"Data 3 Act Focuses on Personal Information Protection... Must Open the Way for Transactions"

[Asking the Way to the Data Economy - Roundtable] "Data Agency Is Inefficient," Critics Say

Experts attending the roundtable discussion "Asking the Way to the Data Economy," jointly planned by Asia Economy and the Korean Data Law Policy Association, are exchanging opinions and smiling brightly. From the left, Ji-eun Lee, lawyer at Kim & Chang Law Office; Seong-yeop Lee, professor at Korea University Graduate School of Technology Management; Do-il Son, lawyer at Yulchon LLC; Min-su Shin, professor at Hanyang University Department of Business Administration / Photo by Hyunmin Kim kimhyun81@

With the enforcement of the Three Data Laws (Personal Information Protection Act, Information and Communications Network Act, and Credit Information Act) on August 5, South Korea is entering a full-fledged data economy era. Asia Economy, in collaboration with the Korean Data Law Policy Association, explored the purpose of the law's enforcement, anticipated changes, and the limitations and issues revealed in the detailed procedures under the theme "Asking the Way to the Data Economy" over four weeks starting from the 18th of last month. On the 16th, concluding the planned series, a roundtable discussion was held inviting four experts from academia and the legal field to discuss the significance, improvement directions, and challenges of the law with 20 days remaining until its enforcement. Professor Lee Sung-yeop of Korea University Graduate School of Technology Management and president of the Korean Data Law Policy Association, Professor Shin Min-su of Hanyang University Business School, Attorney Son Do-il of Yulchon LLC, and Attorney Lee Ji-eun of Kim & Chang Law Office offered their suggestions. The experts proposed that some guidelines in the enforcement decree of the Three Data Laws, which focus more on protecting personal information than on its utilization, should be relaxed or supplemented. Regarding the recent political calls for establishing a Data Agency, they also expressed the view that "sufficient review is necessary." Additionally, they emphasized the need to concentrate efforts on creating a foundation where data can be traded to revitalize the data economy.

-What specific changes are expected in major sectors such as healthcare, finance, and telecommunications following the enforcement of the Three Data Laws?

▲Lee Sung-yeop= Let's take the healthcare sector as an example. By analyzing three types of personal health records?genetic data, medical records, and lifestyle data (lifelog)?as big data, it is possible to provide personalized exercise prescriptions or diets. Based on the analyzed results, preventive measures against potential future diseases can also be taken. In the financial sector, integrating and analyzing various personal financial information can enable asset recommendations, and loans can be obtained based on credit evaluations through data even without collateral. Analyzing big data held by each company to provide customized services to customers is a significant advancement. Targeted marketing that identifies an individual's interests to offer suitable services will also become possible.

▲Lee Ji-eun= Consumer purchase data accumulated in the distribution sector is useful information for those preparing related businesses. For example, if one can identify which products sell well in which regions, it would be helpful for those preparing to start a business or open a dealership. A market for analyzing such data sets already exists. Going forward, data analysis and service transactions in a business-to-business (B2B) format between companies are expected to become more active.

From the top left clockwise: Seongyeop Lee, Professor at Korea University Graduate School of Technology Management; Minsu Shin, Professor at Hanyang University School of Business; Jieun Lee, Lawyer at Kim & Chang Law Office; Doil Son, Lawyer at Yulchon LLC / Photo by Hyunmin Kim kimhyun81@

Attorney Son Do-il: "Detailed guidelines from the National Tax Service and Fair Trade Commission are needed to address tax law issues"
Attorney Lee Ji-eun: "Relax excessive criminal penalties such as a 3% surcharge on total sales"

-There are criticisms from both industry and academia that the enforcement decree of the Three Data Laws makes data utilization more difficult, contrary to the law's intent. What is your view?

▲Shin Min-su= The legislative direction was unclear during the establishment of the Three Data Laws, leading to dissatisfaction from both individuals providing data and companies that need to utilize it. First, more detailed responses are needed regarding the privacy infringement risks that civil society is concerned about. We need to consider effective ways to protect the rights of data subjects, which were framed in the past. Discussions are also necessary about what benefits members of our society who provide data can receive. The standards and methods for pseudonymized information and pseudonymization are still ambiguous. We also need to prepare for legal interpretation controversies that may arise. In particular, detailed guidelines and examples by industry are needed regarding appropriate identifiers and attribute holders for pseudonymization.

▲Son Do-il= It is worth considering whether the government must take a leading role in promoting all industries and whether it is desirable to specify every detail in the enforcement decree. While companies want clear guidelines to avoid problems, some bureaucrats believe that the government should create the broad legal basis and that the private sector should lead the activation of the data economy. Once the Personal Information Protection Commission (PIPC), which oversees personal information management and supervision, officially launches next month, we expect some gradual changes toward data utilization.

▲Lee Sung-yeop= Once the PIPC is launched, I hope it will establish subcommittees or expert committees to activate the government's authoritative interpretation function. Their role would be to collect ambiguous or uncertain cases and make judgments so that companies can use data with confidence. If such cases accumulate, they can also be used as precedents.

-There are views that the criminal penalties such as imprisonment or fines specified in the amendment to the Personal Information Protection Act are excessive. What do you think?

▲Lee Ji-eun= Except for cases like illegal acquisition or commercial sale, most violations of the Personal Information Protection Act can be sufficiently addressed through civil remedies, fines, or administrative corrective measures. If data is not acquired or used maliciously, the criminal penalty provisions need to be relaxed. The regulation imposing a 3% surcharge on total sales for processing pseudonymized information with the intent to identify specific individuals should be limited to the sales related to the violation, not the entire sales, to align with the purpose of recovering unjust profits.

Experts attending the roundtable discussion "Asking the Way to the Data Economy," jointly planned by Asia Economy and the Korean Data Law Policy Association, are exchanging opinions and smiling brightly. From the left, Ji-eun Lee, lawyer at Kim & Chang Law Office; Do-il Son, lawyer at Yulchon LLC; Seong-yeop Lee, professor at Korea University Graduate School of Technology Management; Min-su Shin, professor at Hanyang University Business School.
Photo by Hyunmin Kim kimhyun81@

Professor Lee Sung-yeop: "Placing the data policy control tower as a 'Cheong' (government agency) is inefficient"
Professor Shin Min-su: "Refer to overseas cases with B2B data trading platforms"

-Can the Data Agency proposed recently in the political arena serve as the control tower for data policy?

▲Lee Sung-yeop= Various existing ministries already handle data utilization tasks in their respective fields, such as financial data (Financial Services Commission), health and medical data (Ministry of Health and Welfare), and transportation and logistics data (Ministry of Land, Infrastructure and Transport). Placing these under a single government agency ('Cheong') affiliated with a specific ministry is inefficient because it is impossible to separate financial policy, health and medical policy, and transportation policy from their respective data domains. However, establishing a Data Agency under the Ministry of Science and ICT to create a common data utilization foundation across ministries is worth considering. The PIPC will initially undertake comprehensive policy tasks related to data protection and utilization. After observing the cooperation results among the Ministry of Science and ICT's data utilization foundation efforts, the Ministry of the Interior and Safety's public data utilization tasks, and the Commission, discussions on governance such as a Data Agency should be considered as a mid- to long-term task with sufficient time.

▲Shin Min-su= Data varies in type and usage. For example, the Financial Services Commission has credit information, the Ministry of SMEs and Startups has manufacturing, sensor, and equipment-related data, and the distribution sector has abundant commercial district data. If a Data Agency is established, it must equally reflect the characteristics of each ministry and institution and first establish standards on how to standardize data by sector. Data types are diverse, including those with rights like copyrights or patents, personal information, trade secrets, etc., and their collection methods and uses differ. How to encompass these aspects requires careful consideration.

-What is ultimately needed to revitalize the data economy alongside the enforcement of the Three Data Laws?

▲Son Do-il= Data trading is crucial. For trading to occur, both sellers and buyers must feel secure. A system to ensure this is necessary. Standards for pricing must also be established. For example, when a company's data is traded with a third party, any price is acceptable, but selling to an affiliate may raise issues related to fair trade or taxation. At that time, the appropriate price and whether there are tax law issues must be addressed through detailed guidelines by the National Tax Service or the Fair Trade Commission.

▲Shin Min-su= For data trading to succeed, the value of the data must first be understood. To do this, the specific content of the data must be known, but data content itself is confidential. Even if disclosed, there are quality issues. For example, one might pay after reviewing an abstract of a university report but be disappointed if the content is unsatisfactory. To prevent such problems, a system guaranteeing the content and quality of data is necessary. It is also worth examining overseas cases where private-led platforms mediate data trading, and prices are determined by sellers and buyers themselves in a B2B format.