Republic of Korea: Implemented Presidential Decree No. 34309 establishing data subject rights regarding automated decisions under PIPA

On 15 March 2024, the Personal Information Protection Act Enforcement Decree (Presidential Decree No. 34309), establishing data subject rights regarding automated decisions under the Personal Information Protection Act (PIPA), entered into force. Under Law No. 19234 amending PIPA, individuals have the right to refuse automated decision-making using their personal data and request information regarding the system employed. The decree specifies the procedures for handling automated decisions and requests for explanations or reviews from the data subjects. Furthermore, the decree outlines the process for data subjects to reject automated decisions and request explanations. Businesses must follow specified methods and procedures for refusal, explanation, or review requests as required under Article 41. In addition, the decree outlines measures to be taken in response to refusal requests, including actions that don't apply automated decisions or reprocessing by human intervention. Explanations must be provided concisely and meaningfully, addressing various aspects of the decision-making process. Finally, the decree mandates businesses to disclose the use of automated decision systems and provide information such as the purpose of automated decisions, types of personal data used, and procedures for processing sensitive information.