What is the Three Data Acts Amendment?
The 2020 Three Data Acts amendment, told as a story about gathering three separately-run rulebooks under one inspector, and inventing one new label.
The castle had three separate rulebooks and three separate inspectors.The Personal Information Protection Act, the Network Act, the Credit Information Act — all covering personal data, each watched by its own inspector.
The three rulebooks overlap and contradict each other.The very same guest record gets a different answer from each rulebook. Even the castle's own people get confused.
The 2020 amendment gathered oversight of the three rulebooks under one inspector, and added a brand-new label.The three Acts still exist, but personal-data oversight now centers on one office (the Commission), and a new concept — pseudonymized data, names removed — was introduced.
Side by side, here are the three tiers of guest record.Pseudonymized data is a new middle ground the 2020 amendment carved out, between personal and anonymized data.
The three Acts weren't literally merged into one.Only the oversight consolidated around one office (the Financial Services Commission still watches financial companies, and the Personal Information Protection Commission watches other businesses). A record crossing a border has separate rules such as CBPR, and a guest moving their own record is the job of MyData.
The Three Data Acts amendment gathered three separately-run rulebooks — the Personal Information Protection Act, the Network Act, the Credit Information Act — under one inspector (the Personal Information Protection Commission), and invented a new label: pseudonymized data. A 2020 legal reform.
The 2020 Three Data Acts amendment. It realigned the personal-data provisions of the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection (the Network Act), and the Credit Information Act, and consolidated personal-data oversight around the Personal Information Protection Commission (under the Credit Information Act, the Financial Services Commission still oversees financial companies, while the Commission covers commercial businesses outside FSC supervision). Its core change was introducing 'pseudonymized data' — information processed so a specific individual can't be identified without additional information — which may be processed without the data subject's consent for statistics, scientific research, or public-interest record-keeping. The three Acts themselves were not literally merged; each still exists as a separate law.
When grown-ups say it
- Three Data Acts
- The castle's three rulebooks. The collective name for the Personal Information Protection Act, the Network Act, and the Credit Information Act.
- Personal Information Protection Commission
- The inspector that gathered personal-data oversight from the three rulebooks. The 2020 amendment consolidated personal-data oversight around it.
- Pseudonymized data
- A guest record with the name removed. Processed so a specific person can't be identified without extra information.
- Anonymized data
- A record scrubbed so it can never be traced back. Falls outside the Personal Information Protection Act entirely.
- Re-identification ban
- Forbidding tracing pseudonymized data back to the original person. The core condition attached to processing pseudonymized data.
- Personal Information Protection Act
- The most foundational of the three rulebooks. The broad framework for protecting personal data. → the visitor's name tag belongs to the visitor
- Credit Information Act
- The rulebook that opened financial MyData first. Financial MyData's legal basis is in this Act. → my right to carry my own ledger
- Compliance
- The inspector confirming things follow the rulebook. Whether the Three Data Acts are followed is checked through this same frame. → the inspector from the neighboring kingdom