Commission Implementing Decision (EU) 2022/254 of 17 December 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act (notified under document C(2021) 9316) (Text with EEA relevance)

1 For the purpose of Article 45 of Regulation (EU) 2016/679, the Republic of Korea ensures an adequate level of protection for personal data transferred from the European Union to entities in the Republic of Korea subject to the Personal Information Protection Act as complemented by the additional safeguards set out in Annex I, together with the official representations, assurances and commitments contained in Annex II.

2 This Decision does not cover personal data transferred to recipients falling within one of the following categories, to the extent all or part of the purposes of processing of the personal data corresponds to one of the purposes listed therein, respectively: (a) religious organisations to the extent they process personal data for their missionary activities; (b) political parties to the extent they process personal data in the context of the nomination of candidates; (c) entities that are subject to oversight by the Financial Services Commission for the processing of personal credit information pursuant to the Credit Information Act, to the extent they process such information.

Whenever the competent authorities in Member States, in order to protect individuals with regard to the processing of their personal data, exercise their powers pursuant to Article 58 of Regulation (EU) 2016/679 with respect to data transfers falling within the scope of application set out in Article 1 of this Decision, the Member State concerned shall inform the Commission without delay.

1 The Commission shall continuously monitor the application of the legal framework upon which this Decision is based, including the conditions under which onward transfers are carried out, individual rights are exercised and Korean public authorities have access to data transferred on the basis of this Decision, with a view to assessing whether the Republic of Korea continues to ensure an adequate level of protection within the meaning of Article 1.

2 The Member States and the Commission shall inform each other of cases where the Personal Information Protection Commission, or any other competent Korean authority, fails to ensure compliance with the legal framework upon which this Decision is based.

3 The Member States and the Commission shall inform each other of any indications that interferences by Korean public authorities with the right of individuals to the protection of their personal data go beyond what is strictly necessary, or that there is no effective legal protection against such interferences.

4 After three years from the date of the notification of this Decision to the Member States and subsequently at least every four years, the Commission shall evaluate the finding referred to in Article 1(1) on the basis of all available information, including the information received as part of the review carried out together with the relevant Korean authorities.

5 Where the Commission has indications that an adequate level of protection is no longer ensured, the Commission shall inform the competent Korean authorities. If necessary, it may decide to suspend, amend or repeal this Decision, or limit its scope, in accordance with Article 45(5) of Regulation (EU) 2016/679, in particular where it has indications that: (a) controllers in Korea that have received personal data from the European Union under this Decision do not comply with the additional safeguards contained in Annex I, or there is insufficient oversight and enforcement in this regard; (b) the Korean public authorities do not comply with the representations, assurances and commitments contained in Annex II, including as regards the conditions and limitations for the collection of and access to personal data transferred under this Decision by Korean public authorities for criminal law enforcement or national security purposes. The Commission may also adopt such measures if the lack of cooperation of the Korean government prevents the Commission from determining whether the Republic of Korea continues to ensure an adequate level of protection.

This Decision is addressed to the Member States.