En En Mission Report
Total Page:16
File Type:pdf, Size:1020Kb
European Parliament 2014-2019 Committee on Civil Liberties, Justice and Home Affairs 20.2.2019 MISSION REPORT following the following the ad-hoc delegation to Seoul (South Korea) 29 October – 2 November 2018 Committee on Civil Liberties, Justice and Home Affairs Members of the mission: Claude Moraes (S&D) (Leader of the mission) Josef Weidenholzer (S&D) Michał Boni (PPE) Nathalie Griesbeck (ALDE) József Nagy (PPE) CR\1177539EN.docx PE636.094v01-00 EN United in diversity EN Summary account of meetings Monday, 29th October 2018 - Travel day and EU Delegation to South Korea I. Meeting with the EU Ambassador to South Korea Participants: Michaël Reiterer, Ambassador to the EU, Joelle Hivonnet, Minister Counsellor and John Sagar, First Secretary The delegation kicked off with a welcome meeting by Mr Michael REITERER, Ambassador of the European Union/Head of the Delegation in South Korea and senior officials on the general situation in Korea and the issues related to data protection The Ambassador explained that, in the context of the data protection negotiations, Commissioner Jourova came in June 2018 and that she had fruitful exchanges with the South Korean authorities and stakeholders. Furthermore, data protection was mentioned in the EU-Korea summit at the end of October 2018 in Brussels (ASEM summit). Although no joint statement was published, the data protection reference indicated that the goal of the negotiations was to reach an adequacy understanding by the end of the current year 2018. Indeed, the interest in Korea is very high on this issue from the public authorities’ side and many meetings were organised last June for the Commissioner in the regard. Furthermore, he mentioned that the civil society is also very engaged and consultations with various stakeholders took place. Among possible issues at stake are the status of national security agencies, automated machine and profiling and more generally, the issue of surveillance. The Ambassador also stressed that President Moon is very interested in the relations with the EU. He visited different capitals before Brussels for the EU-Korea Summit mid- October. On other topics of information, such as denuclearisation of North Korea, he reiterated that the Position of the EU is that sanctions can be lifted only if there are progress in the denuclearisation. There have been developments in the good direction compared to PE636.094v01-00 2/32 CR\1177539EN.docx EN September 2017 but the situation must be monitored. He also noted that discussions between North Korea and South are going faster than between North Korea and USA. So far, there are not enough developments in this one and both sides try to improve that. Also, on the EU-Korea relationship, there are good relations in science and research. There is a lot of interest by Korean companies to participate in the horizon 2020 Program. Besides, the topic of the 4th industrial revolution is an important one. Finally, the exchanges programmes such as Erasmus plus/Jean Monnet chair continue to develop. From an economical point of view, unemployment in Korea is higher than usual and also touches the students of the big three universities of the country (usually less affected). According to statistics, 32% of the big companies produce 70% of GDP. Samsung alone is around 12%. Therefore, there is an important impact of the big players on the economy and the current government would like to help the small-medium sized to develop as well. One issue in this context is the social dialogue, which the current President promised to increase in the Korean society. In terms of economy, the best relations are with China, then the USA and in third, the EU. Tuesday, 30th October 2018 - Meetings at institutional level and stakeholders II. Roundtable with representatives of civil society Participants: Eun woo LEE, Institute for Digital Rights; Byoung-il OH & Miru LEE, Korean Progressive Network Jinbonet; HyeJin BYEON, Center for health and Social change; Cheolhan YUN, Citizen's Coalition for Economic Justice; Seohyung LEE, Minbyun-Lawyers for a Democratic Society; Myung YUN & You Kyung HUH, Consumers Korea The delegation started the day with a roundtable with civil society representatives. The first presentation was made by a representative of the Korean Progressive Network Jinbonet, presenting the views of the different civil society represented at the meeting. The NGOs explained that they are working to defend data protection of the data subjects. In terms of action, they stressed that up until now, the NGOs launched awareness CR\1177539EN.docx 3/32 PE636.094v01-00 EN campaigns towards citizens. The presentation focused on the issues identified by the civil society organisations regarding the personal information protection regime in the Republic of Korea, namely, according to them: - Absence of independent data protection authority: Some problems that they identified in relation to this are that there is a landscape of different legislations, which may lead to contradictions and that there are various authorities responsible, which leads to a fragmentation of the Supervisory authorities into different divisions. In short, the legislation is diverse and the authorities also. They stressed that some authorities’ main tasks (e.g. KCC and FSC) are to promote their sectors and fields, and that this may be sometimes in contradiction with the defence of data protection. - Concept of personal information: they stressed that the definition refers to the concept of “easily combined with other information” and it may have the consequence that the scope of personal data may be too narrow (compared to that of the EU) - Concept of pseudonymised data: For them, the concept is not only used for scientific research but englobes all types of research, including industrial R&D or trade secret (confidential data), which would make the definition too vague and no give a possibility for exercising data subject’s rights. They stated that they consider that there is a gap compared to GDPR, because it is only scientific research in the GDPR. - Violation of the purpose limitation principles: They mentioned different cases where they see such violation under PIPA, for instance on statistical processing by public administration (Art 58(1)) or under the Resident Registration Number (RRN) where they consider that data are excessively collected and processed. - The situation of special categories of data and profiling: they stated that NGOs have been raising concerns about biometric data, which are not regarded as sensitive information in South Korea. Another concern that they mentioned is that there is no provision on profiling or automated decision making. - Law enforcement (LE) and national security access to personal data: they presented some points, which they consider issues on LE access as well as access and supervision of personal data at the National Intelligence Service (NIS). Regarding the NIS, it is a comprehensive cybersecurity authority not only to execute relevant policies but also to tackle threat 24/7 all year long. It oversees national cyber security policy, prevents cyber crises and detects attacks, investigates cyber intrusions and analysis of information and conducts security verification schemes. They questioned as well the possible wide surveillance of citizens by the NIS. Regarding the development of a cryptographic model, which is sensitive, the authority can not only access original source but it also carries out certification scheme. - Robotics, AI, Machine to Machine: they are questioning whether legislation are PE636.094v01-00 4/32 CR\1177539EN.docx EN protecting enough the data subjects: On this aspect, the NGOs commented on the GDPR accomplishment and their position that South Korea should adapt its system to more robust data protection standards. - KCC, PPC adequately staffed? Example of complaints? They consider that the authorities are not adequately staffed. They also regret that there is no class action mechanisms in South Korea, so private enforcement scheme does not exist on top of public prosecution. Finally they consider that the administrative fines are of very small amount and seldom imposed. They summarised the following issues at stake: surveillance by the National Intelligence Service; the use of pseudonymised data in R&D, public statistics and commercial statistics with little safeguard; and the use of “my data” (no safeguard, situation of sensitive data, illusion of self-control). In the discussion that followed this general presentation, one issue stressed with the Members touched upon algorithm impact assessment. The NGOs consider that supplementary systems should be adapted to address these issues. The NGOs are interested in enhancing transparency and be able to provide correct explanation of the algorithms. Lastly, regarding algorithm, they stated that discrimination issues are important regarding AI, so they work against discrimination and in view that human rights are protected not only by law but also in practice. They explained that certain large business platforms have a monopoly regarding personal data and they consider that it should be addressed. Personal information should be protected and the issue of protection should be in line with protection of the basic human rights of the people. One participant (Consumers Korea) explained that it is interested in and working on issues surrounding smart devices. They have not carried a full investigation yet, but their first conclusions are that consumers are not adequately informed about the collection of their data. Furthermore, they said that the consumers need to read the fine prints, which are not always very clear. For instance, there is not pop-up banner about collection of their data, or how to turn off the data collection options. In Korea, the consumers need to search through the app or even contact companies how to deactivate certain functions. Members also discussed about cases brought in front of KCC that are relevant to explain the powers of the authority. On enforcement of data protection law, NGOs referred to a case dealt with by the KCC, which was in charge of overseeing a case where 3,2 million consumers data were sent to an insurance company.