Korea Expands Data Portability Rights Across All Sectors

The environment surrounding personal information has changed rapidly over the past several decades. In the past, the core of personal information protection was blocking access. It was closer to a defensive right to prevent infringement, and simply blocking external access was sufficient.

However, as information technology became part of daily life, the nature of personal information itself has changed. It has transformed from a private domain requiring protection into data that is both part of one's identity and holds economic value. Accordingly, perceptions of personal information rights are also evolving. Generations that grew up in digital environments, in particular, tend to view personal information not merely as something to be protected, but as a right that should be directly verified and managed. Personal information rights are now expanding to include the right to control the flow of one's information and participate in its use.

The problem is that reality has not kept pace. We check countless consent forms, yet it remains difficult to know where our information flows and how it is used. It is also difficult to stop or reverse this when we do not want it. The system designed to fill this gap is economy-wide MyData—the right to request transmission of one's own information. This right allows individuals to safely download, manage, analyze, and utilize their information scattered across multiple locations when needed. With the recent revision of the Personal Information Protection Act enforcement decree, individuals can now directly download their information from the websites of companies and institutions holding personal information above a certain scale.

What will change going forward? In healthcare, for example, customized health management will become possible based on diagnosis and medication information. In telecommunications, rate plan recommendations matching usage patterns can reduce living expenses. Services that gather scattered data to assist daily decision-making—such as automatic tax refund notifications or power-saving alerts based on electricity usage—will also spread. The real change that economy-wide MyData will bring is that we will no longer remain passive consenters but become agents who improve our life choices with our own data.

Changing perceptions about personal information is not easy, but the world is moving in this direction. The UK is promoting innovation through open banking, enabling safe sharing of transaction data with third parties. Australia has institutionalized consent-based data transfers starting with banking and energy sectors through Consumer Data Rights (CDR).

The prerequisite for this change is safety. Recent large-scale incidents have shown how much damage occurs when basic protective measures fail to function in the process of handling large volumes of personal information, rather than from data utilization itself. Safety measures commensurate with scale must be substantively implemented in practice.

Another key factor is who handles the data. Economy-wide MyData is structured so that individuals can manage and analyze their information with assistance from trusted specialized personal information management institutions if they wish. These specialized institutions are designated through strict requirements and remain subject to continuous oversight after designation. Designation is merely the starting point; post-designation supervision is the core of trust.

The purpose of the economy-wide MyData policy is clear: to substantively guarantee citizens' control over their personal information—enabling them to manage it safely and transparently, verify data flows in one place, and withdraw or delete it when necessary.

Protecting personal information ultimately means protecting citizens' lives. Such protection cannot be achieved through blocking and prohibition alone. Only when safety, transparency, and control work together can we advance toward a society that properly uses personal information while protecting it.

*Song Kyung-hee is Chairperson of the Personal Information Protection Commission*