Data 3 Laws Hindered by Enforcement Decree... Setback to 'Digital New Deal' (Comprehensive)

[Asia Economy Reporter Seulgina Jo] "Looking at the enforcement decree alone, there is nothing we can do. If that's the case, why revise the law?"

With just over two months until the enforcement of the Data 3 Laws (Personal Information Protection Act, Information and Communications Network Act, Credit Information Act), the related industries are strongly opposing. Contrary to the initial expectation that data usage would become much easier after the law revision, the subordinate legislation is instead strictly limiting data usage. This has raised concerns that the momentum of the "data economy," which creates new value based on data known as the "oil of the future," may be extinguished. There is also criticism that the government is turning a blind eye to these industry concerns.

According to the industry on the 27th, the Ministry of the Interior and Safety is preparing to announce the legislative notice for the revision of the enforcement decree of the Personal Information Protection Act this week, related to the Data 3 Laws to be enforced on August 5. The Data 3 Laws, passed by the National Assembly earlier this year, introduced the concept of "pseudonymous information" for the first time to activate the data economy, allowing individuals and companies to utilize it. It is also regarded as the foundation of President Moon Jae-in’s "Korean New Deal."

However, looking at the specific contents of the currently disclosed enforcement decree revision, it is pointed out that the utilization conditions are strictly regulated contrary to initial expectations, failing to realize the purpose of the law revision at all. It is even difficult to find companies preparing related businesses ahead of full enforcement. The enthusiasm seen at the time of the National Assembly’s passage has completely disappeared, and even the businesses that were under review are being postponed. This proves that the enforcement decree does not reflect the purpose of the law revision. The Data 3 Laws, which aimed to open the way for pseudonymous information utilization and foster the big data industry, are being hampered by subordinate legislation.

◆"Difficult to Utilize Information" Examining the Problematic Clauses= The most controversial is Article 14, Paragraph 2, which deals with additional use and provision standards of personal information. To use personal information additionally, it must have a "substantial relevance" to the original collection purpose and must not infringe on the "interests of third parties." At the same time, additional use must be predictable based on "processing practices." Furthermore, by mandating pseudonymization even in cases where it is not required, all four conditions must be met, leading to criticism that there is practically little information that can be utilized.

This is much stricter than the European Union’s (EU) General Data Protection Regulation (GDPR), which is recognized as a global standard. Especially, ambiguous terms such as "substantial relevance," "based on practices," and "interests of third parties" are used multiple times in the enforcement decree, increasing corporate confusion. Since failure to legally prove "substantial relevance" and "based on practices" can lead to criminal penalties, there is an outcry that businesses must wait for court precedents before proceeding. This is why the criticism that the law is "like earrings when hung on ears, nose rings when hung on noses" is widespread.

Kim Jaehwan, Policy Director of the Korea Internet Corporations Association, pointed out, "If all four conditions must be met, it is difficult to apply in actual work," calling it "excessively rigid." Lawyer Jang Junyoung of Sejong Law Firm also recently attended a related seminar and said, "It is stricter than the EU GDPR," adding, "Whether information can be used depends on individual cases, and there are many gray zones."

Regarding the pseudonymous information combination procedure (Article 29), criticism has arisen that limiting the physical space where data combination is possible is an outdated idea. Unlike the Credit Information Act, which only passes through a specialized combination institution, the Personal Information Protection Act requires passing through two places, making it complicated.

◆Will It Remain a "Glittering Apple"? Industry Pushback= The problem is that despite repeated criticism, the current revision may be pushed through as is. The Ministry of the Interior and Safety is proceeding with the legislative notice without clear responses to opinions submitted by the industry during the enforcement decree and notice revision process. It is reported that the opinion collection process was insufficient even during the joint online forum held late last month by the Ministry of the Interior and Safety, the Korea Communications Commission, and the Financial Services Commission, the main ministries responsible for the Data 3 Laws.

An official who attended the forum said, "Many experts from academia and industry proposed numerous amendments, but the related ministries have remained silent," expressing concern that "we cannot even know the progress, causing confusion." If pushed through as is, it is pointed out that the confusion in the industry will worsen and the law will go against the social atmosphere such as the Korean-style Digital New Deal. A Korea Communications Commission official said, "These are all commonly pointed out issues," but refrained from commenting on the possibility of revising the problematic clauses.

According to market research firm IDC, the data-related market size is expected to grow from about $166 billion in 2018 to $260 billion in 2022. While a data trading market worth 200 trillion won has been activated mainly in the private sector in the U.S., Korea, which claims to be an ICT powerhouse, is criticized for being hampered by potential violations of personal information laws and unable to conduct proper activities. In the "World Digital Competitiveness Ranking 2019" released by the Swiss International Institute for Management Development (IMD), Korea ranked high overall but was 40th out of 64 countries in the "big data utilization and analysis" category. The data industry is especially considered a sector that must be activated for Korea to become an AI powerhouse emphasized by the government.

Experts raise their voices that the enforcement decree must reflect the purpose of the parent law, as the Data 3 Laws can be the core of the Korean New Deal and digital infrastructure construction that the government is currently promoting. Director Kim also said, "Since common criticisms were raised by academic experts and the legal community, they must be reflected in the enforcement decree revision," adding, "The government must listen to industry opinions even now."