A recent news report says measures that de-identify personal data can now be recognized as destroying it — a change worth sharing.
Worth passing along: a recent news report says that de-identifying personal data can now be recognized as destroying it.
Under the existing enforcement decree, permanent erasure was the only accepted way to destroy personal data, which made blockchain hard to apply in a number of fields. If the decree is amended as described, we expect blockchain and DID technology to become usable across a far wider range of use cases.
Here is the gist of the reporting. The Personal Information Protection Commission (PIPC) has approved an amendment to the enforcement decree of the Personal Information Protection Act that, in light of the characteristics of newer technologies such as blockchain, treats personal data as destroyed when it has been rendered impossible to trace back to an individual. Promulgation was scheduled for July.
Because the decree in force at the time recognized only permanent erasure as a method of destruction, applying blockchain technology in finance, energy, healthcare, medicine and similar fields ran into difficulty.
Industry had therefore relied on the demonstration-exemption track of the regulatory sandbox to test and validate blockchain-based services.
The PIPC emphasized that the amendment matters because it opens the way for personal-data-based blockchain technology to spread across many fields without having to go through the demonstration-exemption process first.
The amendment also lets the commission further reduce or, where a violation is minor, waive administrative fines, taking into account factors such as economic conditions and the extent to which data subjects have been compensated.
Until then there was no provision for reducing or waiving fines even for small and mid-sized businesses squeezed by COVID-19 or for minor negligence by small merchants, which limited flexibility. Under the amended decree, economic conditions, the degree of compensation for harm, and ability to pay are weighed together, allowing an additional reduction of up to 90 percent against the previous fine.
PIPC Secretary General Janghyuk Choi said the amendment reflects industry input and improves unreasonable regulation in the personal data field, adding that the commission will keep listening to views from across sectors to identify and reform rules that need changing.
The amended enforcement decree of the Personal Information Protection Act was set to take effect three months after the date of promulgation.
Digital Daily, "De-identification Now Counts as Deletion — Easing a Rule That Held Blockchain Back" (reporter Chikyu Hwang)
We appreciate your interest.
Life Meets Blockchain, ICONLOOP