On March 30, 2021, Chairperson of the Personal Information Protection Commission (the "PIPC") of the Republic of Korea and the Commissioner for Justice of European Commission (the "EC") issued a joint press statement declaring that Korea is an adequate jurisdiction and ensures a similar level of protection to EU for personal data.
During the past four years, Korea and EU have been conducting an in-depth review of the relevant laws and regulations, including the Personal Information Protection Act of Korea and duties of the relevant government agencies. Immediately after the joint press statement, the EC will start its decision-making procedure to adopt the adequacy finding in the coming months and plans to adopt the adequacy decision on Korea in the second half of this year. The adoption of an adequacy decision will involve: (i) disclosure of the EC's initial finding (current stage), (ii) an opinion from the European Data Protection Board, (iii) an approval from a committee, composed of the representatives of EU Member States, and (iv) the adoption of the adequacy decision by the EC via resolution.
As a result of the adequacy decision, personal data can flow from EU to Korea without any further safeguards, such as standard contractual clauses or binding corporate rules, being necessary. However, as this adequacy decision relates to the transfer of personal data from EU, any company that directly collects personal data from the EU residents as a data controller still needs to comply with the obligations under the GDPR for its collection of personal data. In other words, if the company is collecting and processing personal data of EU residents, it is necessary for such companies to review the legal basis for processing personal data under the GDPR and take applicable security measures.
The adequacy finding will cover both commercial operators and the public sector. However, the transfer of personal credit information supervised by the Financial Services Commission of Korea is excluded from the adequacy decision as the scope of the adequacy decision is limited to those areas regulated by the PIPC. The adequacy decision will be re-examined every four years by the EC, and the decision may be challenged as to the scope of the application. Therefore, organizations operating in the EU and Korea should continue to monitor new developments even after the adoption process has been completed.
Related Topics
