Personal Information Protection Act, Article 37-2: rights over automated decisions (South Korea)

What it is

Article 37-2 of South Korea’s Personal Information Protection Act (PIPA) sets out data subjects’ rights regarding automated decisions. It was added by an amendment promulgated on 14 March 2023 and came into force a year later, on 15 March 2024. The Enforcement Decree, amended on 12 March 2024, sets out the detailed procedure in Articles 44-2 to 44-4. The Personal Information Protection Commission (PIPC) supervises it.

The rights cover decisions made by processing personal information in a fully automated system. The Act states that this includes systems that apply AI technology. Automatic dispositions by administrative agencies under the Framework Act on Administrative Affairs are excluded.

Who it applies to

Article 37-2 applies to personal information controllers in the private and public sectors that make fully automated decisions about individuals. In practice, organisations should look at any system that decides an outcome for a person, such as a credit, hiring or eligibility decision, without a person reviewing it first.

The article is written around fully automated systems. Where a person genuinely makes the decision, check with the PIPC’s published materials or your advisers on how the line is drawn for your use case.

What it requires

The right to refuse

Where an automated decision significantly affects a person’s rights or obligations, they can refuse it. The organisation must then, without a justifiable reason to the contrary, either stop applying the automated decision or reprocess it with human involvement, and tell the person the result.

The right to refuse does not apply where the decision is made on the basis of the person’s consent, a special provision of law, or what is needed to perform a contract with them.

The right to explanation and review

Whenever an organisation has made an automated decision, the person can ask for an explanation. The Enforcement Decree says the explanation must be concise and meaningful and cover the following.

• The result of the decision.
• The main types of personal information used.
• How those types of information influenced the decision, as the key criteria.
• The procedure by which the decision was made, including how the main personal information was processed.

The person can also submit their own view, such as additional personal information, and ask the organisation to review whether it can reflect that in the decision. The organisation must tell them whether and how it did.

Publishing the criteria

Organisations must publish the following items where people can easily find them, for example on a website.

• That automated decisions are made, their purpose and which individuals they cover.
• The main types of personal information used and their relationship to the decision.
• The considerations in the decision process and how the main personal information is processed.
• The purpose and specific items where sensitive information or the data of children under 14 is processed.
• That people can refuse or ask for explanation or review, and how.

The decree asks for standardised terms and allows visual aids such as video, diagrams and tables.

Timing and refusal

An organisation must act on a request within 30 days, in writing or by an equivalent method. Where it has a justifiable reason, it can extend twice by up to 30 days each, after telling the person why. If it refuses a request for a justifiable reason, such as a risk of unfairly harming another person’s interests, it must tell the person why without delay.

Key dates

• 14 March 2023. Amendment adding Article 37-2 promulgated.
• 12 March 2024. Enforcement Decree provisions added.
• 15 March 2024. Article 37-2 in force.

How it relates to other frameworks

Article 37-2 is Korea’s counterpart to Article 22 of the GDPR. The Korean version is built around rights the individual exercises on request, and it adds a specific publication duty and fixed response times.

It works alongside the AI Basic Act. A high-impact AI system used for hiring or loan screening falls under both. The AI Basic Act asks the provider for an explanation plan and human oversight. PIPA gives the individual the right to an explanation and to human reprocessing of a decision about them. One register entry that records whether a system decides without human review, which personal data it uses and who oversees it supports both.

A note on this page

This is Aicura’s reading of the Act, written to help you find your way around it. It is not legal advice and it is not the Act itself. Read the primary text on the Korean National Law Information Center and the PIPC’s guidance, and take advice on how it applies to your organisation.