How to de-identify personal data in South Korea: an evolutionary tale

Abstract

In early 2020, South Korea’s legislature made amendments to major laws in the area of data protection in order to, among others, promote the utilization of pseudonymised personal data. With these amendments, pseudonymised personal data can be processed, without consent from data subjects, for archiving purposes, scientific research purposes, or statistical purposes. Arguably, these amendments are largely inspired by the relevant provisions contained in the EU GDPR, although details differ between GDPR and South Korea’s amended statutes. One unique aspect of South Korea’s amended statutes is that they introduce a scheme under which designated agencies carry out the task of combining pseudonymised data that different entities possess.