On March 30, 2023, in response to a data center fire in October 2022 that resulted in a service disruption in Korea, the Ministry of Science and ICT (the “MSIT”) announced the “Measures to Strengthen the Stability of Digital Services.” On the same day, the MSIT pre-announced the Proposed Amendment to the Enforcement Decree of the Broadcasting Communications Development Act and the Proposed Amendment to the Enforcement Decree of the Network Act (pre-announcement period: March 30, 2023 – May 9, 2023). Thereafter, on April 5, 2023, the MSIT pre-announced the Proposed Amendment to the Enforcement Decree of the Telecommunications Business (“TBA”) (pre-announcement period: April 5, 2023-May 16, 2023). The purpose of such proposed amendments is to strengthen the obligations on data center operators and value-added service providers (“VSPs”) to prevent similar service disruptions in the future.
As relevant parties may be subject to more stringent obligations for ensuring service stability, it is recommened for those affected to submit their opinions to the MSIT within the pre-announcement period, if necessary. The key details are as follows:
1. Strengthened Obligations on Data Center Operators
-
Data center operators with a floor area of 500m2 or more1 (the Enforcement Decree of the Network Act)
|
- |
Obligated to take protective measures for information and communications facilities to ensure continuous and stable operation, etc. |
|
- |
Inspection on implementation of the above protective measures to be conducted annually. |
|
- |
Obligated to report to the MSIT without delay in the event of (i) consecutive service suspension for 30 minutes or more, or (ii) service suspension for two or more times within 24 hours for a total of 45 minutes or more. |
-
Data center operators with a floor area of 22,500m2 or more, or a power substation of 40MW or more2 (the Enforcement Decree of the Broadcasting Communications Development Act)
|
- |
Obligated to establish and implement a master plan (i.e., details of physical and technical measures, etc.) for the management of disasters in broadcasting communications, and such plan shall be submitted to the Minister of the MSIT no later than September 30 of each year. |
In addition, in the “Measures to Strengthen Stability of Digital Services” press release, the MSIT unveiled its plans to strengthen the obligations regarding (i) disaster prevention measures, (ii) securing structural stability, (iii) systematization of power management, (iv) duplexing of backup power (i.e., dual backup power facilities), and (v) response to fire hazards for the purpose of enhancing the stability and viability of data centers, and to implement amendments to detailed standards of the Guidelines for Protection of Internet Data Center Facilities (MSIT Notification), accordingly.
2. Strengthened Obligations of VSPs
-
Service providers that exclusively operate/manage leased facilities3 (the Enforcement Decree of the Network Act)
|
- |
Obligated to take protective measures for information and communications facilities they exclusively operate/manage. |
|
- |
Obligated to report to the MSIT without delay in the event of (i) consecutive service suspension for 30 minutes or more, or (ii) service suspension for two or more times within 24 hours for a total of 45 minutes or more. |
-
Service providers that do not exclusively operate/manage leased facilities (the Enforcement Decree of the Network Act)
|
- |
Obligated to fully cooperate with the implementation of protective measures for information and communications facilities of lessor. |
-
Service providers with the daily average number of domestic users of 10 million or more, or daily average domestic traffic volume of 2% or more (under the Enforcement Decree of the Broadcasting Communications Development Act)
|
- |
Obligated to establish and implement a master plan (i.e., details of physical and technical measures, etc.) for the management of disasters in broadcasting communications, and such masters plan shall be submitted to the Minister of the MSIT no later than September 30 of each year. |
3. Proposed Legislation of the Digital Service Safety Act (Tentative Name)
In announcing the “Measures to Strengthen Stability of Digital Services,” the MSIT unveiled its plans to enact the Digital Service Safety Act (tentative name) to consolidate the current systems related to the stability of digital services, which had been set forth in a series of discrete laws, into a single law, and to establish a comprehensive disaster management system covering the digital base of networks, data centers and digital services.
1 Data center operators that provide their own services shall be subject to the above obligations only if their previous year’s sales revenue is KRW 10 billion or more and the daily average number of domestic users is 1 million or more.
2 Such data center operators shall be subject to the above obligation only if their previous year’s revenue is KRW 10 billion or more.
3 Refers to business entities that (a) directly install and/or operate facilities necessary for protective measures (i.e., electricity and fire-fighting facilities, etc.) in the data center, or (b) implement access controls that completely prohibit a third party’s access to the leased facilities.
