South Korea adequacy decision

By Peter Kouwenberg

Partner – Head of Commercial

06 December 2022

Article Insights

On 23 November 2022, following the agreement of an adequacy agreement in principle in July 2022, the UK started the process of formalising its first independent adequacy decision by laying before parliament the Data Protection (Adequacy) (Republic of Korea) Regulations 2022 (the Regulations). The Regulations are expected to come into force shortly before the end of the year, on 19 December 2022.

What effect will the Regulations have?

Once in force, the Regulations will negate the need for organisations seeking to transfer data to South Korea to put in place time-consuming and costly contractual procedures such as the UK International Data Transfer Agreement (the UK’s post-Brexit equivalent of the EU’s Standard Contractual Clauses). The UK Government envisages that this will reduce the administrative and financial burdens for, particularly small and medium sized, UK businesses leading to the generation of an estimated £14.8 million each year with £11 million being made up of decreased administrative and financial burdens and the remaining £3.8 million from increased exports to South Korea.

Additionally, it is expected that it will have a positive impact on research and innovation by streamlining the collaboration process with the Department for Digital, Culture, Media and Sport releasing a statement emphasising the importance of this in relation to medical treatments such as vaccines.

Will this effect the UK obtaining an EU adequacy decision?

Whilst the UK decision follows that of the European Commission (EC), who granted an adequacy decision to South Korea in December last year, there is a significant difference between the two.

The EC adequacy decision has a more limited scope, applying to organisations in South Korea that are subject to the domestic South Korean data protection legislation, the Personal Information Protection Act (PIPA). Consequently, the EC decision excludes the processing of personal credit information, which lies outside the scope of PIPA. In contrast, the UK adequacy decision includes personal data relating to credit information with a view to helping identify customers and verify payments as well as helping ‘…UK businesses with a presence in the Republic of Korea to boost credit, lending, investment and insurance operations in the Republic of Korea’. The effect of this divergence from the European Commission approach is yet to be seen.

What other countries are likely to follow?

As discussed in last month’s article, “What next for Trans-Atlantic data processing?” which can be read here, an adequacy decision is also expected in respect of the US following the implementation of the Executive Order on “Enhancing Safeguards for United States Signals Intelligence Activities”.

Other countries currently on the UK’s list of priority destinations for adequacy decisions include Australia, Brazil, Colombia, The Dubai International Financial Centre, India, Indonesia, Kenya and Singapore with each expected to assist with growth and collaboration.

Disclaimer: General Information Provided Only
Please note that the contents of this article are intended solely for general information purposes and should not be considered as legal advice. We cannot be held responsible for any loss resulting from actions or inactions taken based on this article.