[Asking the Path to Data Economy] Gave Up After 6 Years of Litigation, "Missed the Blue Ocean"

Asia Economy-Korea Data Law Policy Association Joint Project
(1) ICT is a Strong Nation, Data is a Backward Nation

[Asia Economy Reporter Seulgina Jo] South Korea, known as an ICT powerhouse, continues to lag behind in the data competition, often called the "oil of the future." While overseas companies swiftly seize dominance based on user data, Korean firms are held back by regulations, gradually falling behind in the blue ocean of the "data economy." Critics point out that excessive regulations in our society stem from an outdated mindset that views data not as an innovative value fundamental to the Fourth Industrial Revolution but merely as an object of state power management and control. While the world is fostering the data economy to secure the "oil of the future," we are piling up regulations and ironically labeling ourselves a "data underdeveloped country."

◆"Is Korea Really an ICT Power?" Regulations Stifling Innovation= According to business and legal circles on the 18th, excessive legal regulations compared to global standards repeatedly hinder domestic companies' use of data. A representative case involved a pharmaceutical company (Company A) that encrypted and collected patients' prescription information and resident registration numbers for time-series analysis but was prosecuted by the prosecution. Earlier this year, the court acquitted the company, ruling that the sensitive information in question was processed with two layers of encryption, making personal identification difficult, and no intentional wrongdoing was recognized. However, Company A was exhausted after six years of litigation. Legal experts evaluated this as a case where the concept of personal information was interpreted too strictly and viewed excessively from the perspective of protecting data subjects, hindering big data utilization.

Major companies such as Hyundai Motor Company, SK Telecom, and Samsung Life Insurance, which followed government guidelines, were also collectively sued. This occurred shortly after relevant ministries issued the "Personal Information De-identification Guidelines" in 2016 to enable safe use of big data under the Personal Information Protection Act (PIPA). The following year, companies began planning new businesses that could break down industry barriers based on these guidelines. However, civic groups filed mass complaints with the prosecution against four institutions including the Korea Internet & Security Agency (KISA) and 20 companies including Hyundai Motor Company, SK Telecom, and Samsung Life Insurance for violating PIPA, causing turmoil. Although the case was dismissed in March this year, it dampened companies' data-driven innovative management.

Such cases where excessive regulations block innovation are fueling controversy ahead of the implementation of the Data 3 Act (Personal Information Protection Act, Information and Communications Network Act, Credit Information Act) scheduled for August. Contrary to the government's pledge to "let data flow like water" once the Data 3 Act passes the National Assembly, the subordinate laws of the Data 3 Act are instead imposing stricter limits on data use.

A representative from a major domestic law firm expressed frustration, saying, "As the Data 3 Act implementation approaches, companies keep asking for legal interpretations, but honestly, it is very difficult to provide answers at this point." Kim Jaehwan, Policy Director of the Korea Internet Corporations Association, sighed, "Even pseudonymous information, which does not require consent if individuals cannot be identified, is strictly limited in terms of usage purposes under the current amendment. If large companies struggle, how can small and medium enterprises or startups cope?"

◆"Contrary to the Law's Purpose" Criticism Ignored= The most controversial part ahead of the Data 3 Act implementation is the amendment to the enforcement decree of the PIPA. The Ministry of the Interior and Safety postponed the scheduled announcement at the end of last month and entered an additional opinion-gathering process after criticism that the enforcement decree contradicts the original purpose of revitalizing the data economy. Regarding Article 14, Paragraph 2 of the enforcement decree, considered a toxic clause, the likely amendment is to remove the word "all" from the provision requiring all four conditions to be met when using or providing personal information without consent. Additionally, efforts are underway to clarify ambiguous phrases such as "substantial relevance" and "in light of customary practice."

However, experts criticize that as long as the overall framework of the current amendment remains, even if some phrases are modified, it will be difficult to create value in the data economy. Legal scholars point out that "even if the discussed parts are reflected, if examples of usage desired by companies do not emerge, fundamental problems cannot be resolved." This implies a wasteful process of having to observe court rulings for several years to understand actual usage standards. Attorney Koo Tae-eon of Law Firm Lin expressed frustration at a Data 3 Act forum hosted by the Citizens' Coalition for Realization of Science and Technology, saying, "It will be hard to find sufficient cases or examples to resolve companies' doubts before August 5, and it is uncertain which side courts will favor in legal disputes."

Cho Kwang-hyun, President of the Korea Data Industry Association and operator of a big data company, argued, "Most small and medium enterprises and IT companies do not know the details of laws related to data use. Except for absolutely necessary ethical standards and legal measures for problematic cases, regulations should be boldly relaxed." In response, the Personal Information Protection Commission stated, "We plan to finalize guidelines and release explanatory materials after the law's implementation in August," adding, "We will strive to minimize industry confusion while also protecting personal information."

◆The World Has Already Entered the 'Data Economy'= While we are floundering, data economies worldwide are rapidly advancing. McKinsey reported in 2016 that economies connected internationally based on data gain over 40% higher profits compared to less connected economies.

It is also analyzed that a 1% increase in corporate efficiency due to data could add $15 trillion to the global GDP by 2030, equivalent to twice the size of the U.S. economy. The European Union (EU) expects the impact of the data economy to exceed 1 trillion euros, accounting for 6% of GDP by 2025. Research also shows that one data-related job in the U.S. creates three indirect jobs.

The Moon Jae-in administration recently proposed the Korean New Deal as part of its "post-COVID" measures, with a significant portion of the Digital New Deal focused on big data and artificial intelligence (AI) data.

Cross-border data trade is also rapidly increasing. In 2007, traditional international trade of goods and services accounted for over 50% of global GDP, but since 2014, it has fallen below 40%. The Global Software Alliance (BSA) views the data-driven economy as playing a key role in creating new jobs, industries, and innovative technologies, accelerating future economic growth.

Lee Sung-yeop, President of the Korea Data Law and Policy Association and professor at Korea University Graduate School of Technology Management, advised, "Countries like the U.S. and China are ahead in data utilization by adopting negative regulatory policies that generally allow new services and prohibit exceptions. We must also quickly adopt a data economy system that removes regulations and encourages innovation."

Regarding concerns about personal information leaks during pseudonymous data use, he added, "The current PIPA amendment includes much stronger penalties than other countries. We should not block the utility of using cars out of fear of accidents. The goal should be the safe 'utilization' of data."