The European Commission Adopted an Adequacy Decision on the Republic of Korea

On December 17, 2021, the European Commission adopted, in the exercise of its powers under section 45 of the General Data Protection Regulation (“GDPR”), an adequacy decision with respect to the Republic of Korea (hereinafter, the "Adequacy Decision"). The European Commission concluded that the Republic of Korea's domestic law ensures an adequate level of protection to personal data transferred from data controllers or processors in the European Union to data controllers or processors in the Republic of Korea that are subject to the Personal Information Protection Law No. 10,465, as amended.

The adoption of the Adequacy Decision implies that personal data protected by the GDPR can be transferred to data controllers or processors in the Republic of Korea without the need to implement additional measures or safeguards (such as binding corporate rules or standard contractual clauses according to section 46 of the GDPR). The scope of application of the Adequacy Decision is broad and it also facilitates regulatory cooperation between the European and Korean authorities. Moreover, the Adequacy Decision complements the Free Trade Agreement between the European Union and the Republic of Korea, which entered into force in July 2011.

The Republic of Korea now joins the limited list of adequate jurisdictions for the international transfer of personal data from the European Union (along with Andorra, Argentina, Canada, Guernsey, Israel, Isle of Man, Faroe Islands, Japan, Jersey, New Zealand, Switzerland, United Kingdom of Great Britain and Northern Ireland and Uruguay).

The European Commission will monitor legislative developments in the Republic of Korea and will periodically review the Adequacy Decision. The Commission will conduct the first review in December 2024 and thereafter will continue to review the decision at least every four years.

As has happened with other adequacy decisions of the European Commission, it is likely that the Agency of Access to Public Information will share the Commission's criteria and declare that the Republic of Korea ensures an adequate level of protection to personal data belonging to Argentine data subjects, in accordance with the Personal Data Protection Law No. 25,326 and its complementary rules.

For more information on the Republic of Korea's adequacy decision, please refer to the related FAQ section