Personal Information Protection | Complete Revision of the Pseudonymized Information Guidelines, with Expected Changes in Corporate Data Utilization Strategy

The most important change is the standardization of the criteria for risk assessment.

Whereas previously risk factors were enumerated and evaluated individually, after the revision the assessment centers on the following two criteria.

• The entity utilizing the data
• The controllability of the processing environment

Accordingly, the following structure has been established.

• Number of forms: reduced from 24 types to 10 types
• Low risk: minimal documentation and review by the person in charge
• Medium and high risk: in-depth review by stage

This structure lowers the barrier to entry for low-risk projects while allowing high-risk projects to be managed more precisely.

• Permitting expandable purpose definitions
• Flexible processing periods
• Repeated training and model advancement made possible

As the previous rigid purpose restrictions have been relaxed, the practical usability of AI project design has improved significantly.

• Full inspection changed to permitted sample inspection
• Reflecting the reality of processing large volumes of data such as video, audio, and text

However, the burden of proof has been further strengthened with respect to the reasons for selecting the inspection method, the sample design, supplementary measures, and recordkeeping.

In response to this change, companies should establish the following response strategies.

Legal and Compliance Organizations

• Reclassify all data utilization projects
• Review whether they fall within the scope of the special provisions on the processing of pseudonymized information
• Make purpose statements more specific (AI training broken down into model and metric units)

Data and AI Organizations

• Design on the premise that unstructured data = high risk
• Establish a sample inspection design and recordkeeping framework
• Separate training data from service output

Security, IT, and Business Divisions

• Redesign the external provision structure
• Review the contractual structure with entrusted service providers
• Establish a framework for access privileges, log management, and transfer control

The following items are criteria that can be used in actual internal corporate reviews.

Data Utilization and Risk Management

• Are there criteria for the advance classification of risk by project
• Is internal use distinguished from external provision
• Has a controllable analysis environment been secured

Pseudonymization and Inspection Framework

• Are there criteria for reviewing the appropriateness of the pseudonymization method
• Is there a separate inspection framework for unstructured data
• Are the sample inspection design and supplementary procedures documented

Documentation and Evidentiary Framework

• Securing specificity in purpose definition (by model and metric unit)
• Recording the grounds for risk assessment
• Retaining records of review and approval procedures

Contractual and External Provision Structure

• Reflecting personal information protection clauses in contracts with entrusted service providers
• Establishing a framework for transfer control and the management of access privileges
• Securing log records and the capacity for subsequent tracing

This revision conveys the following message.

Data utilization is expanding, but the responsibility to demonstrate the legitimacy and safety of that utilization is being strengthened.

The simplification of low-risk cases, the expansion of AI purposes, and the permitting of sample inspection are clear regulatory relaxations, yet they operate favorably only for companies that have an explainable risk management framework.

The revised guidelines are not a matter that can be resolved through a technical response alone, and the appropriateness of processing pseudonymized information ultimately comes down to a question of legal explainability.

Daeryun Law Firm LLP provides the following advisory services throughout the entire process of corporate data utilization.

• Review of the legality of processing pseudonymized information and design of a risk classification framework
• Definition of the purposes of AI and data projects and design of the documentation structure
• Establishment of legal standards for the processing and inspection of unstructured data
• Risk review of the contractual structure with entrusted service providers and of the external provision structure
• Establishment of a strategy for responding to personal information protection investigations and sanctions

In particular, for issues that combine data, IT, and legal matters, the firm provides an integrated advisory framework that understands both technology and law at the same time, which makes it possible to secure practical response capabilities.

If you need assistance with a related matter, you are welcome to schedule a 🔗legal consultation with the firm.