Meaning of “Stronger” Data Protection Law for Asia – Korea’s accession to Convention 108: 40th Anniversary 1/28/2021

https://www.coe.int/en/web/data-protection/dpd2021-asia-pacific-region-event

The main benefit for Asian countries of accession to Convention 108+ is clear: people in those acceding countries will be protected better on the important rights: data protection rights. People forget that Convention 108 series originated from a discussion on whether EU Human Rights Convention (1950) was sufficiently protecting human rights. After the Council of Europe decided in 1968 that it did not, the Council issued 2 resolutions on “data banks” in 1970s, which led to a 1980 discussion on the OECD Data Protection Guideline. All Asian people caring for human rights should persuade our governments to accede to the Convention 108 series.

Having said that, I am happy to remind the Korean government has announced their intent to join the Convention 108 series. This is significant because, under GDPR, cross border transfer of EU citizens’ personal data is restricted to those countries that have passed European Commission’s adequacy decision, and Korea failed that adequacy decision twice in 2016 and 2018 for reason that we do not have an independent data protection authority. Graham Greenleaf calls Convention 108+, “GDPR Lite”. This is important not because we want a weaker data protection regime than GDPR but gives acceding countries to time to develop and strengthen their governance schemes to live up the GDPR standard.

We are happy to report that in February 2020 Korea established an independent ministerial-level data protection authority with its own budget and staff (3 times the previous one that was part of the Interior Ministry) and acquired data governance functions of other ministries under one roof. So, we are now in a good position to attempt to both join Convention 108 and pass the EC adequacy decision.

However, what is often on the paper from the reality in the ground. What does it mean a strong data protection law? Korea has a strong data protection law, which has detailed provisions on how data should be used and a creative system of dispute resolution marked by mediation whose remedies include not just damages but also reform orders.

However, in Asia, impunity and the right to remember are considered more and more important to bring the countries out of poisonous colonial legacies or legacies from dictatorship, especially because of the strong presence of those legacies. People’s need for more data to participate in civil discourse is very high. Compare to Canada and Australia that has European-style data protection law and yet allows access to court judgment data base. Korea has a strong data protection law and yet does not afford people access to court judgment database for reasons of “data protection”, which would have been crucial to furthering social justice.

Hopely, the accession process will shed light on the reality on the ground on how data should be governed to reach the ultimate goal of Convention 108: human rights.