3% Fine on Sales for Personal Data Breach... Comprehensive Revision of Personal Information Protection Act

Resolution of the Amendment at the Cabinet Meeting, Promulgation on the 14th
First Substantive Full Revision Since the 2011 Law Enactment
Improvement of Unreasonable Regulations, Establishment of Global Standards

The Personal Information Protection Commission announced on the 7th that the amendment to the 'Personal Information Protection Act,' which passed the National Assembly on the 27th of last month, was approved at the Cabinet meeting.

This amendment includes necessary provisions to ▲drive the data economy ▲realize a society of public trust in personal information ▲lead personal information norms that comply with global standards.

The Personal Information Protection Commission evaluated the amendment as highly significant, marking the first substantial comprehensive revision since the law was enacted in 2011, reflecting diverse opinions through over two years of consultations with academia, legal circles, industry, and civic groups.

Expansion of MyData in All Fields, Driving Growth of the Digital Economy

The amendment rationalized unreasonable regulations by unifying dual regulations for online and offline. It supplemented the legal system that could not keep pace with rapidly changing technologies such as autonomous driving and delivery robots.

First, it established a general legal basis for the ‘right to request personal information transfer,’ allowing individuals to demand companies or institutions holding their personal information to transfer it elsewhere. This laid the foundation for MyData services, which were previously limited to certain sectors like finance and public services, to be universally available in all areas such as healthcare and distribution according to individual citizens' wishes.

Reasonable standards were set to ensure the safe operation of autonomous vehicles, drones, and delivery robots equipped with mobile video information processing devices. Until now, mobile video information processing devices have been widely used in daily life but operated without clear regulations. Operational standards were established, including clearly indicating the fact of recording when operating mobile video information processing devices for business purposes.

Additionally, the dual regulatory system for online and offline was restructured so that anyone can easily comply with the law, applying the same regulations to the same actions.

Strengthening Citizens’ Active Rights Suitable for the Digital Era

The amendment is evaluated as having restructured the system so that citizens can practically exercise their rights in the digital environment, laying the foundation for building ‘trust’ between citizens and companies or institutions in personal information processing.

The amendment moved away from the excessive reliance on the data subject’s ‘consent’ in personal information processing practices, allowing collection and use of personal information without consent within reasonably foreseeable scopes such as mutual contracts.

The Personal Information Protection Commission evaluates companies’ and institutions’ personal information processing policies and requires improvements, enabling citizens to more easily and accurately understand how their personal information is handled.

New rights were established allowing individuals to refuse or request explanations regarding automated decisions using artificial intelligence that significantly affect citizens, such as in job interviews or welfare recipient selection.

When informing children about personal information, the obligation to use easy-to-understand formats and language was expanded from the online sector to all sectors, and the obligations of national and local governments regarding child personal information protection policies were clarified.

The obligation to participate in personal information dispute mediation procedures was expanded from public institutions to all personal information processors, and provisions for fact-finding necessary for dispute mediation were established to improve the dispute resolution system.

Legal System Improvements Compliant with Global Standards

The Personal Information Protection Commission explained that, amid the increasing importance of data in global trade, it revised systems such as cross-border data transfer and penalty systems to comply with global standards and lead international personal information norms.

Previously, ‘consent’ from the data subject was required for cross-border transfer of personal information, but the amendment diversified the requirements to include contracts, certifications, and adequacy decisions, securing interoperability with global norms.

To address the issue where, unlike global standards, personal information protection responsibilities were regulated mainly by criminal penalties on individual officers rather than companies, excessive criminal penalties were shifted to economic sanctions. In particular, the maximum fine was adjusted to be no more than 3% of total sales, aligning with global levels, and sales unrelated to the violation were excluded from the calculation to ensure proportionality and effectiveness.

Meanwhile, the amended 'Personal Information Protection Act' approved at the Cabinet meeting is scheduled to be promulgated on March 14 and come into effect on September 14.

Ko Hak-su, Chairperson of the Personal Information Protection Commission, stated, “Citizens should be able to practically control and exercise their rights over their personal information at any time, and companies should be able to safely utilize data based on citizens’ trust, establishing a virtuous cycle.” He added, “Going forward, the Commission will present visions and policy directions for personal information that citizens can trust and feel in the digital transformation era through initiatives such as preparing the ‘National MyData Innovation Roadmap.’”