Korea Introduces Major Amendments To Data Privacy Laws

On 9 January 2020, the Korean National Assembly passed amendments (collectively, the 'Amendments') to three major data privacy laws: the Personal Information Protection Act ('PIPA'), the Act on the Promotion of Information and Communications Network Utilization and Information Protection ('Network Act') and the Act on the Use and Protection of Credit Information ('Credit Information Act').

The Amendments largely aim to:

minimise the burden of redundant regulatory activities and confusion among regulated persons stemming from previously overlapping data privacy regulations and multiple supervisory bodies; and develop a 'data economy' by introducing the concept of 'pseudonymised data' and a legal basis upon which data may be utilised more flexibly (to an extent reasonably related to the original purpose of collection). The Amendments will become effective six months from promulgation by the President, except for certain provisions in the Credit Information Act, which will come into effect one to one and a half years after its promulgation (as further specified in the President Decree relating to it).

Please see below for a summary of key changes introduced by the Amendments. Specifics of the Amendments are yet to be finalised as the Enforcement Decrees and related official notices by governing bodies are not available at the time of writing.

Key Changes: PIPA

Clarified concept of 'personal data': Distinguished concepts of personal data, pseudonymised data and anonymised data (excluded anonymised data from the scope of personal data).

Defined permissible scope of pseudonymised data processing: Permitted processing of pseudonymised data for statistical, scientific research, or public interest record-keeping purposes.

Permitted combination of pseudonymised data of personal data controllers through specialised agencies.

Imposed restrictions upon pseudonymised data processing. Permitted use and release of personal data without obtaining data subjects' consent to an extent reasonably related to the original purpose of data collection. Elevated and strengthened the Personal Data Protection Commission (PDPC)'s status and powers. Added special provisions related to the deleted provisions of the previous Network Act. Effective date: six months after promulgation. Network Act

Deleted provisions related to the protection of personal data under the previous Network Act (i.e. PIPA will govern matters related to protection of personal data). Provided an...