On October 11, 2023, the Personal Information Protection Commission (PIPC) of South Korea made a significant announcement, revealing its initiation of the 'Preliminary Adequacy Review System' set to commence on October 13, 2023. This system aims to ensure the secure handling of personal information in novel services and emerging technologies, such as artificial intelligence (AI). Notably, the PIPC emphasized that this innovative approach allows for consultations regarding the secure use of personal data prior to the launch of new services and technologies, thereby enhancing legal certainty for businesses.
The Preliminary Adequacy Review System is designed to promote the secure use of data and foster trust in personal information by proactively assessing compliance with the Personal Information Protection Act (PIPA). This system encompasses a three-step procedure:
During the planning and preparation stages for the development of new services and technologies, should a business be uncertain about whether its operations adhere to the PIPA, it can request a preliminary adequacy review from the PIPC.
Following a comprehensive analysis of the business's personal information processing environment and data flows, the PIPC engages in discussions and formulates a PIPA compliance plan.
The business proceeds to provide its services in accordance with the agreed-upon compliance plan, with the PIPC retaining authority to oversee its implementation.
In conclusion, the PIPC envisions full-scale implementation, contingent on the results of the pilot operation, scheduled for January 2024.
Glossary
- PIPC: Personal Information Protection Commission.
- Preliminary Adequacy Review: A system involving a proactive review of compliance with the Personal Information Protection Act.
- PIPA: Personal Information Protection Act.
This novel system represents a significant stride towards ensuring the security of personal information in an era where advanced technologies like AI are becoming increasingly pervasive. South Korea showcases its commitment to safeguarding citizens' privacy and offering clear guidance to businesses operating in the realm of personal data management. With its proactive approach, the PIPC is setting a standard that could inspire other jurisdictions to follow suit.
