Collecting Feedback on the Amendment to the Personal Information Protection Act Enforcement Decree
Considering System Implementation for Data Transmission
Six-Month Grace Period Under Review
The Personal Information Protection Commission has dismissed industry concerns about potential negative effects such as the burden of system implementation costs and the risk of trade secret leaks arising from the expansion of the right to request personal data transmission.
Seungcheol Ha, head of the Government-wide MyData Promotion Team at the Personal Information Protection Commission, is explaining the amendment to the "Personal Information Protection Act Enforcement Decree" at the Government Seoul Office Building on the 20th. Photo by Kyungjo No
On the 20th, during a briefing for the press corps at the Government Seoul Office Building, the Personal Information Protection Commission stated, "The procedures and methods for safely exercising the right to request personal data transmission have been specifically stipulated in the amendment to the 'Personal Information Protection Act Enforcement Decree.' The likelihood of trade secret leaks by data transmitters or information leaks due to misuse or poor management by specialized personal information management institutions is extremely low."
The key points of the amendment are the expansion of the right to request personal data transmission to all industries and the clear definition of data transmission standards and procedures. The aim is to increase public utilization of the "personal data transmission request system," which has been in effect since March. The right to request personal data transmission allows individuals to request that data controllers transmit their personal information to themselves.
Currently, the scope of information and businesses subject to the right to request personal data transmission is limited to the healthcare, telecommunications, and energy sectors. The amendment expands this to include any data controller of a certain scale, regardless of industry. The conditions include handling personal information of more than one million individuals or sensitive/unique information of more than 50,000 individuals, with annual sales of at least 150 billion KRW.
Additionally, when using automated tools for data transmission, prior agreement between the transmitter and the agent is required. When data transmitters provide information on their websites, they must also inform individuals that it is possible to download the relevant information when viewing or accessing their personal data.
During the legislative notice period for the amendment, which lasted until the 4th of this month, the Commission received opinions regarding the burden of building transmission systems, concerns about trade secret leaks, concerns about the misuse of information by specialized institutions, and the need for a grace period for the amendment's implementation.
Regarding the system implementation costs that data transmitters may have to bear, the Commission explained, "Startups and small businesses with limited financial resources are excluded from the requirements. On the contrary, they will have opportunities to create new businesses, such as innovative services, by receiving data without any cost burden." The Commission added, "Even for data controllers classified as medium-sized enterprises or larger, the cost burden should not be significant, as they only need to add a function to their website that allows users to download personal information that can be viewed or accessed."
The Commission sees little possibility of trade secret leaks by data transmitters. "Information separately generated by analyzing or processing personal data collected by data controllers is excluded from the scope of the right to request personal data transmission. Furthermore, it is stipulated that the rights or legitimate interests of others must not be infringed, so the likelihood of trade secrets being leaked is extremely low," the Commission stated.
Regarding concerns about information leaks due to misuse or poor management by specialized personal information management institutions, the Commission further explained, "Specialized institutions are designated through strict screening, are subject to supervision and control, and must maintain a high level of credibility and safety, making the possibility of leaks extremely low."
However, considering the need for system implementation by data transmitters, the Commission is considering a six-month grace period after the amendment takes effect. The Commission will also actively gather feedback from integrated and management institutions, the Korea Online Shopping Association, the Korea Internet Corporations Association, and civic groups through meetings.
Seungcheol Ha, head of the Government-wide MyData Promotion Team at the Personal Information Protection Commission, stated, "We are fully aware of industry concerns regarding the amendment," and added, "We will continue to communicate with stakeholders and consistently reflect valuable feedback in the amendment process."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
