Overview of the South Korea Personal Information Protection Act (PIPA) Amendments in 2023 and 2024
The Personal Information Protection Act (PIPA) in South Korea underwent significant amendments in 2023, with key provisions coming into effect in March 2024. These changes introduced explicit rights for individuals regarding fully automated decision-making processes, marking one of the first such regulations in Asia. The amendments expanded the legal framework to include consent-based rules, stricter enforcement mechanisms, and administrative fines of up to 3% of a company’s related revenue for non-compliance.
The PIPC was established in 2011 under the original PIPA as an advisory body to the Ministry of the Interior and Safety, with limited enforcement capabilities. However, the 2020 amendments elevated its status to that of a central administrative agency, granting it full investigative and adjudicative authority over personal data protection matters. This shift positioned the PIPC as an independent entity under the Prime Minister’s office, ensuring operational autonomy in enforcing privacy laws without external supervision. The commission now consists of nine commissioners, including a Chairperson appointed by the President, with two permanent and seven non-permanent members recommended by political factions to ensure balanced representation.
The PIPC’s expanded authority has led to notable enforcement actions against major technology firms. In November 2020, Facebook was fined $6.1 million for sharing user data without consent. Subsequent actions in September 2022 saw Google fined $50 million and Meta Platforms fined $22 million for violations of South Korean privacy regulations. These cases underscore the PIPC’s commitment to holding organizations accountable for non-compliance with PIPA, particularly in sectors involving large-scale data processing and automated decision-making systems.
Key Provisions of the 2023–2024 Amendments
The most notable addition to the PIPA framework is the explicit right for individuals to refuse or request an explanation for decisions made through fully automated processes. The right to explanation is particularly relevant in contexts where automated systems determine access to services, credit approvals, or public benefits, areas where accountability and fairness are paramount.
The amendments also reinforced consent-based mechanisms, requiring organizations to obtain explicit, informed consent from individuals before processing their personal data. Violations of these consent requirements can trigger administrative fines, with the PIPC demonstrating a willingness to impose penalties on both domestic and international entities operating in South Korea.
Administrative fines under the amended PIPA can reach up to 3% of a company’s related revenue, a significant deterrent for non-compliance. This financial threshold is designed to incentivize adherence to privacy standards, particularly for multinational corporations with substantial revenue streams. The PIPC has already demonstrated its capacity to enforce these penalties, as seen in the fines levied against OpenAI and other organizations.
Enforcement and Regulatory Framework
The PIPC operates as a central administrative agency with the authority to investigate privacy failures, adjudicate complaints, and impose fines independently. Its structure includes a Chairperson and eight additional commissioners, with appointments balanced between political recommendations to ensure impartiality. The PIPC has held briefing sessions for businesses to clarify requirements for transferring personal data across international borders, ensuring compliance with both domestic and foreign privacy laws.
The PIPC’s enforcement efforts are supported by a dedicated Personal Information Protection Database, which documents resolutions, decisions, and case studies related to privacy violations. The database highlights the PIPC’s commitment to transparency in its regulatory processes, allowing stakeholders to understand the commission’s interpretations of the law and the consequences of non-compliance.
The PIPC’s regulatory scope includes sectors such as finance, where the handling of resident registration numbers—South Korea’s equivalent of national identification numbers—requires stringent protections.
Required actions
- Article 37-2: individuals may refuse a decision made by a fully automated system that materially affects their rights, or demand an explanation, unless the decision is necessary for a contract or consent - Publish the criteria and procedure for automated decisions in the privacy policy - Obtain separate consent for sensitive and biometric data; report breaches within 72 hours