[Report] The Dilemma of Data Protection vs. Utilization: 'Pseudonymized Data' in the Field

Low Utilization of the Pseudonymized Data System for New Technologies and Services
Strict On-Site Security Measures Limit Usage
Public and Private Sectors Consider Various Improvement Plans

Data is often referred to as the new oil in the age of artificial intelligence (AI). However, simply having a lot of data does not automatically guarantee value. Just as pearls must be strung together to make a necklace, data held separately by the government and private sector must be combined to develop new technologies or services and to inform policy, thereby realizing its true value.

Seo Yong Lee, unit head of Duzon Bizon, which operates the Personal Information Innovation Zone, is holding a meeting with the press on the 11th at the headquarters in Chuncheon, Gangwon.

For example, by combining vehicle ownership information (held by local governments) with vehicle operation data (from navigation companies), it is possible to determine the optimal locations for electric vehicle charging stations. Similarly, by integrating income information (from the National Tax Service), household and personal information (from the Ministry of the Interior and Safety), and pension data (from private banks), welfare policies can be better utilized.

Five Years Since the Introduction of the Pseudonymized Data System: What Are the Issues?

To this end, the government introduced the 'pseudonymized data system' in August 2020. The purpose was to enable the safe and effective use of data containing personal information. By pseudonymizing personal information so that individuals cannot be identified without additional data, it is possible to use the data without the consent of the data subject. While direct commercial use is not permitted, it can be used for purposes such as statistical analysis, scientific research, and public record preservation.

Donghyun Kim, professor of AI Information Security at Halla University, said, "The success of a data strategy depends on how well high-value personal information is utilized."

However, five years after its introduction, it is difficult to say that the pseudonymized data system in Korea has become fully activated. Many public institutions lack the personnel or budget needed to provide pseudonymized data, and there are concerns about becoming embroiled in personal information leakage incidents. As a result, data-holding institutions are often passive or uncooperative in providing data.

Professor Kim stated, "There needs to be a legal basis or incentives for the use of public data," adding, "I understand that starting this year, the government will award extra points in its management evaluations for the use of public data."

Data De-identification Office within the National Health Insurance Service. Provided by the Personal Information Protection Commission

To increase data utilization while protecting personal information, 'pseudonymized data combination agencies' serve as third-party institutions that safely combine pseudonymized data. Currently, 21 such agencies have been designated to safely combine and export pseudonymized data from different organizations. However, considering that the National Health Insurance Service, which has produced the most results among combination agencies in the healthcare sector, has only completed 42 cases over five years, it is clear that the pseudonymized data system still has a long way to go. The National Health Insurance Service is providing education and on-site consulting about the pseudonymized data system.

Inside a Pseudonymized Data Combination Agency and the Personal Information Innovation Zone

At the headquarters of the National Health Insurance Service in Wonju, Gangwon Province, which was visited on the 11th, there are dedicated rooms for data de-identification, data combination, and meetings to review data exports. These are independent spaces equipped with three to four PCs. To prevent any potential personal information leakage, the rooms are monitored by CCTV 24 hours a day, and the use of personal IT devices is strictly prohibited. Due to the emphasis on security, even storage devices must be traditional USB drives.

The 'Personal Information Innovation Zone' (formerly the Personal Information Safe Zone), which is operated for startups and researchers to analyze and utilize pseudonymized and personal data over the long term, is in a similar situation. Duzon Bizon, located in Chuncheon, Gangwon Province, was designated as a Personal Information Innovation Zone in December of last year. Although seven months have passed since its opening, there have not yet been any notable achievements. In this space, where even internet access is unavailable, pseudonymized data cannot be taken outside and must be analyzed only within the Innovation Zone. To reuse pseudonymized data, it is necessary to go through another round of consultations with the institution and obtain approval from a specialized review committee.

Due to such strict security measures and issues of accessibility from the Seoul metropolitan area, some have complained, "Are we supposed to analyze data as if we were in the Joseon Dynasty?" In order to protect data while also utilizing it, users must endure inconvenient conditions. Currently, there are five Personal Information Innovation Zones in operation: the National Cancer Center, Statistics Korea, Korea Social Security Information Service, Korea Expressway Corporation, and Duzon Bizon.

Seongyong Park, head of the Big Data Business Office at the National Health Insurance Service, said, "There is a growing demand for pseudonymized data combination, but some feel burdened by the requirements of the system." He added, "There are many requests to improve the convenience of data use, but at the same time, a high level of awareness regarding personal information protection is also necessary." Seo Yong Lee, unit head at Duzon Bizon, stated, "It is true that the data analysis environment needs improvement," and added, "We have proposed a plan to partially open the network and allow cloud-based data uploads, provided that security is ensured."