News and developments
Major Amendment to the Personal Information Protection Act Passed by National Assembly (II)
The legislative purpose of the Amended PIPA is to facilitate the use of personal information while strengthening the protection of data subjects’ rights and ensuring compatibility and interoperability with the global regulatory regime in the advent of the digital economy. Accordingly, the Amended PIPA contains some significant changes in terms of substance.
In a series of 3 newsletters, which will be circulated in short succession, we will take a closer look at some of the key provisions of the Amended PIPA as set out below.
In this second newsletter, we review some of the key provisions of the Amended PIPA relating to the processing of special categories of personal information.
If you have any questions regarding this article, please contact below: Kwang Bae PARK ([email protected]) Jong soo (Jay) YOON ([email protected]) Hwan Kyoung KO ([email protected]) Sunghee CHE ([email protected]) Kyung Min SON ([email protected]) For more information, please visit our website: www.leeko.com
[1] Decisions made automatically and without human intervention after processing personal information entirely by automated systems, such as those using artificial intelligence technology (Art.4(vi)). [2] Under the Amended PIPA, information on the ‘methods and procedures for refusing the transfer of personal information and the effects thereof’ must also be notified to data subjects when obtaining consent for cross-border transfers of personal information. [3] Data controllers that have been ordered by the PIPC to cease the cross-border transfer of personal information as above will have an opportunity to file an objection within seven (7) days from the receipt of the order.
l Newsletter No. 1: Provisions relating to the processing of personal information in general - Unification of data protection rules for offline and online businesses - Revamping of provisions relating to administrative penalties and criminal penalties - Easing of requirements for the processing of personal information - Revamping of provisions relating to the mediation of disputes involving personal information l Newsletter No. 2: Provisions relating to the processing of special categories of personal information - Revamping of provisions relating to visual information processing devices - Introduction of rights relating to automated decision-making - New rules for cross-border transfers of personal information l Newsletter No. 3: Provisions relating to the right to data portability |
- Revamping of provisions relating to visual information processing devices
- Introduction of new provisions for mobile visual information processing devices
- Revamping of existing provisions for stationary visual information processing devices
- Introduction of rights relating to automated decision-making
- The right to request an explanation from the data controller in cases where they have been subjected to automated decision-making.
- The right not to be subject to automated decision-making in certain cases when automated decision-making is likely to affect/has affected their rights or obligations significantly, except when such decision-making is made on the basis of data subjects’ consent, legal provisions or the need for the execution/performance of a contract between the data subjects and the data controller.
- New rules for cross-border transfers of personal information
- Expansion of legal bases for cross-border transfers of personal information
- when the data subject has separately given his or her consent;
- when there are special provisions regarding the cross-border transfer of personal information in laws, treaties, or international agreements;
- when the (i) outsourcing of the processing of personal information or the storage thereof is necessary for the execution or performance of a contract and (ii) information[2] that must be notified to data subjects when obtaining consent for the cross-border transfer of personal information has been disclosed in the privacy policy or notified individually to data subjects via methods prescribed by the Enforcement Decree of the PIPA (e.g., by email);
- if the overseas recipient has obtained data protection certification prescribed by the PIPC and has taken all of the following measures:
- security measures necessary for the protection of personal information and measures necessary to guarantee the rights of data subjects; and
- measures necessary to conduct data processing in accordance with data protection certification in the country where personal information is to be transferred; and
- when personal information will be transferred cross-border to a country or international organization recognized by the PIPC as having essentially equivalent levels of data protection as those required under the PIPA.
- Orders to cease the cross-border transfer of personal information (Art. 28-9)
If you have any questions regarding this article, please contact below: Kwang Bae PARK ([email protected]) Jong soo (Jay) YOON ([email protected]) Hwan Kyoung KO ([email protected]) Sunghee CHE ([email protected]) Kyung Min SON ([email protected]) For more information, please visit our website: www.leeko.com
[1] Decisions made automatically and without human intervention after processing personal information entirely by automated systems, such as those using artificial intelligence technology (Art.4(vi)). [2] Under the Amended PIPA, information on the ‘methods and procedures for refusing the transfer of personal information and the effects thereof’ must also be notified to data subjects when obtaining consent for cross-border transfers of personal information. [3] Data controllers that have been ordered by the PIPC to cease the cross-border transfer of personal information as above will have an opportunity to file an objection within seven (7) days from the receipt of the order.