Controversy Over Data 3 Laws Blocked by Enforcement Decree, What Are the 'Toxic Clauses'?

[Asia Economy Reporter Seulgina Jo] Controversy continues to surround the Data 3 Laws (Personal Information Protection Act, Information and Communications Network Act, Credit Information Act) scheduled to be implemented in August. Amid strong opposition from academia and industry, there are criticisms that these laws run counter to the recently announced 'Korean New Deal' by the Moon Jae-in administration. What is the reason that the Data 3 Laws, which were expected to open the door to the data economy era when passed by the National Assembly earlier this year, have come under scrutiny during the process of preparing subordinate statutes?

The main subject of controversy is the amendment to the Enforcement Decree of the Personal Information Protection Act. Looking at the specific contents of the currently disclosed amendment to the Enforcement Decree, it is pointed out that, contrary to initial expectations, the use conditions are strictly regulated, failing to realize the purpose of the law amendment at all. The Data 3 Laws, which aimed to pave the way for the use of pseudonymized information and foster the big data industry, have been hampered by the subordinate statutes.

Within and outside the industry, Article 14-2 of the amended Enforcement Decree of the Personal Information Protection Act is cited as a poison clause. According to the amendment, when personal information is additionally used or provided without the consent of the data subject, all four conditions must be met: ▲significant relevance to the original purpose ▲predictability of additional use ▲prevention of infringement on third-party interests ▲obligation of pseudonymization. It is much stricter than the European Union's General Data Protection Regulation (GDPR), which is currently recognized as the global standard, including mandating pseudonymization even in cases where it is not necessary.

In particular, ambiguous terms such as 'significant relevance,' 'in light of customary practice,' and 'third-party interests' are used multiple times within the Enforcement Decree, further increasing confusion among companies. Since failure to legally prove 'significant relevance' and 'in light of customary practice' may result in criminal penalties, there is an outcry that businesses must wait for court precedents before proceeding. This has led to criticism that the law is "like earrings when hung on the ear, and nose rings when hung on the nose," meaning it can be interpreted arbitrarily. One startup official sighed, "Small and medium-sized enterprises are too worried about getting involved in legal disputes to even consider it."

Article 29-2 related to the pseudonymized information combination procedure is also complicatedly regulated to pass through both the linkage information generating institution and the specialized combination institution, unlike the Credit Information Act, which only passes through the specialized combination institution. The limitation of combined information to a physical space within the specialized combination institution is also criticized as an outdated idea that hinders smooth data combination.

Moreover, unlike the Personal Information Protection Act, the amendment to the Enforcement Decree of the Credit Information Act clearly defines the level of pseudonymized information processing, so confusion in the industry is inevitable. Unlike the Credit Information Act, which only passes through the specialized combination institution, the Personal Information Protection Act is complicatedly regulated to pass through two institutions.

At a hacking security seminar held at the National Assembly late last month, Attorney Koo Tae-eon of Law Firm Lin stated, "There is no clear guideline on the level of pseudonymization required to avoid legal issues with pseudonymized information," and "Since the scope of use is not clearly specified with a clear purpose, there will be practical difficulties in utilization."

The Data 3 Laws are considered key legislation for the Korean-style New Deal policy and digital infrastructure construction recently promoted by the government. According to a survey conducted by the Presidential Committee on the Fourth Industrial Revolution, 79.9% of the public have experienced big data-based services in daily life, and 91.4% responded that these services are useful in their lives. According to market research firm IDC, the data-related market size is expected to grow from $166 billion in 2018 to $260 billion in 2022. It is considered an essential sector for the government's emphasis on the Fourth Industrial Revolution and the leap to an artificial intelligence (AI) powerhouse.

Experts raise their voices that for the Data 3 Laws to successfully promote the recently announced Korean New Deal, it is essential that the Enforcement Decree reflects the legislative intent of the parent law. In particular, they point out the need to clarify ambiguous phrases and further simplify the procedures for utilizing and combining pseudonymized information.

Kim Jaehwan, Policy Director of the Korea Internet Corporations Association, emphasized, "The current amendment to the Enforcement Decree is excessively rigid," and added, "Since common criticisms have been raised by academic experts and the legal community, the amendment to the Enforcement Decree must be revised."