On 17 December 2021, the Commission finally adopted the adequacy decision for personal data transfers between the EU and the Republic of Korea, after having concluded talks and initiated the necessary steps in the first half of 2021 (→ eucrim 2/2021, 99). As of 17 December 2021, data can be transmitted from the EU to South Korea without any further safeguard being necessary. In others words, transfers to the country will be assimilated to intra-EU transmissions of data. The possibility of a free flow of data would supplement the Free Trade Agreement between the EU and South Korea that entered into force in 2011.

In a joint press statement, Didier Reynders, Commissioner for Justice of the European Commission, and Yoon Jong In, Chairperson of the Personal Information Protection Commission of the Republic of Korea, highlighted the benefits from the adequacy decision for business and citizens. The adequacy decision, which is based on the EU’s General Data Protection Regulation, covers both data transfers for commercial and regulatory purposes. The Republic of Korea also benefits from the adequacy decision since it acknowledges a high data protection level in the country and thus facilitates data transfers with other non-EU countries which recognise the EU’s assessment, such as Argentina, Israel, and Switzerland.

The adequacy decision includes a detailed assessment of the Korean data protection law, i.e. the Personal Information Protection Act (PIPA). An annex includes information about the legal framework of the Republic of Korea regarding the collection and use of personal data by Korean public authorities for law enforcement and national security purposes.