PIPC Promotes Institutional Improvements to Activate Safe Pseudonymous Information

Administrative Notice on the Amendment of the "Notice on the Combination and Export of Pseudonymized Information"

[Asia Economy Reporter Eunmo Koo] The Personal Information Protection Commission announced on the 3rd that it will hold an administrative notice period for 20 days from the 4th to the 23rd regarding the amendment of the "Notice on the Combination and Export of Pseudonymized Information."

The amendment to this notice reflects tasks among the 16 regulatory innovation promotion tasks that can be implemented without revising the Enforcement Decree of the Personal Information Protection Act or similar laws. Looking at the main contents, first, the scope and role of the combination-specialized institution will be expanded to enable comprehensive support for combination applicants (Article 11-2). Currently, the role of the combination-specialized institution is limited to combination application and export, but it will be expanded to include consultation, pseudonymized information processing, and analysis support, allowing support from pseudonymization to analysis in all stages, such as pseudonymizing personal information before combination application or analyzing combined information.

Furthermore, unnecessary time and costs will be minimized during the process of combining pseudonymized information (Articles 9-2, 9-3). Before pseudonymizing personal information, only the combination key is first generated to check the combination rate in advance, or some information is pre-combined and analyzed to verify the usefulness of the combination (mock combination), after which the decision to proceed with the combination or change the target information can be made. To improve the inconvenience of combination applicants having to send large amounts of information to the combination-specialized institution, with the support of the combination key management institution, only the information that is actually the target of combination can be extracted, pseudonymized, and then transmitted (pseudonymized information extraction).

Additionally, the requirements for designation as a combination-specialized institution have been relaxed so that corporations, organizations, or institutions with expertise in various fields can be smoothly designated as specialized institutions (Articles 5, 10). Corporations, organizations, or institutions wishing to be designated as combination-specialized institutions can receive prior confirmation on whether designation is possible with just a plan, reducing the burden of investment in facilities and equipment.

Among the three experts, one can be recognized as personnel belonging to another department within the institution, and public institutions with legal grounds for establishment and secured soundness and sustainability of operation can be designated as combination-specialized institutions even if they do not meet the capital requirement of 5 billion KRW. Institutions designated as data-specialized institutions that wish to be additionally designated as combination-specialized institutions can simplify the submission documents and review procedures to receive designation quickly.

In addition, the overall notice has been revised to resolve ambiguities in the combination procedure, including the introduction of export application forms and specification of the operation standards for the export review committee.

Organizations or individuals with opinions on this amendment can submit them to the Data Safety Policy Division of the Personal Information Protection Commission, and the full text of the administrative notice can be checked on the Personal Information Protection Commission website.