The Personal Information Protection Commission projected on the 20th that expanding the right to request personal transmission (MyData) across all sectors would lead to increased data utilization and the creation of new industries. However, considering the industry's need for a preparation period, it is also contemplating a six-month grace period after implementation.
On this day, the Personal Information Protection Commission expressed its stance regarding industry concerns about the amendment to the Personal Information Protection Act enforcement ordinance, which was publicly announced for legislation from June 23 to the 4th of this month, at a press briefing at the Government Seoul Building. The amendment mainly aims to expand the right to request personal transmission, which was limited to certain fields such as medical and communication, to all sectors.
The right to request personal transmission allows individuals to demand that personal information processors send (download) their information to themselves. According to the amendment, personal information processors meeting certain criteria, such as those with annual sales exceeding 150 billion won and processing personal information of over 1 million individuals, as well as those processing sensitive information or unique identification information of over 50,000 individuals, are included in the scope of personal transmission requests regardless of the field. Consequently, about 680 businesses are expected to be newly included as targets for personal transmission requests.
According to the Personal Information Protection Commission, a variety of concerns were raised during the legislative notice process, including the burden of building transmission systems, fears of trade secret leakage, concerns over misuse of information by specialized institutions, and the need for a grace period for the amendment. In response to claims that the information transmitter would bear the expense of building systems, the Personal Information Protection Commission stated, 'Startups and small businesses with poor finances will be excluded from the list of information transmitters,' adding that 'they will rather have the opportunity to receive data without bearing expenses and create innovative services and new businesses.'
For mid-sized companies and above included as information transmitters, it was noted that 'since they can add functionality to download personal information that is displayed and viewed through their websites, the burden of expense will not be significant.'
Regarding concerns about trade secret leakage, it was stated that 'information created separately by processing and analyzing personal information collected by the personal information processor will be excluded from the category of personal transmission information,' and 'it is stipulated that transmission requests must not violate others' rights or legitimate interests, so the possibility of trade secrets being leaked is almost nonexistent.' The Personal Information Protection Commission also emphasized that if there are items thought to be trade secrets among the provided items, businesses can mask the information themselves before providing it.
There were also voices expressing concern over the misuse and management negligence by specialized institutions responsible for personal information management. In response, the Personal Information Protection Commission stated, 'Specialized institutions must undergo strict screening and receive designations from the Personal Information Protection Commission and other government departments, and even after designation, they must maintain high reliability and safety through supervision and control, so the possibility of leakage is low.'
However, the Personal Information Protection Commission is reviewing the imposition of a six-month grace period after implementation of the amendment, reflecting industry opinions that time is needed for building transmission systems, among other factors. Director General Ha Seung-cheol noted, 'There have been many opinions asking for a grace period, and I see six months as sufficient,' adding, 'However, there are still discussions remaining with the Ministry of Legislation, and a specific grace period has yet to be determined.'
In addition to the legislative notice, the Personal Information Protection Commission held explanatory sessions for integrated and management specialized institutions, meetings with the Online Shopping Association and the Internet Enterprises Association, and discussions with civic groups to gather opinions. Director General Ha stated, 'We fully recognize the industry's concerns,' and 'we will continue to communicate with stakeholders and actively reflect reasonable opinions in the amendment process.'