On July 4, 2023, in order to prevent service failures arising from disasters in major data centers, several laws and regulations were enacted to strengthen the obligation of service providers to secure the stability of their services.
As a follow-up, the Ministry of Science and ICT (the “MSIT”) pre-announced the proposed amendment to the Guidelines for Protection of Internet Data Center Facilities (the “Proposed Amendment”) on August 9, 2023, specifying the standards for protective measures that must be taken by data center operators and service providers that exclusively operate and manage leased facilities.
Separately, the bill for the Act on Establishment of Fair Distribution Environment of Cultural Industries (the “Bill”), proposed by the Ministry of Culture, Sports and Tourism (the “MCST”) to protect the rights of authors, is under review to determine whether there is an overlap with regulations enforced by other agencies (i.e., Korea Fair Trade Commission, MSIT, and Korea Communications Commission (the “KCC”)).
The Culture, Sports and Tourism Committee of the National Assembly (the “CSTC”) passed the Bill on March 29, 2023 despite a disagreement on whether the Bill overlaps with the Broadcasting Act, Internet Multimedia Broadcasting Business Act, and Telecommunications Business Act. However, the Bill was referred back to the CSTC after the Legislation and Judiciary Committee of the National Assembly (the “LJC”) rejected it on July 17, 2023.
|
1. |
Pre-Announcement of the Proposed Amendment to the Guidelines for Protection of Internet Data Center Facilities |
|
(1) |
Establishing obligations to take various protective measures The Proposed Amendment newly established obligations to take technical, managerial, and physical protective measures, including the following: |
|
Category |
Protective Measure |
Details |
|
Access control and surveillance |
Installation and operation of Battery Management System (“BMS”) and auxiliary systems |
A BMS must be installed to enable monitoring of call temperature and voltage, and the measurement cycle time must be set as ten seconds or less. Auxiliary systems other than a BMS must be operated in parallel for early fire detection. |
|
Power management by sector |
In the event of a power shutdown, each sector must be managed separately to minimize the shutdown area. |
|
|
Redundant power facilities |
Redundant power facilities must be installed (at least N+1 backup) to enable power supply even in the event of a disaster. Redundant power facilities (main/backup) must be installed in physically separated areas if they have 2N or more redundancy. |
|
|
Installation of CCTVs |
CCTVs must be installed inside and outside of battery rooms. |
|
|
Alarm and emergency suspension system |
An emergency suspension system must be operated to enable automatic or manual suspension in the event of an emergency. |
|
|
Availability |
Protection of electricity and related facilities |
A control system must be implemented to enable the remote power shutdown of the Uninterruptible Power Supply (the “UPS”) system. |
|
UPS |
The UPS must include a remote bypass functionality to secure a stable power supply even in the event of system failures due to disasters, and must be configured to enable individual power shutdown per UPS system. |
|
|
Storage battery facilities |
There must be sufficient distances (i) between a storage battery and a wall, and (ii) between rechargeable batteries (except in cases where fireproof partitions are installed between racks, or the batteries are UL9340A batteries or conform to equivalent or higher standards). Power lines other than those connecting the UPS are prohibited inside the storage battery room (except for batteries installed inside the server room). |
|
|
Self-generating facilities |
Oil tanks must be placed separated by firewalls. |
|
|
Disaster prevention |
Fire-fighting facilities |
Rapid air vents must be installed to prevent ruptures or explosions in the event of internal pressure from inflammable gas inside the battery room. |
|
Flood prevention |
If main facilities are located underground, there must be flood protection barriers and drainage facilities installed at least as high as the predicted flood level to prevent flood damage. |
|
|
Protection management systems |
Facility protection plan and business continuity plan |
Simulation training (based on scenarios that reflect real-life disasters) must be conducted more than once every quarter and joint training with fire/electricity-related agencies must be conducted more than once every year. |
|
(2) |
Partially revising and removing obligations to take certain protective measures The Proposed Amendment partially revised and removed obligations to take protective measures as follows: |
|
Category |
Protective Measure |
Details |
|
Availability |
UPS |
Reduction of minimum power supply time: Currently, the minimum power supply time for computer rooms1 must be at least 20 minutes, but the Proposed Amendment reduced this to 15 minutes. |
|
Storage battery facilities |
Removal of obligation to install separate rooms for storage batteries: Installation of separate storage battery rooms and closed-type panels is no longer required. New prohibition of integrated management of storage batteries and UPS equipment: Currently, integrated management is allowed for storage batteries and UPS equipment. However, under the Proposed Amendment, if the battery capacity supplying electricity to one UPS exceeds 20kWh, it must be installed in a room separate from other electric facilities. |
|
|
Disaster prevention |
Fire-fighting facilities |
Installation of fire extinguishing equipment tailored to the characteristics of each facility: Currently, gas fire extinguishing equipment must be installed for major facilities and gas fire extinguishing equipment or sprinkler fire extinguishing equipment must be installed for other areas. The Proposed Amendment instead requires the installation of appropriate fire extinguishing equipment tailored to the characteristics of each facility (such as the type of batteries). |
|
Protection management systems |
Facility protection plan and business continuity plan |
New information required to be included in the facility protection plan and business continuity plan: The facility protection plan and business continuity plan must include specific plans for the power maintenance system, facility operation, and other issues by reflecting real-life disasters. |
1 Minimum power is the electricity equivalent to 130% of the average instantaneous power of the customer information system equipment in the computer room during a three-month period.
With this Proposed Amendment, protective measure obligations would become significantly stricter, not only for data center operators but also for service providers that exclusively operate and manage leased facilities. The MSIT may also issue a corrective order to a service provider if it finds that improvements are required after reviewing the implementation of protective measures. Therefore, it would become necessary for companies to thoroughly review the implementation status of the newly established and amended protective measures mentioned above.
|
2. |
Legislative Review of the Bill on the Act on Establishment of Fair Distribution Environment of Cultural Industries |
The Proposed Amendment to the Guidelines for Protection of Internet Data Center Facilities is expected to take effect in early 2024, but there are still regulatory review procedures remaining. Therefore, it would be advisable for each company to review whether it would be subject to specific obligations under the Proposed Amendment and take into consideration recent developments.
In addition, if the MCST begins actively pursuing the enactment of the Bill and the Bill is passed, it would become necessary for companies involved with cultural industries or products to conduct comprehensive reviews of their contracts and business practices. Therefore, it would be advisable for companies to continue to monitor the progress of the Bill and consider submitting opinions to the Government agencies if necessary.
