South KoreaPersonal Information Protection Act, pseudonymized information
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Prohibition, Security, Governance
- Audit expectation
- none
As of .
What it requires
- You may process pseudonymized information of people in Korea without their consent for statistics, scientific research, archiving in the public interest and similar purposes, and when you give it to a third party for those purposes you must not include any information that could be used to identify a specific individual (Article 28-2).
- Have pseudonymized information held by different controllers combined, for those purposes, only by a specialized institution designated by the Protection Commission or the head of the relevant central administrative agency, and obtain the approval of that institution's head before taking the combined information out of it, after processing it into pseudonymized information or the form Article 58-2 covers (Article 28-3).
- Store the additional information needed to restore pseudonymized information to its original state separately, take the technical, managerial and physical safety measures the Enforcement Decree sets, and keep records of the purpose of processing, any recipient and any separately set processing period, for at least three years from the date of destruction where the information is destroyed (Article 28-4).
- Never process pseudonymized information for the purpose of identifying a specific individual, and if information that can identify an individual is generated in processing, stop processing it at once and retrieve and destroy it without delay (Article 28-5).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 71, item 8: a person who processes pseudonymized information for the purpose of identifying a specific individual in breach of Article 28-5(1) is punishable by imprisonment of up to five years or a fine of up to KRW 50,000,000. The same article punishes, at the same level, combining pseudonymized information without being designated a specialized institution (item 6) and taking combined information out of the institution, or giving it to a third party, without the approval of the institution's head (item 7).
Penalty structure
Article 64-2(1), item 6: the Protection Commission may impose a penalty surcharge of up to 3/100 of total sales on a controller that processes information for the purpose of identifying a specific individual in breach of Article 28-5(1), or up to KRW 2,000,000,000 where there are no sales or sales cannot be calculated in the cases the Presidential Decree sets. Article 64-2(2) raises the ceiling to 10/100 of total sales, or KRW 5,000,000,000 where there are no sales, where the controller, intentionally or with gross negligence, repeats a violation of the same item within three years of a surcharge, or commits it intentionally or with gross negligence and 10 million or more data subjects are harmed. The surcharge is calculated on sales net of sales unrelated to the violation (Article 64-2(3)).
- Rule
- Turnover pct only
- As of
- Currency
- KRW
- Turnover percentage cap
- 3
Who enforces it
Enforcement body
Personal Information Protection Commission (PIPC), Korea's independent data protection authority, which imposes the penalty surcharge under Article 64-2 of the Act.
What it makes you log
What the log must hold
Data lineage
Log retention
Article 28-4(3) sets three years from the date of destruction of the pseudonymized information as the minimum; where the information has not been destroyed the article states no period.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Article 28-4(3) requires a controller that intends to process pseudonymized information to prepare and keep records of the purpose of processing, the recipient where the information is given to a third party, and the processing period where one was set separately, with the further matters the Presidential Decree sets. The records are kept for at least three years from the date of destruction where the information is destroyed. The sections carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- Explicit
- As of
- Provision
- Act Article 28-4(3)
- Trigger
- personal_data_processing
What this law does
A personal information controller may process pseudonymized information without the consent of the data subjects for statistics, scientific research, archiving in the public interest and similar purposes, and when it gives such information to a third party it may not include information that could be used to identify a specific individual.
Pseudonymized information held by different controllers is combined for those purposes only by a specialized institution designated by the Protection Commission or the head of the relevant central administrative agency, and the combined information leaves that institution only with the approval of its head.
A controller processing pseudonymized information must store the additional information needed to restore the original state separately, take the safety measures the Enforcement Decree sets, and keep records of the processing. No one may process pseudonymized information for the purpose of identifying a specific individual, and where information that can identify an individual is generated the controller must stop processing it and retrieve and destroy it without delay.
Processing information to identify an individual in breach of that ban draws a penalty surcharge of up to 3 percent of total sales, or up to 2 billion won where there are no sales or they cannot be calculated, and is punishable by imprisonment of up to five years or a fine of up to 50 million won.
When LexLint raises it
When your app profile says your app processes personal data.