The Personal Information Protection Commission (PIPC) convened a general meeting for the 23rd time on December 26, where the members of the Commission deliberated and resolved the Third Basic Plan(hereinafter referred to as “basic plan”), encompassing a national policy framework for personal information protection from 2018 to 2020, as well as relevant tasks.

The basic plan is a mid-term plan established in accordance with the Personal Information Protection Act (PIPA) every three years. It encompasses major issues from setting objectives and future directions towards personal information protection to improving relevant laws and systems to having in place measures to prevent any element that may raise personal information protection issues. The basic plan also serves as a basis for 47 central administrative agencies to establish its own personal information implementation plan.

The First and Second Basic Plans were established by the Ministry of the Interior and deliberated and resolved by the PIPC. It fell to the PIPC to establish a basic plan following the amendment to the PIPA in July 2015 that entails the strengthening of the function of PIPC.

While the First and Second Basic Plans placed emphasis on having in place infrastructure necessary for personal information protection, including laws, systems and organisation, as well as on capacity building for the PIPC, the Third Basic Plan focuses more on advancing the personal information protection system and improving its interoperability to proactively respond to a rapidly changing policy environment.

Accordingly, the PIPC has set “an information society that respects individuals’ dignity and value” as its vision and is going to select and conduct 11 tasks covering the four areas of data subject, data controller, Government, and governance.

The tasks in the area of data subject involve the restructuring of the existing system to guarantee the data subjects’ right to self-determination and to ensure damage remediation in the case of any incident.

The tasks in the area of data controllers include promoting self-regulation in each area of business, providing technical protection measures for microbusinesses, developing and disseminating a guideline aimed at embedding personal information protection from the product and service design stage by applying the principle of Privacy by Design.

Meanwhile, the tasks in the area of the Government are aimed at expanding surveys on the public awareness of personal information protection for the advancement of laws and systems, improving the legal system to ensure consistency between relevant statutes, and strengthening international cooperation such as by getting prepared for EU assessment of adequacy of personal information protection.

Lastly, the tasks in the area of governance are aimed at increasing examination to identify areas for improvement through cooperation between the central Government and local governments, stepping up monitoring for possible data breaches in joint efforts with relevant agencies/businesses, and encouraging social discussion on how to protect personal information in the information society.

Chairperson Lee Hong Sub said in his speech, “The PIPC has made its effort to establish the Basic Plan to deal with the period of transition to the information society where there is growing interest in personal information protection. In this regard, the PIPC will provide as much support as possible to help each agency to establish and implement its own implementation plan.”