"Strengthening Data Subject Rights" Personal Information Commission Approves Next Year's Implementation Plan

[Asia Economy Reporter Eunmo Koo] The Personal Information Protection Commission (PIPC) finalized and approved the "2022 Personal Information Protection Implementation Plan (Implementation Plan)" established by 50 central administrative agencies at its plenary meeting on the 22nd, in accordance with the "Basic Personal Information Protection Plan (2021?2023)."

The Implementation Plan is a statutory plan prepared annually by the heads of central administrative agencies based on Article 10 of the Personal Information Protection Act and Article 12 of its Enforcement Decree. Each agency formulated detailed implementation plans to concretize the "Basic Personal Information Protection Plan (2021?2023)" focusing on ▲improvement of personal information protection policies and systems ▲system improvement and operation ▲education and publicity.

Looking at the main contents of the Implementation Plan, first, institutional improvements will be promoted to strengthen the rights of data subjects and enable safe data utilization. Agencies will update related laws and internal regulations to ensure consistency with personal information protection laws, minimize personal information collection items mainly in civil complaint forms used by agencies, and revise work-related guidelines. Additionally, sector-specific guidelines for pseudonymized information processing and utilization will be prepared, and data standardization will be promoted in preparation for the introduction of MyData.

A safe management and response system for personal information processing systems will also be established. As the types of personal information collected by public institutions diversify and systems holding sensitive personal information such as biometric data increase, concerns about personal information breaches are rising. Accordingly, each agency plans to secure the safety of personal information management within systems and establish a rapid response system to prepare for leakage or exposure.

Furthermore, tailored education by target group will be strengthened to enhance personal information protection capabilities. Personal information tasks require education suited to the characteristics of each agency and sector. Each agency plans to provide customized education and conduct campaigns targeting internal staff and policy groups to improve the agency’s personal information protection capabilities and spread a culture of personal information protection.

Lee Jeong-ryeol, Director of the Personal Information Policy Bureau at the PIPC, said, “With the rapid digital transformation, the processing of large amounts of data is increasing in all fields, making efforts to protect personal information in policy sites very important at this time,” and added, “I hope the implementation plans established by each agency will serve as an opportunity to create a new personal information protection system.”