SOUTH KOREA Trends and Developments Contributed by: Hwan Kyoung Ko, Sunghee Chae, Kyung Min Son and Matt Younghoon Mok, Lee & Ko
• where, within three years from the date of a prior administrative penalty, the data controller commits the same type of violation, provided that each vio - lation involves intent or gross negligence (for clar - ity, the assessment of intent or gross negligence for purposes of administrative penalties follows the criteria specified in the PIPC’s administrative penalty guidelines, rather than general Civil Code standards); • where a violation subject to an administrative pen - alty is committed with intent or gross negligence and affects more than ten million data subjects; or • where personal data breach occurs due to failure to comply with a corrective order. The violations listed in Article 64-2, paragraph 1 – including personal data breach, use or provision of personal data beyond the permitted purpose, and unlawful processing of unique identification infor - mation or sensitive information – may fall within the aggravated regime if the above conditions are met. Introduction of a mitigation provision (Article 64-2, paragraph 6) The Amended PIPA further introduces Article 64-2, paragraph 6, which provides that an administrative penalty must be reduced where the data controller has made investments and operated measures relating to personal data protection, including budget, personnel, facilities or systems, as prescribed by Enforcement Decree. This mitigation provision does not apply in cases involving intent or gross negligence. Revision of administrative fine provisions (Article 75) The Amended PIPA revises and supplements admin - istrative fine provisions in order to ensure the enforce - ability of newly introduced or amended obligations. In particular, the following violations are now subject to administrative fines or increased administrative fine amounts: • failure to designate a CPO, or designation of a CPO who does not meet statutory qualification requirements, with the maximum administrative fine increased from KRW10 million to KRW30 mil - lion (approximately USD21,000);
• failure to obtain board approval for the appoint - ment, replacement or dismissal of a CPO, where required, subject to a maximum administrative fine of KRW30 million (approximately USD21,000); • failure to report the appointment, replacement or dismissal of a CPO to the PIPC, where required, subject to a maximum administrative fine of KRW30 million (approximately USD21,000); and • failure to obtain mandatory personal data protec - tion certification, subject to a maximum admin - istrative fine of KRW30 million (approximately USD21,000). Legislative Developments Concerning Special Provisions for AI Alongside the strengthening of corporate accountabil - ity under the Amended PIPA, legislative discussions have progressed regarding the introduction of special provisions permitting certain processing of personal data for AI development or performance improve - ment. The PIPC has stated, including in its 2026 policy plan, that it intends to complete legislative measures introducing such provisions as part of broader gov - ernmental efforts to facilitate the availability of training data and promote AI-driven innovation. A bill currently pending before the National Assembly proposes to allow, under limited conditions, the pro - cessing of lawfully collected personal data beyond the original purpose of collection for AI development or performance improvement. Under the proposed framework, personal data may be utilised in its origi - nal form without pseudonymisation or anonymisation, subject to statutory requirements. Processing beyond the original purpose would, in prin - ciple, require deliberation and resolution by the PIPC. Such processing would be permitted only where: • anonymisation or pseudonymisation alone would make AI development or performance improve - ment difficult; • appropriate technical, administrative and physical safeguards are implemented; and • the processing contributes to public or social inter - ests while presenting a demonstrably low risk of unjust infringement of the interests of data subjects or third parties.
450 CHAMBERS.COM
Powered by FlippingBook