There is disagreement over strengthening independence and unification of institutions

There has been a claim that the independence and expertise of the organization responsible for protecting and regulating the use of personal information in the big data industry, one of the core tasks of the 4th industrial revolution, should be strengthened.

A discussion was held at the National Assembly on the topic of “Personal Information Protection Control Tower in the Era of the Fourth Industrial Revolution.” The host, Democratic Party of Korea member Byun Jae-il, said in his opening remarks, “We are considering approaches to the technical and institutional issues of big data discussed in the Fourth Industrial Revolution. I hope that through discussions, we can come up with a plan to utilize it to improve the welfare of individuals as well as companies, beyond the level of protecting personal information.”

In Korea, the representative organizations responsible for personal information protection are the Personal Information Protection Commission (PIPC), the Financial Services Commission (FSC), and the Korea Communications Commission (KCC). Professor Kim Il-hwan of the Law School of Sungkyunkwan University, who gave the presentation, emphasized the need for a committee that guarantees independent third-party direction separate from personal information processing, strengthening independence and legal authority, securing expertise, and prohibiting concurrent positions.

“There are many conflicts of opinion because the policies of government ministries are inconsistent. For example, the Financial Services Commission investigated the issue and made legal revisions to the Financial Services Commission and made recommendations. However, when the Financial Services Commission did not accept it and asked for its opinion, the Financial Services Commission said it did not have the authority to do so and did not intend to follow it. Then, the next day, when 100 million pieces of personal information were leaked, they took action.”

Even if the Personal Information Protection Commission makes a decision, government departments do not follow it. The reason was that the evaluation subjects were inconsistent due to the introduction of the legal system. He added that considering trade relations, the EU’s General Data Protection Regulation (GDPR), an international standard, should be referred to.

“The EU has been integrating French and German-style personal data protection agencies, but the trend is to strengthen the French-style ‘permission system’ that grants intervention authority to the protection agency, rather than the German-style ‘consultation system’ that provides post-control and advice functions. This is something that our country can refer to in relation to expanding the authority of the Personal Information Protection Commission.”
The discussion was attended by lawyers, the Information Human Rights Research Institute, part-time professors at the Police Teachers College, and officials from the Personal Information Protection Commission, the Ministry of Government Administration and Home Affairs, and the Korea Communications Commission. They agreed that the independence of the supervisory body should be strengthened.

On the other hand, regarding the unification of the supervisory organization, Lee Chang-beom, a part-time professor at Dongguk University's Police Education College, and Kim Gyeong-hwan, a lawyer at Minhoo Law Firm, expressed differing opinions, saying, "It is still too early."
There were also voices acknowledging the unique nature of the Personal Information Protection Supervisory Commission and calling for increased efficiency in line with the characteristics of the field.

Eunwoo Lee, director of the Information Human Rights Research Institute, said about the use of personal information, “We need a supervisory body that has a vision for personal information protection and sets directions and theories. In that regard, he argued, “The Korea Communications Commission has a wide scope of work, so it is only scratching the surface, and there is a lack of new content and impact assessments.”
Ministry officials expressed their views on each sector, saying that the agencies are divided because each industry requires expertise and understanding.

Jang Han, head of the Personal Information Protection Policy Division of the Ministry of the Interior and Safety, said, “We need to discuss ways to legislate ethical steps in the safety system and accurately hold people accountable and compensate them afterward. Even if the agency used personal information because it was necessary, from the perspective of the person in charge of the information, there is a need to adjust interests because misuse can cause damage.”

Bae Sang-ho, head of the Personal Information Protection Commission’s dispute resolution division, emphasized the need to ensure autonomy and independence in budget and personnel organization, saying, “The Personal Information Protection Commission has never had the authority to investigate and supervise, and has no budget, so it has no actual execution ability. Most of its members hold concurrent positions.” He continued, “The censorship procedures by field are complicated, and we are also confused. He suggested a direction, saying, “We need to set a single goal orientation through unification tailored to the customer’s position.”

Choi Yoon-jung, head of the Personal Information Protection Ethics Division of the Korea Communications Commission, supported Director Bae’s statement by saying, “If the Personal Information Protection Commission is to strengthen its control tower and suggest a direction to move forward, it is desirable for related ministries to take the Personal Information Protection Commission as their goal.” Regarding special laws by sector, Director Choi added, “It seems appropriate to supplement special laws to reflect the characteristics of each sector. However, overlapping parts need to be reorganized to increase the accuracy of the legal system.”