Personal Information Protection Commission Announces Legislative Notice on Amendment of Personal Information Protection Act Enforcement Ordinance
(Seoul = Yonhap News) Reporter Lee Sang-seo = The Personal Information Protection Commission announced on the 23rd that it would issue a legislative notice on the amendment of the Personal Information Protection Act Enforcement Ordinance, aimed at expanding the ‘MyData’ (personal data transfer rights) to all sectors, open until August 4.
The MyData service allows individuals to request companies or institutions holding their personal information to transfer it to another place that they or related parties desire.
The Personal Information Protection Commission has been promoting the introduction of MyData across all sectors since March, starting with healthcare and telecommunications.
The amendment includes expanding the criteria for personal data handlers and the range of transferable information to all sectors and establishing specific guidelines for these.
Key criteria for personal data handlers include companies with annual sales of 1.5 billion won or those holding information of more than 1 million data subjects or sensitive unique information of over 50,000 individuals; universities holding information on more than 20,000 students; public system operators; and third-party data handlers.
The criteria for transferable information include data processed with the consent of the data subject or due to contract fulfillment, as well as information processed according to related laws.
However, information separately generated, such as risk group information created by analyzing patient prescriptions in hospitals, and information infringing on third-party rights and interests, are excluded.
The guideline also specifies safe transmission methods for when a data subject requests their information be transferred through a proxy.
Particularly, if an agent uses automated tools like scraping, the data must be transferred in an agreed-upon manner with the data handler in advance.
Furthermore, it identifies specialized institutions that are ensured to be safe and reliable to support the exercise of data subjects’ rights and manage personal information safely.
As a result, data subjects can make transfer requests through these specialized agencies, and the data will be stored in a repository accessible only by the subjects themselves. The specialized agencies can manage and analyze the data as mandated by the subject’s delegation.
Ha Seung-cheol, the head of the MyData Promotion Division at the Personal Information Protection Commission, stated, “We will strive to substantially guarantee control over personal information to realize a government of national sovereignty, enabling the public to experience safe and innovative MyData services.”
Opinions on the amendment can be submitted via email ([email protected]) or through the National Participation Legislation Center.