Will the transfer of personal information to the UK become easier… Personal Information Protection Commission begins review of protection level

The Personal Information Protection Commission has begun reviewing whether to grant adequacy recognition for personal information protection levels to the United Kingdom.

The Personal Information Protection Commission announced on the 1st that it will begin a full-fledged review in October of whether to recognize the UK as having an equivalent level of personal information protection under the Personal Information Protection Act.

Adequacy recognition is a system that, after comprehensively reviewing the other country's personal information protection framework and the level of guarantee for data subjects' rights, acknowledges that a substantially equivalent level of personal information protection is being achieved compared to South Korea.

Once adequacy recognition is granted for a specific country, domestic companies and public institutional investors, among others, can transfer personal information to that country without additional requirements for overseas transfers. It was explained that this could lead to more active global business activities and international joint research. However, other legal obligations, such as the requirements for collecting, using, and providing personal information, as well as safety measures, must still be complied with.

Previously, the Personal Information Protection Commission made its first adequacy recognition decision in September of last year regarding the European Union and the European Economic Area. The targets include 27 EU member states such as Germany, France, and Italy, and three EEA countries: Norway, Iceland, and Liechtenstein. Through this, a foundation for safe and smooth personal information transfer was established on the premise of high-level personal information protection.

The EU also made its first adequacy decision regarding South Korea in 2021. An adequacy decision is a system in which the EU recognizes that a specific country's level of personal information protection is equivalent to that of the EU, similar to South Korea's adequacy recognition system. In July of this year, through a re-review, the EU assessed that South Korea's personal information protection framework continues to maintain a high level and decided to continue maintaining the adequacy decision.

Accordingly, a bidirectional personal information transfer system based on mutual trust has been established and maintained between South Korea and the EU. The Personal Information Protection Commission has been reviewing the next country for adequacy recognition based on its experience with the EU and feedback gathered from the field, including the domestic industry and research sectors. After two reviews by the Overseas Transfer Special Committee in August and September of this year, the UK was determined to be the next target country for review.

During the review process, factors such as cooperation relations in economic and digital fields, similarities in personal information protection legal systems, the other country's willingness to cooperate, and the principle of reciprocity were comprehensively considered.

The Personal Information Protection Commission plans to comprehensively review the UK's personal information protection legal framework, supervision and enforcement system, guarantee of data subjects' rights, and procedures for remedy in case of damage. Through this, it will carefully evaluate whether a substantially equivalent level of personal information protection is being achieved in the UK compared to South Korea.

According to the Personal Information Protection Commission, the mutual adequacy recognition decision between South Korea and the EU has been predicted to have an economic effect of expanding medium- to long-term trade volume by up to 32.9 billion dollars, approximately 47 trillion won. It is expected that once the mutual adequacy recognition decision with the UK is completed, it will serve as a foundation for activating the data economy, including expanded trade and international joint research between the two countries.

Song Kyung-hee, Chairperson of the Personal Information Protection Commission, stated, "Following the stable establishment and maintenance of the mutual personal information transfer system with the European Union, we plan to carefully review the level of personal information protection in the UK to establish a smooth data transfer system." She added, "Through this, while safely protecting citizens' personal information, we expect that trust-based global data cooperation will expand, allowing companies, public and research institutional investors, among others, to utilize data with peace of mind."