"Joint Research with the EU Made Easier"... Establishment of a Free Personal Data Transfer System

Korea Recognized for 'Equivalence' in EU Personal Data Protection
Personal Information Can Now Be Transferred to 30 Countries
"Data Cooperation Between Both Sides Expected to Strengthen Further"

Starting today (September 16), domestic companies or public institutions in Korea can transfer personal information of employees or customers to branches or other companies located in the European Union (EU) without additional requirements such as obtaining individual consent.

Goh Haksoo, Chairperson of the Personal Information Protection Commission (right), unveiled the Korea-EU mutual recognition statement together with Michael McGrath, EU Commissioner for Democracy, Justice, Rule of Law, and Consumer Protection, at the Global Privacy Assembly (GPA) held on the 16th at the Grand Hyatt Seoul in Yongsan-gu, Seoul. Provided by the Personal Information Protection Commission

This is the result of the Personal Information Protection Commission granting what is known as "mutual recognition," acknowledging that the level of personal information protection in the EU is effectively equivalent to that of Korea. After amending the Personal Information Protection Act in September 2023 to introduce the mutual recognition system, the EU has become the first entity to receive this recognition.

Previously, transferring information required separate conditions such as consent, which restricted pseudonymized data analysis research with EU research institutions and placed the responsibility for protecting transferred information on the data subject.

Following the EU’s adequacy decision in December 2021, which allowed the free transfer of personal information from the EU to Korea, a framework has now been established for the free flow of personal information in both directions between Korea and the EU. Transfers of personal information include provision, inquiry, processing outsourcing, and storage in cloud servers located in the EU region.

Koh Haksoo, Chairperson of the Personal Information Protection Commission, together with Michael McGrath, EU Commissioner for Democracy, Justice, Rule of Law, and Consumer Protection (ministerial level), who is visiting Korea to attend the Global Privacy Assembly (GPA) on September 16, released a joint statement containing these details.

The mutual recognition system is designed to ensure that, in the era of artificial intelligence (AI) and data where cross-border flows of personal information are routine, personal data can move safely and freely between countries and regions. This system is similar in intent to the EU’s adequacy decision.

After introducing the system, a group of experts and relevant ministries was formed, and 11 working-level meetings between Korea and the EU were held to examine the EU’s personal information protection framework, the possibility of guaranteeing data subject rights, the supervisory system, and redress procedures.

With this mutual recognition, private and public personal information handlers can now transfer personal information without additional requirements to a total of 30 countries: the 27 EU member states subject to the EU General Data Protection Regulation (GDPR), as well as three countries in the European Economic Area (EEA)-Norway, Liechtenstein, and Iceland. However, this recognition does not affect the transfer of resident registration numbers or personal credit information.

This mutual recognition will be subject to review starting three months before September 15, 2028. If the review concludes that the equivalent level of protection is not maintained, the recognition may be modified or revoked. Additionally, if transferred personal information is not adequately protected and there is significant harm or risk of harm to data subjects, the Personal Information Protection Commission may order the suspension of such transfers.

Koh Haksoo, Chairperson of the Personal Information Protection Commission, stated, "Since Korea and the EU have established a safe and free data transfer system across both the private and public sectors, we expect even stronger data cooperation between the two sides going forward."