On 16 June 2021, the Commission initiated the procedure for adopting the adequacy decision for personal data transfers to the Republic of Korea. It will cover transfers of personal data to the Republic of Korea’s commercial operators and public authorities. After having examined the legislation in the Republic of Korea, in particular the Personal Information Protection Act (PIPA) and the investigatory and enforcement powers of the Personal Information Protection Commission (PIPC), the Commission concluded that the Republic of Korea ensures a level of data protection equivalent to that guaranteed by the GDPR.

The draft adequacy decision has now been sent to the European Data Protection Board (EDPB) for its opinion. As a further step, a committee composed of representatives of the EU Member States must approve the draft before the Commission can adopt the final adequacy decision. Once adopted, data can be transmitted from the EU to South Korea without any further safeguard being necessary. In others words, transfers to the country will be assimilated to intra-EU transmissions of data. The possibility of a free flow of data would supplement the Free Trade Agreement between the EU and South Korea that entered into force in 2011. After Japan, the Republic of Korea would be the second Asian country for which the adequate protection of personal data is recognised. (TW)