Personal Information Commission to Launch 'Digital Labor Surveillance' Status Survey Next Year

Personal Information Protection Commission Announces Next Year's Work Plan

[Image source=Yonhap News]

[Asia Economy Reporter Koo Eun-mo] The government will conduct a survey next year on labor surveillance using digital devices in response to the rapidly changing digital environment due to the spread of COVID-19. It will also begin standardizing common data by sector to activate MyData for the entire population.

The Personal Information Protection Commission (PIPC) held a briefing at the Government Seoul Office on the 22nd and announced the "2022 Work Plan of the Personal Information Protection Commission," which includes these contents.

Choi Young-jin, Vice Chairman of the PIPC, said at the briefing, "We will protect digitally vulnerable groups exposed to rapid new technology changes, eliminate blind spots in protection scattered across public and private sectors, and further expand data movement and distribution between industries to promote safe data utilization."

Inspection of Biometric Information Collection and Use... Blocking Excessive Collection of Personal Information at the Source

The PIPC will first promote legislative improvements based on a full survey of more than 2,100 laws related to health, environment, and other areas to block excessive collection of personal information in the public sector at the source. If existing laws violate the principle of minimum personal information collection or deviate from proportionality and validity, the commission plans to recommend improvements to relevant ministries.

In addition, the PIPC plans to establish a "Public Institution Personal Information Leakage Prevention Plan" in the first half of next year and strictly sanction poorly managed institutions with fines and other measures. Furthermore, in the first half of next year, it will conduct inspections on the collection and use of biometric information used in local government closed-circuit television (CCTV) control centers and artificial intelligence learning.

As large-scale use of personal information by public institutions increases, the commission will also introduce a "pre-confirmation service" to check the risks and legal compliance of projects using sensitive personal information before they start. This service will pre-check the legal grounds for collecting, using, and providing personal information to third parties, as well as the legality of de-identification measures, to strengthen safety management.

Measures will also be prepared to prevent personal information leakage through thermal cameras, whose use has increased due to the COVID-19 pandemic. The PIPC plans to work with consumer groups to inspect whether biometric information collection products excessively collect personal information and assess risks, and introduce a certification system to ensure personal information protection measures are implemented from the manufacturing stage.

Strengthening Protection for Vulnerable Groups Such as Children and Adolescents... Labor Surveillance Survey

This work plan also includes measures to strengthen protection for vulnerable groups regarding personal information. To establish a protection foundation for children and adolescents, the PIPC will create a checklist for each processing stage to plan and design services according to the "best interests of the child" principle, and promote expanding the special protection target under the current Personal Information Protection Act from "children" to "adolescents." By the first half of next year, it will prepare protective measures tailored to different age groups and establish a basic plan for protecting personal information of children and adolescents.

The so-called "digital labor surveillance" survey is also included in the work plan. Due to concerns about human rights violations caused by CCTV surveillance and worker location tracking, the PIPC plans to collaborate with the Ministry of Employment and Labor and others to inspect labor surveillance practices in workplaces around September next year. Based on this, by the end of next year, it will derive institutional improvement measures regarding management and supervision when introducing and using digital devices for personal information collection in the workplace.

Additionally, through inspections of online personalized advertising, the commission will examine whether global big tech companies are using personal information without authorization or violating processing policies, and proactively inspect industries such as insurance that frequently request sensitive information.

Strengthening Personal Information Leakage Monitoring... Establishing a Rapid Response System

Efforts will also be made to establish a response system to prevent damage caused by personal information leakage and illegal transactions.

First, the commission will monitor 4 million domestic and international websites with many users and high risk to quickly detect and delete illegal distribution posts. In the event of a large-scale leakage incident, it will form a joint investigation team with the Ministry of Science and ICT, the National Police Agency, and others to respond.

Moreover, the "Find My Leaked Information Service," which allows citizens to directly check leaked account information, will gradually expand the types of data that can be checked from IDs and passwords to emails, phone numbers, and fraud information. In addition, if hackers expose personal information for extortion purposes, the commission plans to urgently block such posts through telecommunications companies.

Activating the Data Economy with Pseudonymized Information and MyData as Two Pillars

The PIPC will undertake standardization of common data by sector to activate MyData. MyData refers to individuals' ability to request the transfer of personal information they have provided to public and private entities to third parties, enabling proactive use of this data in services based on data such as credit evaluation, asset management, and health management.

The commission has reflected a budget of 3 billion KRW for standardizing data formats and transmission methods to facilitate smooth data transfer between different sectors, and plans to establish the foundation for building authentication and identification systems, including one-stop user authentication, and security infrastructure by the end of next year.

Measures to promote the use of pseudonymized information are also included. The PIPC plans to provide a user-friendly comprehensive platform for pseudonymized information and expand regional field support centers.

Furthermore, in accordance with the Personal Information Protection and Utilization Technology R&D Roadmap (2022?2026), the commission will develop next-generation personal information technologies. First, it will invest 3 billion KRW next year to prioritize four core tasks, including conversational data personal information detection technology to prevent a recurrence of the "Iruda" incident, and plans to invest 29 billion KRW in the personal information protection field over the next four years.

Yoon Jong-in, Chairman of the Personal Information Protection Commission, said, "Next year, the PIPC will fulfill its role as the substantive guardian of the constitutional right to personal information self-determination and realize a society where citizens can feel safe about their personal information."