In March 2021, representatives of the European Commission and South Korea's Personal Information Protection Commission announced the successful conclusion of the adequacy discussions between the European Union and the Republic of Korea. As a follow-up to this announcement, in June 2021, the European Commission published its draft South Korean adequacy decision. If adopted, the decision would mean European Economic Area personal data can be freely transferred to commercial operators and public authorities in South Korea on the same basis as intra-community data sharing arrangements.
The decision covers transfers of all personal data from the EEA — which is comprised of the EU, Lichtenstein, Norway and Iceland — to South Korea, with the exception of transfers to recipients falling within one of the following categories:
- “(a) religious organizations to the extent they process personal data for their missionary activities.
- (b) political parties to the extent they process personal data in the context of the nomination of candidates.
- (c) controllers that are subject to oversight by the Korean Financial Services Commission for the processing of personal credit information pursuant to the Credit Information Act, to the extent they process such information.”
South Korea would be the 14th country to obtain adequacy from the EU, assuming the U.K. will get its adequacy status, which seems likely. Other countries with adequacy include Japan, Israel, Switzerland, Argentina, New Zealand, Canada (partially) and a few others. With the exception of Japan and the U.K., all of these countries obtained their adequacy status under the Data Protection Directive, the predecessor to the EU General Data Protection Regulation. The requirements under the GDPR are more stringent than those of the Data Protection Directive. Also, the privacy laws in those countries may have changed since they obtained adequacy. The commission therefore is reviewing these “old” adequacy decisions, which remain in force by virtue of Article 45(9) of the GDPR until “amended, replaced or repealed.” There is no statutory deadline for this review but it is clear this is now urgent. There is, of course, no guarantee all of the existing adequacy decisions will be renewed. If they are, they would in any case be subject to a periodic review — at least every four years — as required by Article 45(3) of the GDPR, something that has not happened in the past.
The draft South Korean adequacy decision contains few surprises. It follows the structure we have seen in the U.K. draft adequacy decision: identifies the main components and building blocks of the GDPR and describes in detail how these components are reflected in the relevant privacy laws of the country that applies for adequacy. For South Korea the relevant law is mainly the Personal Information Protection Act as well as legally binding notifications adopted by the Personal Information Protection Commission. Of particular importance is the notification attached as Annex I to the draft decision. In this notification, the PIPC sets out supplementary rules that South Korean controllers need to observe when processing personal information transferred to South Korea on the basis of the EU adequacy decision. The supplementary rules relate to transparency requirements, out-of-purposes use, onward transfers, pseudonymized information and processing for national security purposes, among others.
The commission concludes that for each of the relevant components, including rights of individuals and redress mechanisms, South Korean law offers a level of protection essentially equivalent to that under the GDPR.
The commission also concludes that the PIPC meets the independence test, a key component of the “checks and balances” built in under the GDPR.
Not surprisingly, nearly half of the draft decision is devoted to a detailed description of the circumstances under which South Korean public authorities may access and use EU personal information for criminal law enforcement and national security purposes. This is an issue of great concern to civil society in the EU, as evidenced by the recent “Schrems II” decision of the Court of Justice of the European Union, in which the court invalidated the EU-U.S. Privacy Shield and laid out rules for international transfers of EU personal data, including transfers to countries other than the U.S.
The commission is satisfied that in the case of South Korea “any interference in the public interest … will be limited to what is strictly necessary to achieve the legitimate objective in question, and that effective legal protection against such interference exists.” The commission hereby relies on its own analysis of applicable laws in South Korea but also on detailed representations, assurances and commitments from the South Korean government contained in a letter addressed to the competent EU commissioner and attached as Annex II to the draft decision.
In line with the requirements of Article 45(3) of the GDPR, the adequacy decision for South Korea will be reviewed every four years, with the first revision period shortened to three years. This is longer than the initial revision time for Japan, which is set at two years, and very different from the approach taken with respect to the U.K., where the adequacy decision expires after four years unless renewed. It shows the commission has confidence in the South Korean privacy regime, which should not come as a surprise since South Korea is known to many of us as having one of the most stringent privacy laws in the world.
The draft decision now goes to the European Data Protection Board for comments. If the recent Japan and U.K. draft adequacy decisions are anything to go by, we should expect detailed and often critical comments from the EDPB. The opinion of the EDPB is not binding but nevertheless influential. The commission also needs to obtain the green light from a committee composed of representatives of the EU Member States. The European Parliament is not required to approve the decision, but it may offer its suggestions and comments, and most likely will do so. The above steps which the commission needs to go through before formally adopting the adequacy decision tend to take several months.
Photo by Sunyu Kim on Unsplash
