EU: EDPB adopts opinion on draft South Korea adequacy decision
The European Data Protection Board ('EDPB') announced, on 27 September 2021, that it had adopted its opinion on the European Commission's draft adequacy decision for the Republic of Korea. In particular, the EDPB highlighted that the core aspects of the Korean data protection framework are essentially equivalent to those of the EU, but also called on the Commission to further clarify certain aspects and to closely monitor the situation.
Specifically, the EDPB noted that there are key areas of alignment between the EU and South Korean data protection frameworks with regard to certain core provisions, such as data protection concepts (e.g. personal information, processing, data subject), grounds for lawful processing for legitimate purposes, purpose limitation, data retention, security and confidentiality, and transparency. In addition, the EDPB welcomed the adoption of notifications by the Personal Information Protection Commission ('PIPC'), which aim to fill the gaps between the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and the Korean data protection framework, such as the additional protections provided by Notification No 2021-1. In this regard, however, the EDPB called on the Commission to provide further information on the binding nature, the enforceability and validity of Notification No 2021-1, whilst also recommending an attentive monitoring of this in practice.
In terms of transfers for the purpose of law enforcement and national security, the EDPB outlined that that provisions of the Personal Information Protection Act 2011 (as amended in 2020) ('PIPA') apply without limitation in the area of law enforcement, whilst also agreeing with the Commission's conclusion that South Korea can be considered to have an independent and effective supervisory system. Additionally, in relation to effective remedies and rights of redress, the EDPB asked the Commission to clarify the substantive and/or procedural requirements, such as a burden of proof, to which a complaint with the PIPC or any action before a court is subject, and whether EU individuals would be able to meet such a precondition.