A Comparative Study of Consent Rules in the Personal Information Protection Laws of China and South Korea

Consent rules, as the “Imperial Clauses” for personal information protection, are both specifically regulated in the Personal Information Protection Laws of China and South Korea. However, the explosive growth and high-speed circulation of personal information in the era of big data makes it more difficult for personal information processors to obtain the effective consent of personal information subjects, thereby weakening the ability of personal information subjects to control their personal information. How to apply consent rules to effectively balance the relationship between personal information protection and the development of the digital economy is one of the common topics faced by both China and South Korea. This paper compares the specific provisions and exceptions of the consent rules in the Personal Information Protection Laws of China and South Korea and analyzes the commonalities and differences between the two. Then, it compares the legal liability of violation of consent rules in the Personal Information Protection Laws of China and South Korea and analyzes their differences. Finally, from the two aspects of the validity of consent and the application of the rules, this paper summarizes the common dilemma faced by the consent rules of China and South Korea and proposes some solutions. Although the consent rules of the Personal Information Protection Laws of China and South Korea have their own advantages and disadvantages, on the whole, South Korea's regulations can better reflect the legislative purpose of “strong protection and strong utilization”. The flexibility and operability of law enforcement are stronger. The common dilemma of the two countries' consent rules lies in the insufficient validity of consent and weak enforcement of rules. The former is mainly due to the personal information subjects are lack of cognitive ability, are “forced” to consent too much and are lack of enthusiasm for personal information management. The latter is mainly due to the deviation of the actual law enforcement from the original intention of the legislation, the difficulty of implementing the rules due to the development of science and technology, and the paradox of the consent rules themselves. In this regard, this paper proposes solutions from two aspects: perfecting the content of the rules and improving the implementation of the rules. The perfecting of the rules mainly includes four dimensions: refining the classification of personal information, optimizing the notification mode of personal information processors, supplementing the method of personal information subject consent, and reasonably restricting the exceptions to consent. The improvement of the implementation of the rules mainly includes four measures: introducing a third-party evaluation mechanism, strengthening government supervision, reinforcing legal responsibility, and implementing effective remedies.