The EU Commission has launched the process towards adoption of a GDPR adequacy decision allowing for the free flow of personal data from the EEA to the Republic of Korea.

The Commission has found that the Republic of Korea ensures an essentially equivalent level of protection to the one guaranteed under the General Data Protection Regulation (GDPR). This news is good for the Republic of Korea, as it will support a trade relationship worth nearly €90 billion.

Focusing on Korea, currently the processing of personal data is governed by the Personal Information Protection Act (PIPA), which provides similar principles, safeguards, individual rights and obligations as EU law, and in 2020 additional powers of investigation and enforcement were granted to the independent data protection authority, the Personal Information Protection Commission (PIPC). These reforms further aligned the jurisdictions in the protection of personal data and the rights of individuals.

During the negotiations on adequacy, several additional safeguards that will be incorporated into the PIPC were agreed that will increase the protection of personal data processed in the Republic of Korea, by enhancing obligations around transparency, sensitive data and onward data transfers.

For those that are still struggling with the impact of Schrems and the rights of public authorities to access personal data purposes for law enforcement or national security purposes in foreign jurisdictions, the framework relies on the strong oversight role of the PIPC and the ability for it to facilitate EU individuals' access to redress, to address the concerns raised in Schrems.

This is not yet a done deal. The Commission has passed the draft decision to the EDPB and must wait for its opinion, following which the Commission will seek the approval from a committee composed of representatives of the EU Member States. Only once these two steps are completed, can the Commission proceed to adopt the adequacy decision.

The expansion of the Commission’s list of jurisdictions that are adequate is welcomed so we hope that the decision for the republic of Korea is approved smoothly, and that others quickly follow.

As for the UK, the wait for an adequacy decision goes on and, with 30 June only a fortnight away, the deadline for the interim post-Brexit measures to expire is fast approaching.