On 15 March 2024, an amended Enforcement Decree for
South Korea's Personal Information Protection Act came into
effect.
The Amended Enforcement Decree introduces specific rules that
were delegated by the March 2023 amendments to the Personal
Information Protection Act, which also came into effect on March
15, 2024. These include rules concerning automated decisions
facilitated by artificial intelligence (AI) and similar
technologies, qualification requirements for Chief Privacy Officers
(CPOs), and insurance requirements.
Details on data subjects' rights against automated
decision-making
Under the Amended PIPA, data subjects have the right to demand
explanations or reviews of decisions made through a 'fully
automated process'. Moreover, when these automated decisions
significantly affect the subjects' rights and obligations, they
have the right to refuse such decisions. In this context, an
'automated decision' refers to a final decision that
affects one's
