EDPB adopts opinion on adequacy assessment of South Korea

The European Commission has presented a draft adequacy assessment of South Korea. If South Korea's level of protection of personal data essentially corresponds to the level of protection provided for in the General Data Protection Regulation, South Korea may be granted "safe third country" status. In practice, this will mean that, as a data controller or data processor, once the adequacy decision has been adopted, can transfer personal data to South Korea on an equal footing with countries within the EU/EEA and thus without having to use a transfer basis in Chapter V of the General Data Protection Regulation.

THE OPINION OF THE EDPB

With regard to the general data protection framework, the EDPB notes that there are a number of key areas where the rules under the GDPR are consistent with the South Korean data protection rules. This applies to:

1) Data protection law concepts (e.g., the definition of personal data, processing, etc.)
2) Justification for lawful processing for legitimate purposes
3) Purpose limitation
4) Data retention, security, and confidentiality
5) Transparency

The EDPB also draws attention to a number of issues relating to access to personal data by public authorities in South Korea.

Also, the EDPB agrees with the European Commission's conclusion that South Korea can be considered to have an independent and effective supervisory system. However, the EDPB asks the European Commission to clarify the requirements applicable to redress, including whether individuals will be able to meet these requirements to have their complaints handled by a supervisory authority.

WHAT HAPPENS NEXT?

Once the European Commission has considered the opinion of the EDPB, the European Commission must request the green light from member states' representatives. If the green light is given, the European Commission can adopt the final decisions on the adequacy of the level of protection for South Korea.