Introduction of pseudonymized information that cannot identify individuals without additional information
Imposition of a 3% fine on sales revenue if protective measures are insufficient
Personal Information Protection Commission elevated to central administrative agency


The amendment to the three data laws was passed 14 months after it was proposed.
On the evening of the 9th, the National Assembly held a plenary session and passed the 'Three Data Laws (Personal Information Protection Act, Credit Information Act, and Information and Communications Network Act).' The amended Three Data Laws supplement the current system to strengthen personal information protection while seeking the development of related industries through the active utilization of data.

First, the criteria for determining personal information, which were somewhat ambiguous, have become clear.

It was clarified that determining whether something constitutes personal information requires reasonable consideration of factors such as the availability of other information that can be combined, and the time, cost, and technology involved in identification, and that the Personal Information Protection Act does not apply to anonymized information that does not meet these requirements. This is expected to reduce confusion when carrying out projects involving the processing of personal information and to promote the use of anonymous information.

To promote data utilization, the concept of pseudonymized information was introduced, and grounds for combining data were also established.

Pseudonymized information, which is information that cannot identify a specific individual without additional information, may be used without the data subject's consent under appropriate safeguards for purposes such as statistical compilation, scientific research, and public interest record keeping. Accordingly, the types of usable data are expected to diversify through pseudonymization, and fields of application are projected to expand, including the development of new technologies, products, and services, as well as market research.

In addition, data combination between companies or institutions is permitted through specialized agencies equipped with security facilities. It is expected that the secure combination and utilization of data from diverse fields, such as telecommunications, finance, and retail, will enhance data value and stimulate the creation of innovative services, including personalized services.

The responsibilities of personal information processors regarding data utilization have also been strengthened.

Obligations to take safety measures are imposed when processing pseudonymized information or combining data, and acts that identify specific individuals are prohibited; in the event of violation, in addition to administrative fines or criminal penalties, a penalty surcharge equivalent to 3% of total revenue may also be imposed. Under the obligation for safety measures, additional information required to restore pseudonymized information must be stored separately, and providing it to third parties is prohibited. If personally identifiable information is generated during the process of data utilization, processing must be immediately halted, and the data must be retrieved or destroyed.

Similar and overlapping regulations in personal information protection laws were streamlined, and the implementation system was unified.

The personal information protection functions of the Ministry of the Interior and Safety, the Korea Communications Commission, and the Financial Services Commission were unified under the Personal Information Protection Commission and elevated to a central administrative agency under the Prime Minister, while the independence of the personal information supervisory body was secured through measures such as the granting of investigative and enforcement powers. This is expected to resolve the confusion and burden caused by the previously separated online and offline supervisory systems, and enable the implementation of consistent policies regarding personal information protection.

Furthermore, with the personal information supervisory body gaining independence, approval for the European Union (EU) adequacy assessment is expected, and domestic companies are projected to find it easier to enter the EU market by being exempted from separate procedures required for the transfer of personal information of EU residents.

The government plans to support the growth of the data industry by promoting the expansion of data openness and distribution to ensure the effects of the law amendment take root quickly in the field, and by facilitating data convergence and the utilization of data in key sectors.

By linking the 10 big data platforms established in 2019, we will promote the production of data with new value through the combination of data from heterogeneous fields and expand openness and distribution. Centering on the established platforms, we will revitalize data trading and develop and provide guidelines and standard contracts to facilitate transactions.

We plan to create innovative services by supporting the purchase and processing of various data produced through pseudonymization and data merging, as well as the utilization of AI, through data utilization support programs such as data vouchers and data flagship projects.

Policies for data utilization in sectors with significant economic ripple effects, such as finance and healthcare, as well as in future industries like smart cities and autonomous vehicles, will also be pursued. In addition, we plan to promptly revise subordinate regulations and related laws to support safe data utilization, and expedite the approval of the EU GDPR adequacy assessment based on securing the independence of the supervisory body.

The government plans to continuously support companies and institutions in safely utilizing data and fully accelerating the transition to a data economy by gathering diverse opinions from the private sector regarding the amendment of the three data laws and reflecting them in policy as much as possible.

A task force for revitalizing the data economy involving all relevant ministries is scheduled to be launched in February, and comprehensive support measures will be announced at the same time.

Meanwhile, the amended statute will take effect six months after the date of promulgation.