The scope of the right to request transmission of one's own data under MyData, previously limited to health care and telecommunications, will be expanded to all industries. Going forward, people will be able to directly download and manage personal information retrieved across daily life, including transportation, culture, leisure, and distribution, or gather it in one place for use.
The Personal Information Protection Commission said an amendment to the Enforcement Decree of the Personal Information Protection Act that expands the scope of MyData's right to request transmission to all sectors was approved at a Cabinet meeting on the 10th. The amendment expands the scope of the transmission right—under which data subjects can move and use their personal information wherever they want—from the existing health care and telecommunications sectors to all sectors.
After a grace period, the amendment is scheduled to take effect in Aug.
According to the decree, entities that transmit information for the data subject (personal information handlers) are defined as large-scale personal information handlers and others with the capability to protect personal information. This includes institutions that, under the Framework Act on Small and Medium Enterprises and other laws, have average sales exceeding 180 billion won and handle data for 1 million or more data subjects, or process sensitive or unique identification information for 50,000 or more people; public system operating institutions; and third-party information transmitters.
As a rule, information that may be requested for transmission includes data processed with the data subject's consent, during contract formation or performance, or under statutes. However, information separately analyzed or processed and generated by the personal information handler, information that infringes on the rights or interests of third parties, and trade secrets may be excluded.
For secure transmission, when a representative requests transmission, it must be sent only in a method prearranged with the personal information handler. In principle, an application programming interface (API—consolidation between computers or software) linkage method is recommended, but in the short term, scraping is conditionally allowed only for representatives whose safety and reliability are assured after prior consultation.
If a representative of a personal information handler requests transmission using a prearranged method, it cannot be refused without justifiable reason.
Encrypting information that a data subject can view on a website and downloading it directly is also specified as a transmission method.
Considering the preparation period, public system operating institutions and third-party information transmitters will have a six-month grace period after promulgation, and private large-scale personal information handlers with average sales exceeding 180 billion won will have a one-year grace period.
The Personal Information Protection Commission plans to run a working-level council to expand third-party transmissions to energy, education, employment, culture, and leisure, and to hold briefings starting in Mar. on plans to designate and support specialized institutions for personal information management.
Song Kyung-hee, Chairperson of the Personal Information Protection Commission, said, "With this amendment to the decree, people are expected to actively exercise their sovereignty over personal information and, according to their wishes, move and use their information," adding, "We will ensure information is transmitted in a safe and trustworthy environment to bolster public trust in the MyData system and deliver tangible results."