South Korea

On September 28, 2021, the European Data Protection Board (“EDPB”) issued its opinion on the European Commission’s (“Commission”) draft decision on the adequate protection of personal data in the Republic of South Korea.  Once the Commission approves the decision, it will allow for personal data to flow freely from the EEA to commercial operators and public authorities in South Korea, without the need to implement other transfer mechanisms provided in the General Data Protection Regulation (“GDPR”), such as standard contractual clauses.

The EDPB’s opinion is overall favorable with respect to the Commission’s finding that South Korea’s data protection laws offer a level of protection essentially equivalent to that provided by the GDPR.  In particular, the EDPB highlights that there are “numerous similarities” between the South Korean data protection laws (which include the Personal Information Protection Act (PIPA), its adjoining Enforcement Decree, and Notification No. 2021-1) and the European data protection framework, in particular the GDPR.
Continue Reading EDPB Adopts Overall Favorable Opinion on European Commission’s Draft Adequacy Decision for South Korea

South Korea has became the fifth member economy to join the Asia-Pacific Economic Cooperation’s (“APEC”) Cross-Border Privacy Rules (“CBPR”) system, a voluntary but legally enforceable code of conduct that aims to facilitate secure data transfers and e-commerce between parties to the agreement.

Established in 2011, the CBPR system aims to provide a minimum level of protection for personal information exchanged among member economies as e-commerce continues to boom. It helps mitigate privacy concerns led by the ever-increasing flow of personal data across borders and build consumer trust by ensuring that data is processed in compliance with the CBPR’s high security standards without restricting data flows.  Countries and businesses that took part in the multilateral system agree to implement APEC’s nine privacy principles, which include, for example, preventing harm, notice, collection limitation, integrity, and accountability, in all cases involving the transfer or processing of personal information.
Continue Reading South Korea Joins the APEC Cross-Border Privacy Rules Framework

South Korea’s new comprehensive privacy law, the Personal Information Protection Act, promulgated on 29 March 2011, is now in effect. The Korean government allowed a grace period for companies to comply with the provisions of the new law and this came to an end on March 31st 2012. In relation to the private sector, the new legislation replaces some aspects of the Act on Promotion of Information and Communications Network Utilization and Information Protection (ICN Act). Described by privacy commentators as one of the strictest privacy laws in the world, the new legislation reflects the baseline standards of the OECD Privacy Guidelines and the APEC Privacy Framework (2004) to a large extent and also appears to exceed those requirements in several respects. This is an introduction to some of the core provisions of the new legislation:
Continue Reading Grace Period for Compliance with New Korean Privacy Law Ended this Spring

The South Korean Ministry of Public Administration and Security reiterated support this week for its plans to abolish legislation that requires Internet users on social networks to use their real names on websites.  Currently, the law requires websites with more than 100,000 visitors per day to require users to register with their real names.  In