[Asking the Way to the Data Economy - Opinion] Pseudonymized Information Must Align with the Purpose of the 'Information Utilization' Law

Data economy has become one of the most important topics in our society. The buzzword "Digital New Deal" is also frequently heard. The core of the data economy is "information utilization" and the resulting "value creation." Here, "information utilization" serves as the means of the data economy, and "value creation" corresponds to the outcome. To create value through innovative information utilization, meaningful information analysis is essential, and almost all meaningful information is personal data. However, existing personal data-related laws in Korea have rarely recognized exceptions for commercial use beyond the consent of the data subject, which is very rare globally.

Meanwhile, as can be easily seen from various overseas cases, others have already begun to reap the fruits of "value creation" in the data economy in areas such as big data and artificial intelligence (AI), and even larger-scale results are expected in the future. Therefore, we can no longer just watch and have newly introduced the concept of pseudonymous information to support "information utilization" during the recent amendment of the three data laws (Data 3 Act). From this perspective, the future of pseudonymous information can be said to determine the success of the amended Data 3 Act. So how can we ensure the future of pseudonymous information? Above all, a purposive and flexible interpretative approach regarding pseudonymous information must be developed.

Pseudonymous information is the result of pseudonymizing personal data, and pseudonymization refers to measures that delete or replace parts of personal data while normatively blocking its re-identification as personal data. As can be understood from this concept, there are many interpretative challenges ahead in dealing with pseudonymous information or pseudonymization, such as how much personal data must be deleted or replaced to be considered pseudonymous information (the more deleted or replaced, the easier it is to protect data subjects, but the less useful the information becomes), and who should be the standard for judging pseudonymous information (if judged by everyone in the world, the scope of recognition is very narrow, but if judged by a specific personal data processor, it is relatively widely recognized).

In this regard, some argue that since the concept of pseudonymization was borrowed from the European Union’s (EU) General Data Protection Regulation (GDPR), the interpretation in the EU should be directly applied. However, while pseudonymization is recognized as a personal data protection measure in the EU, it was introduced in Korea to support "information utilization," so this view risks disregarding the purpose of the legal amendment. In fact, when thinking of legal interpretation, one usually imagines court interpretations, but in more specialized areas like pseudonymous information, interpretations by the government and related agencies are very important. Currently, the government and related agencies are preparing notices, explanatory documents, guidelines, and manuals for interpreting pseudonymous information, and it is hoped that they will keep the original legislative intent of supporting "information utilization" deeply in mind.

Although not well known to the public, in the past, courts recognized the act of a complainant submitting the contact information of the accused in a complaint to investigative agencies as a violation of the Personal Information Protection Act, which is a conclusion difficult to accept from a social common-sense perspective. There is no law preventing similar interpretative approaches from being applied to pseudonymous information, so it is a matter for the public and society to pay attention to. Otherwise, there will be no future for pseudonymous information.

Jinhwan Kim, Attorney at Kim & Chang Law Office