SOUTH KOREA Trends and Developments Contributed by: Hwan Kyoung Ko, Sunghee Chae, Kyung Min Son and Matt Younghoon Mok, Lee & Ko
Amended PIPA will enter into force six months after promulgation, though the mandatory ISMS-P certifi - cation requirements will take effect from 1 July 2027. In parallel with the strengthening of corporate respon - sibility, the PIPC has also indicated its intention to introduce special statutory provisions permitting lim - ited processing of personal data for artificial intelli - gence (AI) development or performance improvement, subject to defined conditions and regulatory oversight. In addition, several significant court decisions have recently been rendered addressing the scope of cor - porate liability for damages arising from data breaches and the applicability of the right to request suspension of processing in the context of pseudonymisation. The principal elements of these developments are discussed below. Key Amendments Under the Amended PIPA Express clarification of representative director responsibility and strengthening of the CPO’s role A key structural change introduced by the Amended PIPA concerns the clarification of responsibility for per - sonal data protection within the corporate structure. The amendments expressly identify the representative director (or business owner in the case of a sole pro - prietorship) as bearing ultimate responsibility, expand the organisational and reporting functions of the CPO, and, for entities meeting prescribed thresholds, sub - ject the appointment and removal of the CPO to board approval and notification to the PIPC. Accordingly, personal data protection in Korea is addressed within formal corporate governance processes rather than solely as an operational compliance matter. Express clarification of representative director responsibility (new Article 30-3) The Amended PIPA introduces a new Article 30-3, which expressly provides that a representative director or business owner bears ultimate responsibility for the safe processing of personal data and the protection of data subjects’ rights. The provision further requires that such representative director or business owner implement effective overall management measures, including the provision of professional personnel and
sufficient budgetary support necessary for personal data protection. Expansion of the CPO’s duties (Article 31, paragraph 4, subparagraphs 2 and 3) Article 31 of the Amended PIPA expands the statutory duties of the CPO. In addition to existing responsibili - ties, the CPO is now required to: • manage professional personnel necessary for personal data protection and secure the relevant budget; and • report to the business owner or representative director, as well as to the board of directors, on the status of personal data protection and other major related matters. Board resolution and reporting obligations for CPO appointment (Article 31, paragraph 3, subparagraphs 1 and 2) Under the Amended PIPA, data controllers meeting thresholds to be prescribed by Enforcement Decree and based on factors such as turnover and scale of personal data processing are subject to additional procedural requirements concerning the CPO. For such entities: • the appointment, replacement or dismissal of the CPO must be approved by a resolution of the board of directors; and • such appointment, replacement or dismissal must be reported to the PIPC. Mandatory personal information protection certification (ISMS-P) The Amended PIPA introduces mandatory ISMS-P certification requirements for certain data controllers. ISMS-P builds upon the existing ISMS certification framework required for certain entities under the Act on Promotion of Information and Communications Network Utilisation and Information Protection, by incorporating additional requirements relating to per - sonal data protection. Certification is conducted by the Korea Internet & Security Agency (KISA) and, in the case of financial institutions, the Financial Security Institute (FSI), which
448 CHAMBERS.COM
Powered by FlippingBook