[Asia Economy Reporter Kim Heung-soon] The Personal Information Protection Commission (PIPC) announced on the 24th that it has published an integrated version of the "Pseudonymized Information Processing Guidelines," which includes detailed procedures for pseudonymizing personal information or combining pseudonymized information in accordance with the Personal Information Protection Act.
The PIPC added a section on the combination and export of pseudonymized information to the integrated version, explaining the procedures that personal information processors must follow to apply for the combination of pseudonymized information and how they can export and utilize the resulting data.
According to the guidelines, those who wish to combine and utilize pseudonymized information (hereinafter referred to as applicants for combination) must consult in advance with the institution holding the pseudonymized information to obtain consent for providing the pseudonymized information, and then proceed with the combination in four stages according to the law.
Additionally, if assistance is needed during the process of combining pseudonymized information, applicants can request support from the Korea Internet & Security Agency, which supports the combination process, and the specialized combination institution responsible for the actual combination.
The combined pseudonymized information is reviewed by a separately established "Export Review Committee" within the specialized combination institution and can be exported only after final approval by the institution. At this time, the review must consider the purpose of combining the pseudonymized information and the level of safety measures in the environment where the pseudonymized information is processed.
The export review is conducted individually for each applicant, allowing multiple applicants to export the combined pseudonymized information. It is possible to pseudonymize the combined information to the extent necessary to achieve each applicant’s combination purpose before exporting.
The PIPC is establishing and operating a "Help Desk" (tentative name) to provide guidance on the pseudonymized information system and is preparing measures to discover leading cases of pseudonymized information combination through inter-ministerial collaboration. By October, it plans to complete the essential functions of the "Comprehensive Support System for Pseudonymized Information Combination" and begin its operation. Once the specialized combination institution is designated, follow-up measures will be carried out without delay to enable immediate execution of pseudonymized information combination.
Meanwhile, at the 4th plenary meeting of the Personal Information Protection Commission held on the 23rd, the first sector-specific guideline reflecting the characteristics of the healthcare sector, the "Healthcare Data Utilization Guidelines," was also reported.
The healthcare sector guidelines provide procedures and methods to refer to when pseudonymizing sensitive information such as health-related data or combining pseudonymized information that includes disease information. This guideline is scheduled to be published on the 25th after final revisions by the Ministry of Health and Welfare.
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
