European Data Protection Board Welcomes South Korea's Privacy Law Overhaul

After South Korea revised its Personal Information Protection Act to strengthen citizens' rights to withdraw consent to the use of collected data and to refuse automated judgments made by artificial intelligence (AI), the European Data Protection Board (EDPB) adopted a statement on the 11th (local time) giving a positive assessment of the changes.

South Korea amended the Personal Information Protection Act in March 2023, establishing a legal basis for the right to withdraw consent and rights regarding automated decisions. An 'automated decision' refers to a decision made by a fully automated system, such as AI, that processes personal data without human intervention. Key provisions, including consent withdrawal, took effect on September 15 of that year, while rights concerning automated decisions came into force on March 15, 2024.

The statement included an assessment by EDPB Chair Anu Talus. He evaluated that South Korea's legislative amendments raised the level of protection for individuals while remaining essentially equivalent to the EU's General Data Protection Regulation (GDPR) and also facilitated the processing of personal data. The Board also viewed positively the diversification of legal bases for international personal data transfers and the strengthening of the Personal Information Protection Commission's enforcement and sanctioning powers.

According to the EDPB, the statement concerns the first review of the adequacy decision on South Korea's personal data protection, evaluating improvements to the legal framework governing personal data processing in the private sector and access to and use of personal data by South Korean public institutions. The EDPB also agreed to the European Commission's proposed four-year periodic review of the adequacy decision for South Korea.

Meanwhile, at the same meeting, the EDPB selected automated decision-making (ADM) in recruitment processes as the theme of the sixth coordinated law enforcement action in 2027, with AI-based candidate screening tools also included in the review. National data protection authorities will participate voluntarily, and the coordinated action is expected to begin in 2027. However, no specific start date or list of companies under investigation was provided in the announcement.