The European Data Protection Board (“EDPB”) has issued its opinion on the draft adequacy decision published by the European Commission on last 16 June 2021 (available here) concerning the transfer of personal data to the Republic of Korea.
This is a decision that, once in force, will allow the EU economic operators – such as, first of all, all the electronic communication service providers, cloud providers and multinational companies – to freely transfer personal data from Europe to the Republic of Korea without having to adopt either the appropriate safeguards (e.g., “Standard Contractual Clauses“) or the additional measures (e.g., consent of data subjects) required by Chapter V of EU Regulation No. 679/2016 (“GDPR”).
Indeed, pursuant to articles 44 et seq. of the GDPR, the transfers of personal data to countries outside the European Economic Area or to an international organization are allowed provided that the adequacy of the third country or organization is expressly recognized by a decision of the Commission.
We will now examine in detail the contents of the opinion issued by the EDPB.
Firstly, it was noted that the Republic of Korea’s legal framework on the protection of personal data is substantially aligned with the European one, especially with regard to the main definitions provided for by law (“personal data”, “processing” and “data subject”), the requirements for a lawful data processing, the general principles and the security measures.
This has been possible not only thanks to the presence of an effective privacy law (i.e., the “Personal Information Protection Act” or “PIPA” which came into force in 2011) but also because of a series of “notifications” (included the “Notification no. 2021-1”) issued by the Korean Data Protection Authority (i.e., “Personal Information Protection Commissioner” or “PIPC”) which explain and make easily understandable the provisions of PIPA.
Moreover, as noted by the EDPB, the Republic of Korea is part of a number of international agreements that guarantee the right to privacy (including the “International Covenant on Civil and Political Rights“, the “Convention on the Rights of Persons with Disabilities” and the “ONU Convention on the Rights of the Child“), which confirms the attention that the Republic of Korea has paid to the protection of personal data for several years now.
The EDPB’s analysis then focused on some key aspects of PIPA that slightly differ from the GDPR and therefore require more attention – such as, in particular, the absence of a general right to withdraw the consent provided by the data subjects, for example, for marketing activities.
According to the EDPB, although article 37 of PIPA grants data subjects the right to request the “suspension” of the processing of their personal data – a right that can be exercised also in case of direct marketing, as expressly clarified by Recital 79 of the EU Commission adequacy decision – the PIPA provides for the right to withdraw the consent only in two specific cases:
- in relation to the transfers of personal data carried out in the context of special corporate operations (such as mergers, acquisitions, etc.);
- with regard to the processing of personal data for marketing activities by providers of electronic communication services.
The EDPB therefore considered it necessary to draw the Commission’s attention to the above-mentioned issues in order to analyze in detail the consequences that, in the light of the Korean legal framework, the absence of such a right might cause for data subjects and to clarify, in the adequacy decision, the actual scope of the above-mentioned right to request the “suspension” of the processing.
Secondly, the EDPB observed that, pursuant to article 58 of PIPA, a substantial part of PIPA – including Chapters III, IV and V, which respectively regulate the general principles for data processing, the security measures and the rights of data subjects – does not apply to several processing of personal data (including those necessary to meet urgent needs for the protection of public health and safety).
The EDPB also notes that the word “urgent” in the PIPA expresses an extremely broad concept that needs to be limited and contextualized, also with the help of practical examples, in order not to compromise the confidentiality of the data subjects’ personal data.
Moreover, the EDPB, in the light of the current emergency situation caused by the Covid-19 pandemic, drew the Commission’s attention in relation to the need to ensure an adequate level of protection also for personal data transferred to the Republic of Korea for purposes related to public health protection.
This is because “sensitive” information relating to European citizens (for example, the vaccination status), should receive at least the same level of protection as granted under the GDPR once transferred to the Republic of Korea. In this regard, the EDPB therefore invited the Commission to closely monitor the application of the exemptions provided for in article 58 of PIPA.
Finally, the EDPB considered it appropriate to focus on the possibility for Korean public authorities to access the personal data of European citizens for national security purposes. In this respect, there is no specific obligation for Korean authorities to inform data subjects of the access to their personal data, especially when data subjects are not Korean citizens.
However, even in the absence of such obligation, the balance between the needs of protection of the national security and the protection of the fundamental rights of the data subjects can be found in the same Korean Law that protects the privacy of interpersonal communications (the “Communications Privacy Protection Act” – see also Recital 187 of the adequacy decision), according to which the access to the personal data of European citizens for purposes of national security can be made only if certain legal requirements are met (for example, in the case of communications between “foreign agencies, groups or citizens suspected of being involved in activities threatening national security“).
The EDPB notes that, as a further guarantee of the confidentiality of communications accessed by the Korean authorities, the South Korean Constitution states essential data protection principles applicable to this specific matter.
In the light of the favorable opinion issued by the EDPB, it is certainly desirable, and likely, that the European Commission will adopt an adequacy decision in respect of the Republic of Korea.
In an increasingly data-driven global economy based on the economic value of personal data as well as on the sharing of personal data, such an adequacy decision would open the door to the liberalization of trade with the east, also from a privacy perspective.
This regulatory intervention, object of this article, was due and awaited and it certainly follows the “Free Trade Agreement” between the EU and South Korea in force since 2011, which has been able to exponentially increase bilateral trade between the two countries (in 2015 the trade value of transactions amounted around € 90 billion).
Our hope is that, as the years go by, the European Commission’s adequacy assessments will cover more and more legal frameworks so that the international transfer of personal data can represent a real and concrete instrument for promoting the economy and innovation worldwide.