Open Net condemns the July 2025 Korean Supreme Court's decision that simply paralyzed the data subjects' right to stop processing. The Court ruled, in a case where consumers demanded that the mobile phone companies stop pseudonymizing their personal data, that pseudonymization is not a data processing and therefore the data subjects cannot exercise their right to stop processing under Article 37. This is simply illogical. The definition of "processing" includes "collection, generation, connecting, interlocking, recording, storage, retention, value-added processing, editing, searching, output, correction, recovery, use, provision, disclosure, and destruction of personal information and other similar activities" Pseudonymization is partial destruction of personal data whereby identifiers or potential identifies are removed. The data subject must be entitled to exercise that right.
The lower courts were rightly concerned more with the applicability of Article 28-7 which excludes data subjects' rights for pseudonymized data. The idea is that some of the data subjects' rights such as right to inspect their personal data is difficult to be afforded without reidentifying the pseudonymized data, which is not a preferable event from a privacy perspective and may even forfeit the whole purpose of allowing non-consensual use of pseudonymized data for research and other communal purposes. This difficulty is especially pronounced in Korea where reidentification of pseudonymized data is absolutely banned without exception (Article 28-5), which makes affordance of the right to access categorically impossible. This dilemma originates from the fact that Korean PIPA excludes data subjects' rights for pseudonymized data categorically while GDPR, Korean PIPA's role model, excludes the rights only if exercise of the rights hampers research purposes for which the data were pseudonymized. For this reason, Open Net has sponsored a bill with MP Byungduk Min to straighten out PIPA's pseudonymized data provision and even filed a constitutional challenge. However, as the lower courts aptly noted, even before such law reform, the right to stop processing is exercised on the personal data before it becomes pseudonymized, and therefore Article 28-7 does not apply to begin with.
The Supreme Court's decision is not only illogical but also unprecedented in any jurisdiction exactly because it is illogical. This again shows the reason for amending PIPA so that exclusion of data subjects' rights is not determined by whether the data is pseudonymized or not but by whether such exercise makes the intended research difficult. That way, any exclusion of the rights will be justified by the countervailing public interest in the research. Currently, the right exclusion is being simply justified by the dogmatic belief in the value of pseudonymized data as a panacea for innovation.
0 Comments