유럽사법재판소 ‘Schrems II’ 판결의 한국 GDPR 적정성 평가에 대한 시사점 – 공공기관의 개인정보처리에 대한 제한 중심으로 –

The General Data Protection Regulation (“GDPR”) adequacy decision for South Korea was adopted on December 17, 2021 with immediate effect. This decision allows personal data of EU data subjects to be transferred to South Korea without the need to take additional measures such as receiving the data subject’s consent or adopting standard data protection clauses. The decision will be re-examined within three years from adoption, and thereafter at intervals not to exceed four years. It is also possible for the European Commission to initiate procedures to suspend, repeal or amend the adequacy decision if it finds significant issues with the level of protection afforded to EU data subjects by the data protection laws of South Korea. A critical issue in maintaining the adequacy decision will be whether the South Korean data protection laws provide sufficient safeguards concerning the processing of personal data for law enforcement or national security purposes. The Schrems II decision of the Court of Justice of the European Union (“CJEU”) is particularly pertinent for this purpose. Schrems II, which invalidated the EU-US Privacy Shield, followed on the CJEU’s Schrems I decision, which invalidated the EU-US Safe Harbour agreement, showing that the CJEU is not shy about nullifying international agreements of considerable commercial importance if it finds that the agreement is insufficiently protective of EU individuals’ fundamental rights. The South Korean adequacy decision cites principles derived from Schrems II in assessing the adequacy of safeguards applicable to the processing of personal data for law enforcement and national security purposes. While South Korea passed this test the first time around, it will be important during subsequent examinations to demonstrate that the level of protection provided to EU data subjects does indeed meet the Schrems II standard. This paper identifies some of the issues that may be raised from an enforceability perspective, in hopes of facilitating dialogue on necessary enhancements in legislation and enforcement practice.