The Preparatory Office for the Personal Data Protection Commission recently released a draft amendment to several articles of the “Enforcement Rules of the Personal Data Protection Act.” These revisions aim to refine existing provisions, bolster the personal data protection framework, and introduce a formal definition for “intelligence agencies.” The primary objectives of this amendment are to align the rules with the revised Act, consolidate relevant regulations, and implement robust security management and accountability mechanisms for personal data. 

The Preparatory Office stated that under the authority granted by Articles 12, 18, and 20-1 of the Personal Data Protection Act, the competent authority is empowered to establish regulations concerning post-incident notification mechanisms, the security maintenance of personal data files, and the duties, qualifications, and training of Personal Data Protection Officers. To prevent regulatory redundancy, the draft removes related content from Articles 12, 22, 24, and 25 of the current Enforcement Rules. 

Furthermore, regarding the definition of “unable to identify a specific data subject,” Article 17 of the draft adopts the legal reasoning of Constitutional Court Judgment No. 13 (2022). It clarifies that this concept refers to personal data that can no longer be used to directly identify a specific natural person through technological methods available at the time. The Preparatory Office further explained that to comply with Article 21-5 of the Act and Article 29 of the draft, a definition for “intelligence agencies” has been added, referring to agencies established under Article 3, Paragraph 1, Subparagraph 1, and Paragraph 2 of the National Intelligence Work Act. Additionally, in response to the establishment of the Personal Data Protection Commission, the designation of the competent authority responsible for appointing the enforcement date has also been amended.