[New Wave] Looking Forward to a Bigger Step for the Three Data Laws

At the beginning of this year, the 'Data 3 Act' passed the National Assembly plenary session and has been in effect since early August. There is growing curiosity about the subsequent progress of this legislation. The Data 3 Act refers to the amendments to the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and the Credit Information Act. It distinguishes personal information into personal information, pseudonymized information, and anonymized information, and provides opportunities to use pseudonymized information for research purposes or public interest record preservation without the consent of the credit information subject, allowing its use in marketing or public services.

With the implementation of the Data 3 Act, significant changes are expected across various industries such as finance, healthcare, and education by expanding the operation and utilization of customer data to create new added value. From the perspective of ordinary individuals like consumers, they are no longer just providers of semi-structured and unstructured data but can now become the subjects of data usage by converting the data usage rights held by governments or companies to themselves, enabling active management of their own information. In this context, the term 'MyData' has emerged, referring to the use of data information for credit and asset management based on individual needs.

Until now, the utilization of existing public data faced practical limitations due to complex and overlapping personal information protection regulations. However, the potential for data utilization through pseudonymized information aligns with the Fourth Industrial Revolution era and is expected to bring positive transformative changes. For example, the possibility of realizing total communication through the construction, execution, and evaluation of data-driven personalized information platforms, including artificial intelligence, has increased. Additionally, it is anticipated that personalized messages tailored to individual consumers can be instantly provided through the widespread use of algorithms recommending products related to specific interests.

The intention to manage personal information integrally through the Data 3 Act, instead of separate systems managed by related administrative departments or public sectors, is welcome. However, from the general public’s perspective, the process of providing data through pseudonymized information is difficult to fully understand. Big data utilization inherently requires the use of entire or comprehensive datasets. Yet, if consent for the use of pseudonymized data is not obtained or anonymization consent is not secured, the ultimate ability to generalize the implicit insights from the data is compromised, leaving issues regarding the effectiveness of data utilization.

Furthermore, it is difficult to completely avoid potential controversies related to information protection for pseudonymized information. In particular, even if the data is pseudonymized, there may be concerns about the use of channels to acquire individual consumers’ purchasing tendencies or product information, as well as financial information used in actual purchases, for purposes other than the individual consumer’s own. Similar to past controversies and social issues caused by personal information leaks, there is a need to first establish clear guidelines and systemic prevention measures against data cybercrimes that could arise through pseudonymized information.

Moreover, the recent environment of media and information collection, processing, and utilization requires regulations on how to maintain the balance of 'power' between individuals or small organizations providing information and public organizations and private companies utilizing that information. In other words, the new industries created by utilizing personal data and the profits derived from them may ultimately be concentrated in certain industries or vested interests, potentially causing new social imbalances.

Building a balanced infrastructure and process to address this is also an urgent task. On a personal level, individuals must continuously maintain interest and a critical perspective on how their information is being used across industries and for what value. Private companies must be fully prepared to address any supplementary issues that may arise in the future.

From the government’s standpoint, it must be able to control and manage potential social issues and conflicts that may arise later through coordination among the overall data new industries, infrastructure, and existing industries. Although there are concerns about the Data 3 Act, which has just taken its first steps, there is high expectation to focus on the necessity and practical positive functions of data utilization that align with the Fourth Industrial Revolution framework, anticipating greater progress of the Data 3 Act in the new year.

Wonjun Jeong, Associate Professor, Department of Media Communication, Suwon University