The Personal Information Protection Commission has clarified that the upcoming expansion of data transfer rights on August 20 will not result in a complete ban on scraping methods used by financial institutions. Instead of an outright halt, the commission is transitioning to safer methods, such as application programming interfaces (APIs), through pre-consultation.
Since June 25, the commission has been piloting support for pre-consultation on the transfer of personal data between public institutions and their agents. In the first round of applications, about 70 institutions submitted 150 requests, and an additional 550 requests were received during the second round from July 20 to 31.
The majority of these applications come from the financial sector, including banks, insurance companies, and securities firms. These entities have traditionally used scraping methods to collect necessary personal data, such as income and assets, from public institution systems based on user consent and authentication. The pre-consultation process aims to facilitate the transition from existing scraping methods to API-based approaches.
In line with the expanded data transfer rights, the pre-consultation will address the scope of information needed for data transfer, the method of transfer, authentication levels, and security measures to enhance safety. The commission announced on August 11 that if an organization applies for pre-consultation, they can continue using existing methods until the consultation is complete, thereby encouraging a gradual shift to API methods.
While scraping involves agents using user authentication information to log into public institution systems and retrieve necessary data, the API method allows for the exchange of only the required information through a predetermined transfer route, significantly reducing the risk of data breaches.
The commission noted that with approximately 700 applications received in the first and second rounds, there are many existing services utilizing personal data from public institutions. From August 11 to 31, a third round of pre-consultation applications will be accepted, targeting small businesses.
Speculation about a complete ban on scraping starting August 20 has also been influenced by a separate ruling from the Supreme Court, which decided to restrict automated scraping of personal data from external sources, even though it does not fall under the scope of the data transfer rights as defined by the Personal Information Protection Act.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.