Personal Information Protection Commission 2023 Work Report
Dismissal and Removal of Officials for Intentional Personal Information Leakage
Revision of Personalized Advertising Personal Information Protection Guidelines
[Asia Economy Reporter Lee Seung-jin] The Personal Information Protection Commission (hereinafter referred to as the Personal Information Commission) will implement a one-strike-out system starting next year, under which public officials who intentionally leak personal information will be dismissed or discharged. In addition, it will closely examine the status of overseas transfers of personal information by major mobile apps such as YouTube, Netflix, and Instagram.
The Personal Information Commission announced that Chairman Ko Hak-soo reported these policy directions for next year to President Yoon Seok-yeol on the 28th. Through three major policy directions and six core promotion tasks, the Commission plans to strengthen its role as the control tower for personal information next year and lead digital innovation.
The Era of Nationwide MyData Begins
First, the Personal Information Commission identified the 'MyData era,' where citizens have control over their own data and can transfer it to desired destinations, as a key task to be promoted next year.
The Commission plans to establish the 'Republic of Korea MyData Roadmap' in the first half of the year, which contains strategies for expanding MyData, currently limited to the financial and public sectors, to all fields, thereby actively revitalizing the data economy.
To enable seamless data movement, the standardization of data formats and transmission systems will be expanded to 10 fields, and an Information Strategy Plan (ISP) will be promoted to build a 'MyData Support Platform' that allows citizens to conveniently use services.
Strengthening the Foundation for Personal Information Utilization to Support New Technologies and Industries
The Personal Information Commission plans to form a 'Public-Private Joint Personal Information Regulation Innovation Group (tentative name)' to gather opinions from industries such as ICT and platforms and resolve similar or overlapping regulations among related laws.
Additionally, it will develop real-time de-identification technology for using video and biometric information in AI training and establish personal information technology standards in key areas such as artificial intelligence (AI) and blockchain.
In particular, to promote the development of new industries such as AI and autonomous vehicles, the Commission plans to introduce a 'Personal Information Safe Zone (tentative name)' where data can be processed more securely in a protected environment when personal information analysis and utilization are necessary, leading data innovation.
Securing Leadership in Response to the Reorganization of the Global Data-Based Order
The Commission aims to proactively respond to changes in digital international norms due to the spread of new technologies and actively share advanced know-how such as MyData and pseudonymized information utilization with the international community to secure leadership.
It will strengthen international cooperation by building data hubs related to investigation and disposition with organizations such as the OECD and countries including the U.S., EU, and the U.K., and also host the General Assembly of the 'Global Privacy Assembly (GPA)' in 2025.
The Commission plans to focus on inspecting the overseas transfer status of 5,000 applications with large user bases, improve the domestic representative system for global companies by mandating designation of domestic corporations, and assign responsibilities for protecting data subjects.
Establishing a Rapid Response System from Prevention to Damage Relief
In the public sector, 1,515 systems processing large-scale sensitive information will be selected for focused management, with mandatory introduction of access management systems and strengthened access controls. The one-strike-out system (dismissal/discharge) for intentional personal information leaks will also be implemented from January next year.
To create a trustworthy online service environment, proactive preventive inspections will be conducted in seven core areas of the digital ecosystem such as dark patterns and ad tech, alongside strict sanctions and guideline provision for violating businesses.
Furthermore, the scope of mandatory participation in personal information dispute mediation will be expanded from the public to the private sector, and a privacy 'One Portal' that handles leak reports and dispute mediation in one place will be launched in March next year.
Building a Digital Personal Information Protection System Without Blind Spots
The Personal Information Commission will conduct a 'Digital Right to be Forgotten Pilot Project' starting in April and promote the enactment of the 'Child and Adolescent Personal Information Protection Act (tentative name)' reflecting the characteristics of children and adolescents. It will also conduct inspections of domestic and foreign businesses providing content services to children through IPTV, OTT, and other platforms.
A pilot 'Privacy by Design Certification System' will be implemented for digital devices that collect personal information in daily life, such as AI speakers and IP cameras. Additionally, the Commission will introduce a 'Personal Information Processing Policy Evaluation System' that inspects whether processing policies are publicly disclosed in an easily understandable manner and recommends improvements if inadequate.
Following sanctions against overseas platforms like Google and Meta for personalized advertising in September this year, the Commission plans to prepare a revised 'Personalized Advertising Personal Information Protection Guideline' in the first half of the year, focusing on improving consent methods for behavioral information such as product purchases and search history and guaranteeing users' post-rejection rights for tracking data.
Personal Information Regulatory Innovation Accelerating Digital Transformation
The Personal Information Commission will also pursue regulatory innovation. It plans to rationally reorganize overlapping safety measures regulations divided between online and offline sectors, including the scope, frequency, and methods of notification for personal information use and provision.
To support innovation in new industries such as autonomous driving and drones, the Commission will promote the enactment of the 'Personal Video Information Act,' reflecting the characteristics of mobile video devices.
For the rapidly growing online platform sector, where immediate application of personal information laws is difficult, a new form of 'public-private cooperative self-regulation,' where the private sector establishes codes of conduct and the government approves them, will be expanded to five major areas including food delivery.
Chairman Ko Hak-soo of the Personal Information Protection Commission stated, “In the era of digital transformation, data utilization based on public trust is more important than anything else,” adding, “We will leap forward as a global data-leading country by leveraging MyData utilization across all fields and further protect personal information in both public and private sectors based on strict law enforcement.”
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
