South Korea is making changes to its data protection enforcement system that will hopefully clear the way for its long-awaited adequacy decision from the European Union.
The EU only allows frictionless personal data transfers to outside countries if their data protection regimes are deemed to be "adequate," or essentially comparable to that of the EU itself. Lucky recipients of such decisions include Canada, Argentina, Israel, Switzerland and — effectively, via the Privacy Shield framework — the U.S.
South Korea has quite strong data protection rules, and it initiated the process of getting an EU adequacy decision back in 2015. However, there are problems with the independence of its enforcement bodies, and that's what the new legislation is designed to fix.
When South Korea started down the adequacy road, the basis for the proposal was its strict Personal Information Protection Act. The law, enacted in 2011, created a Personal Information Protection Commission that is a data protection authority supposedly with independence but without enforcement powers of its own. The authority's enforcement powers instead reside with the Ministry of the Interior and Safety, which is, of course, not independent from the government.
As far as the Europeans are concerned, that simply doesn't fly.
"With regard to [the] current structure of DPAs in Korea, simply speaking, the MOIS has the power to enforce the PIPA [but has a] lack of independence under EU standard, while the PIPC satisfies the independence standard, but [suffers a] lack of enforcement power," said Kwang Bae Park, a partner and leader of the technology, media and communications group at the Seoul-based law firm Lee & Ko.
So, facing an impasse in the EU adequacy talks, the focus shifted and narrowed to data protection under the Act on Promotion of Information and Communications Network Utilization and Information Protection — or the "Network Act," as it is more conveniently known.
"The issue was that PIPC did not have the enforcement powers that are required from a Data Protection Authority to apply for adequacy," said Claude Moraes, the chair of the European Parliament's Committee on Civil Liberties, Justice and Home Affairs, which sent a delegation to South Korea in late October.
"Therefore, the South Korean authorities went to apply for partial adequacy under the Network Act, given that the KCC is both independent and has enforcement powers," Moraes continued. "Since then, the European Commission has asked the South Korean authorities to clarify the scope, and eventually, the South Korean authorities confirmed that the scope of a partial adequacy based on the Network Act would in fact be limited in a transfer context (although its scope is actually quite broad in a domestic context)."
South Korea's Network Act specifically deals with data protection as it relates to broadcasting and communications, which is a far cry from the scope of the EU General Data Protection Regulation, although it does cover most big businesses' online activities. It is enforced by the Korea Communications Commission.
Article 45(1) of the GDPR says the European Commission may grant an adequacy decision to specific sectors in a country, as opposed to entire countries. Still, it is clearly preferable for a country to get a blanket adequacy decision instead.
Jeongsoo Lee, the KCC's deputy director, told The Privacy Advisor that talks between the European Commission and the KCC had established that South Korea has an "exemplary" data protection regime, and that, "whereas before the adequacy talks centered on the Network Act, now we are exploring the possibility of adequacy with a more comprehensive scope."
That scope would be made possible by amendments to the PIPA that were submitted to the South Korean National Assembly on Nov. 15. According to these changes, the PIPC would essentially win the enforcement functions that it lacks from the MOIS and the KCC.
"Once those bills [are] passed by the National Assembly (and I believe the chances are high), I believe the substantial obstacle for EU’s finding on the adequate level of protection under the Korean data protection laws could be removed and the adequacy decision process will be expedited," Park said via email.
So, would these changes really clear the way for an adequacy decision? The Europeans are certainly keen.
Moraes noted that the PIPC's current lack of enforcement powers mean it is not really fully independent, as it depends on the interior ministry for enforcement. "The independence of the PIPC should … be improved. Hopefully, this is what will happen with the modifications to the PIPA," he said.