Automated decision-making in South Korea
A critical review of the revised Personal Information Protection Act
Bibliographic Data
| ID | 22234332 |
|---|---|
| Authors | Dong Hyeon Kim (0000-0003-0756-8419, Seoul National University), Do Hyun Park (0000-0003-0199-4337, Gwangju Institute of Science and Technology, corresponding author) |
| Year | 2024 |
| Volume | 11 |
| Issue | 1 |
| Publication date | 2024-07-29 |
| Open Access | Yes |
| Type | ARTICLE |
| Venue | Humanities and Social Sciences Communications (JOURNAL) |
| Journal identifiers | ISSN: 2662-9992 • E-ISSN: 2662-9992 |
| Publisher | Springer Science and Business Media LLC (PUBLISHER) |
| DOI | 10.1057/s41599-024-03470-y |
| OpenAlex | W4401084101 |
| Language | EN |
| References cited | 20 |
The General Data Protection Regulation (GDPR) of the European Union has established regulations on automated decisions in Article 22 with the proliferation of artificial intelligence. In response, the Personal Information Protection Act (PIPA) of South Korea, serving as a counterpart to the GDPR, has recently incorporated provisions for automated decisions under Article 37-2 through an amendment. Although the PIPA follows a distinct legal framework from the GDPR, it is crucial to ensure an equivalent level of protection for fundamental rights. Recognising this concern, this study analyses the differences between the PIPA and GDPR regarding automated decisions, focusing on three aspects: format, target, and content. This analysis identifies that the PIPA lacks comprehensive safeguards for data subjects in certain aspects compared to the GDPR. First, regarding the format, the PIPA grants the right to object rather than establishing a general prohibition to automated decisions, posing limitations in protecting individuals who are unable to effectively exercise their rights. Second, in terms of the target, the PIPA regulates a completely automated status at the overall system level, creating a regulatory vacuum for a multi-stage profiling system. Third, concerning the content, the PIPA faces several technical and practical limitations that remain unresolved in delineating the content of the right to explanation. Building upon this analysis, this study proposes potential legislation and interpretation remedies to address these concerns based on each aspect
Business · Computer security · Data Protection Act 1998 · European union · General Data Protection Regulation · International trade · Internet privacy · Legislation · Political science · Artificial Intelligence in Healthcare and Education · Computer Science · Ethics and Social Impacts of AI · Law · Privacy-Preserving Technologies in Data
Rules versus Standards
Peeking Inside the Black-Box
European Union Regulations on Algorithmic Decision Making and a “Right to Explanation”
Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation
A Right to Reasonable Inferences
Beyond Notice and Choice
| Highly cited | No |
|---|