South KoreaPersonal Information Protection Act, rights regarding automated decisions
Act No. 10465 (as amended by Act No. 19234, 2023) Art. 37-2; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, ), Arts. 44-2 to 44-4
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that makes a decision about a Korean data subject using a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, must let the subject object to or request an explanation of the decision, must not apply the decision over an objection absent a compelling reason or must reprocess it with human involvement, and must disclose the criteria and procedures it uses for automated decisions.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 37-2 gives a data subject a right to object to a fully automated decision and to ask for an explanation, and requires the controller to disclose its criteria and procedures. Enforcement Decree Articles 44-2 to 44-4, which the row also cites, add a 30-day period for acting on a request, written replies and a website disclosure. Neither text names a log or record of the decisions, and neither names a reader of one. The sections carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
PIPA Art. 37-2, inserted by the 2023 amendment, gives a data subject the right to object to a decision made by a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, and the right to request an explanation of the decision, except where the decision rests on the data subject's consent, a statutory obligation, or the performance of a contract with the data subject under Art. 15(1)(1), (2), or (4).
Where a data subject objects or requests an explanation, the controller must not apply the automated decision unless there is a compelling reason not to, or must take measures such as reprocessing the decision with human involvement, and Art. 37-2(4) separately requires the controller to disclose the criteria and procedures it uses for automated decisions so a data subject can readily confirm them.
Enforcement Decree Arts. 44-2 through 44-4, added by Presidential Decree No. 34309 and in force from the same date as Art. 37-2 itself, set the request procedure, the controller's response measures, and the standards the disclosure duty must cover.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .