Personal Information Protection Commission Officially Launched as Ministerial-Level Agency on the 5th

Integrated Supervisory Authority for Personal Information

Yoon Jong-in, the inaugural Chairman of the Personal Information Protection Commission
Photo by Personal Information Protection Commission

[Asia Economy Reporter Kim Heung-soon] The Personal Information Protection Commission (PIPC), an integrated supervisory body for personal information, will officially launch on the 5th as a ministerial-level central administrative agency under the Prime Minister.

According to the PIPC on the 4th, the PIPC, which was a presidential advisory deliberative administrative agency, will be elevated to a central administrative agency nine years after the enactment of the Personal Information Protection Act in 2011. It will have independent authority over organization, personnel, and budget operations. Additionally, with the enforcement of the amended Data 3 Act (Personal Information Protection Act, Information and Communications Network Act, Credit Information Act) starting on the 5th, the personal information protection functions that were previously dispersed across multiple ministries such as the Ministry of the Interior and Safety, the Korea Communications Commission, and the Financial Services Commission will be unified under the PIPC.

Personal Information Protection Implementation System [Data provided by the Personal Information Protection Commission]

◆ Organization and Personnel Composition?= The PIPC is a deliberative body composed of nine commissioners, including a minister-level chairperson and a vice-chairperson at the vice-minister level, serving as the government's control tower for personal information protection. The first chairperson was appointed on the 30th of last month as former Vice Minister of the Ministry of the Interior and Safety, Yoon Jong-in. The PIPC Secretariat will have 14 divisions under 4 bureaus. The total staff will be 154.

The Personal Information Policy Bureau is an organization that integrates the personal information protection policy and legislative management functions of the Ministry of the Interior and Safety and the Korea Communications Commission. It is responsible for establishing, overseeing, and coordinating personal information protection policies, formulating basic personal information protection plans, policies related to new technology convergence such as artificial intelligence and the Internet of Things, pseudonymization policies, and promoting and supporting the self-regulation of personal information handlers.

The investigation and evaluation of personal information infringement and dispute mediation functions of the Ministry of the Interior and Safety and the Korea Communications Commission have been integrated into the Investigation and Mediation Bureau. This bureau is responsible for personal information protection status inspections and infringement investigations, monitoring and managing personal information infringement situations, administrative actions such as imposing fines and penalties, evaluating personal information infringement factors in laws and regulations, and supporting the Personal Information Dispute Mediation Committee.

The Planning and Coordination Officer, spokesperson, and Operations Support Division have also been newly established. They will handle administrative tasks necessary for agency operations such as planning, budgeting, public relations, and personnel. In addition to the existing personnel from the PIPC, Ministry of the Interior and Safety, and Korea Communications Commission due to the inter-agency function transfer, civil servants from various ministries including the Ministry of Science and ICT will be transferred and recruited to supplement the workforce.

Organizational Chart of the Personal Information Protection Commission

◆ What are the main policy directions?= The PIPC announced that it will significantly strengthen policy functions related to safe data utilization, autonomous protection, and new technology response, reflecting the amendment purpose of the Personal Information Protection Act, which is "harmonizing personal information protection and utilization," upon its launch.

Specifically, it plans to establish pseudonymization guidelines and create a department dedicated to pseudonymization policies such as managing and supervising pseudonymized information linkage to foster a safe data utilization ecosystem that information subjects can trust. It also aims to establish a personal information protection system that citizens can feel by supporting the private sector, which actually holds personal information such as companies, to autonomously and actively carry out protection activities according to industry conditions and characteristics.

To ensure consistency and connectivity of personal information protection policies and strengthen cooperation, an inter-ministerial "Personal Information Protection Policy Council (at the bureau director level)" will be formed, and a "government-wide joint investigation consultative body" capable of promptly responding to and investigating large-scale infringement incidents will also be operated. Support will also be provided for the operation of "Personal Information Protection Related Agencies Councils" by city and province.

The PIPC also plans to support the development of technologies specialized in personal information protection and the fostering of related industries. It will cooperate with the Ministry of Science and ICT, Ministry of Education, Ministry of Employment and Labor, and others to cultivate field-oriented experts.

Meanwhile, the PIPC expects significant progress in negotiations for the European Union (EU)’s General Data Protection Regulation (GDPR) adequacy decision with the launch of an independent integrated personal information supervisory body. The presence of an independent integrated personal information protection supervisory body was one of the biggest requirements for the adequacy decision negotiations. The adequacy assessment is a system where the EU evaluates the level of personal information protection in partner countries based on the GDPR.

If the adequacy decision is made, Korean export companies will be able to transfer EU citizens' personal information overseas without going through separate procedures that involve considerable costs. Furthermore, international cooperation such as joint responses to infringement incidents by global companies to protect Korean citizens' personal information can be strengthened.

Yoon Jong-in, Chairperson of the PIPC, said, "The launch of the integrated personal information supervisory body is a historic turning point for establishing a personal information protection system suitable for the Fourth Industrial Revolution era," and added, "We will do our best to ensure that the fruits of innovation in the personal information protection system return to the people."