South Korean Officials Naive About Data Sovereignty

For instance, the US Protecting Americans from Foreign Adversary Controlled Applications Act signed into law by US President Joe Biden last month, requires TikTok's parent company, Chinese firm ByteDance, to sell its US operations within 360 days or face a ban due to concerns that TikTok users' personal information could be accessed by the Chinese government.

Prior to this, President Biden had signed an executive order in February to protect Americans' sensitive data, such as biometric, health, and location information, from adversarial nations like China.

Additionally, countries such as Australia, the UK, and the European Union have banned TikTok on government devices and strongly recommend its removal from personal devices.

Europe also has been proactive in addressing data sovereignty. The European Union in 2018 implemented the General Data Protection Regulation, which regulates the transfer of data to third parties and nations unless explicitly permitted by the EU. It also grants individuals the right to control and delete their personal data.

More recently, the Digital Markets Act and the Digital Services Act, which came into effect this year, aim to prevent market dominance by foreign big tech platforms such as Google, Meta and Apple – fundamentally seeking to protect domestic companies.

The trend of data privacy and restriction of where the data can go is prevalent in South Korea's neighboring economies. The recent case of the Korea-Japan Naver Line conflict falls in line with this trend. The Japanese government pressured Naver to transfer its 50% share of the joint venture Line to its partner, Japan's SoftBank,due to fears that data from Line Yahoo, used by most Japanese, could be transferred to the Korean company Naver. This demand follows an information leak incident from Naver Cloud, which manages the Line messenging service most commonly used by Japanese consumers.

The issue began last November when Line Yahoo's servers were attacked, resulting in the leak of over 440,000 personal data records. Subsequently, on March 5 and April 16, the Japanese Ministry of Internal Affairs and Communications issued administrative guidance to Line Yahoo to protect the confidentiality of communications and ensure cybersecurity. This response highlights Japan's growing concern over data sovereignty and the use of Japanese data outside their jurisdiction.

Meanwhile, the Korean government focused solely on opposing the forced sale of Naver's shares, pledging to“firmly and strongly respond” to these measures. However, this reaction did not address the broader issue of data sovereignty protection.

Compared with other major countries' policies to block foreign companies from collecting and accessing data, Korea's response appears overly complacent. The major reason is that the Korean government continues to view data sovereignty protection merely as personal information protection.

The current Personal Information Protection Act directly mentions in Article 1, Paragraph 1 that“the purpose of this law is to protect individuals' freedom and rights by stipulating matters related to the processing and protection of personal information and, furthermore, to realize the dignity and value of individuals.”

It also briefly and vaguely stipulates in Article 14, Paragraph 2, the obligation of the state to formulate policies related to the transfer of personal information abroad and the obligation to obtain the consent of the information subject when transferring personal information abroad – not explicitly specifying its territorial scope.

Sign up for one of our free newsletters

• The Daily Report Start your day right with Asia Times' top stories
• AT Weekly Report A weekly roundup of Asia Times' most-read stories

These limitations indicate that the Korean government continues to view data sovereignty protection narrowly, rather than viewing as a national security and a geopolitical issue. By not addressing the broader implications of data transfers and lacking a clear extraterritorial application, the PIPA falls short of the comprehensive measures needed to safeguard national data sovereignty in an increasingly interconnected digital world.

Recently, an Australian think tank reported that Chinese state-controlled propaganda agencies are extensively linked to collecting data from Chinese companies, including shopping and gaming apps AliExpress and Temu.

Despite these findings, relevant Korean ministries, such as the Ministry of Science and ICT and the Personal Information Protection Commission, have only mentioned observing how user data from Chinese online shopping companies is collected and used, which seems disconnected from the severity of the situation.

While other countries implement policies to block foreign companies from collecting data and restricting where it can go, Korea still holds the outdated notion that as long as foreign companies manage collected personal information well and prevent cyberattacks following PIPA, it is not a big issue.

This suggests that Korea may not fully understand the extent to which foreign companies operating in the country collect and use citizens' data. It is time for South Korea to adopt stronger measures to protect essential data for economic security and actively amend clear legislative standards that cover the extraterritorial scope.

Seunghwan (Shane) Kim (...) is a researcher at the Korea Foundation.

This article, first published by Pacific Forum , is republished with permission.

Already have an account? Sign i Sign up here to comment on Asia Times stories OR

Thank you for registering!

An account was already registered with this email. Please check your inbox for an authentication link.