Implications of GDPR and EU Adequacy Decision for Regulation of Profiling and Automated Decision-making in Korea

Despite the outsized role of artificial intelligence in the processing of personal data in the age of 4IR, South Korea does not have cross-sector data protection regulations concerning the automated processing of personal data. The European Union’s General Data Protection Regulation (GDPR), on the other hand, prohibits solely automated decision-making subject to certain limited exceptions and requires appropriate safeguards when processing personal data based on such exceptions. Significant gaps in the South Korean and EU regulations on automated processing could potentially be an issue in the European Commission’s evaluation (i.e., re-examination) of the South Korean GDPR adequacy decision. A GDPR adequacy decision, which permits the transfer of EU data subjects’ personal data to the relevant recipient country, is based on a finding by the European Commission that such country’s data privacy laws afford essentially the same protections regarding the transferred personal data as the GDPR. The adequacy decision for South Korea went into effect in December 2021 and will be subject to evaluation within three years from the effective date. While the lack of regulations specifically addressing automated decision-making did not serve as a deal breaker in the original adequacy decision, it is highly likely that the issue will be subject to closer scrutiny in future negotiations between the European Union and South Korea on adequacy. This paper analyzes the regulations on automated processing (including profiling) under the GDPR and Korean law, and makes suggestions for improving Korean regulations and enforcement practice for closer alignment with the GDPR, which is emerging as a de facto global standard. Relevant requirements should be enacted through a cross-sectoral statute like PIPA rather than merely through subordinate legislation or sector-specific laws. Although the Korean government has already submitted a bill to amend PIPA that contains regulations on solely automated decision-making, such draft amendment departs from the GDPR standard on a number of issues. These include no explicit right to human intervention or duty to provide meaningful information about the logic involved, and no regulation of profiling as a separate concept. Moreover, a duty to provide meaningful information on the logic involved may be of limited utility without clearer guidance on transparency requirements as well as measures to induce voluntary compliance with such guidance. Overall, it would be desirable for the regulators to undertake organizational measures to heighten their expertise and competence over AI issues.