UK Finalizes Appropriateness Decision... Easier Market Entry for Korean Companies in the UK

[Asia Economy Reporter Seungjin Lee] The United Kingdom has officially adopted the ‘Adequacy Decision on Personal Data Protection’ for South Korea. As a result, domestic companies entering the UK can now bring UK citizens' personal data into South Korea and use it for business activities without any additional procedures.

According to the Personal Information Protection Commission on the 19th, the UK Department for Digital, Culture, Media and Sport (hereinafter DCMS) has finalized the ‘Adequacy Decision on Personal Data Protection’ for South Korea. This is the first time the UK has granted an adequacy decision since its withdrawal from the European Union (EU).

The adequacy decision is a system that evaluates the level of personal data protection in other countries and approves them as countries to which personal data can be transferred. Currently, the EU, UK, Japan, Brazil, and others operate this system. Accordingly, Korean companies will now be able to transfer personal data within the UK to South Korea without additional certification or procedures.

In August last year, the UK officially announced six countries and institutions, including South Korea, the United States, Australia, Singapore, Colombia, and the Dubai International Financial Centre, as priority targets for adequacy decisions following its EU withdrawal. The relevant departments of both countries, the Korean Personal Information Protection Commission and the UK DCMS, held more than 20 working-level meetings and jointly announced the adoption agreement of the adequacy decision in July.

Notably, the types of personal data eligible for overseas transfer include financial data. The adequacy decision finally approved by the Personal Information Protection Commission from the EU last December included a condition that domestic electronic financial companies and banking institutions operating in the EU must use the existing approval procedure of Standard Contractual Clauses (SCC).

Through this decision, domestic companies wishing to transfer UK personal data to South Korea are expected to enjoy various benefits. In particular, SCC is known to require a minimum cost of 30 million KRW to over 100 million KRW per project and several months of time. However, with the adequacy decision, domestic companies can actively engage in business activities by reducing the time and cost burden as well as legal risks.

For example, even if a domestic company like Naver Cloud expands large-scale services in the UK, there will be no need to increase costs or human resources related to personal data protection. Additionally, benefits are expected across various service sectors such as shopping, healthcare, and finance.

However, in South Korea, the second amendment to the Personal Information Protection Act must pass the National Assembly for UK companies to transfer Korean customers' personal data overseas. Currently, only the transfer of UK customers' personal data to South Korea is permitted. The second amendment passed the Legislation and Judiciary Committee Subcommittee on the 22nd of last month and is expected to be finalized after going through the full committee, the Legislation and Judiciary Committee, and the plenary session.

The Personal Information Protection Commission and the Korea Internet & Security Agency will hold an online briefing session titled ‘Utilizing the Korea-UK Adequacy Decision for Our Companies’ on the 20th via online channels to share the effects of the adopted adequacy decision and ways for domestic companies to utilize it. The online briefing will be conducted in real-time for representatives of companies planning to enter the UK market.