongly opposing. Contrary to the initial expectation that data usage would become much easier after the law revision, the subordinate statutes are instead strictly limiting data usage. This has raised concerns that the momentum of the "data economy," which creates new value based on data known as the "oil of the future," may be extinguished. There is also criticism that the government is turning a blind eye to these industry concerns.

According to the industry on the 27th, the Ministry of the Interior and Safety is preparing to announce the legislative notice for the revision of the enforcement decree of the Personal Information Protection Act this week, related to the Data 3 Laws to be enforced on August 5. The Data 3 Laws, passed by the National Assembly earlier this year, introduced the concept of "pseudonymous information" for the first time to activate the data economy, allowing individuals and companies to utilize it. It encourages active use of pseudonymous information as long as real-name verification is not possible. This is regarded as the foundation of the "Korean New Deal" proposed by President Moon Jae-in.

However, looking at the specific contents of the currently disclosed enforcement decree revision, there are criticisms that it strictly regulates usage conditions contrary to initial expectations, failing to realize the purpose of the law revision at all. Although the law was amended to ease data accessibility, the enforcement decree has instead raised barriers. An industry official pointed out, "The enforcement decree contains many ambiguous expressions such as 'substantial relevance,' which can be interpreted in various ways depending on the situation." Excessive restrictions in the enforcement decree of the Personal Information Protection Act also conflict with the enforcement decree of the Credit Information Act. The revision of the Credit Information Act enforcement decree stipulates a relatively simple data combination procedure and clearly defines the level of pseudonymous information processing.

Despite ongoing concerns from experts, the relevant ministries' consistent silence is also problematic. An industry official said, "The Ministry of the Interior and Safety is pushing forward with the enforcement decree without providing any substantial response to the opinions submitted by the industry," adding, "If the enforcement decree is forced through, it will not only increase confusion in the industry but also result in outcomes contrary to the social atmosphere such as the Korean-style Digital New Deal." Kim Jaehwan, Head of Policy at the Korea Internet Corporations Association, said, "Since common criticisms have been raised by academic experts and legal circles, they must be reflected in the enforcement decree revision," and added, "The government should listen to the industry's opinions even now."

▶What are the Data 3 Laws?

The term collectively refers to the Personal Information Protection Act, the Network Act (Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.), and the Credit Information Act (Act on the Use and Protection of Credit Information). They were passed by the National Assembly in January 2020 with the purpose of allowing companies to pursue new businesses by utilizing pseudonymous information processed so that individuals cannot be identified.