The European Data Protection Board (EDPB) has adopted a statement on the review of the adequacy decision for the Republic of Korea, recommendations on binding corporate rules for processors, and has chosen the theme of its future coordinated enforcement action.

In its statement on the first review of the adequacy decision for the Republic of Korea, the EDPB positively assesses the amendments made to the Korean legal framework, notably the Personal Information Protection Act (PIPA). These changes introduce a right to withdraw consent, a right to suspend processing, and a right to object to an automated decision, including by artificial intelligence systems. The EDPB also welcomes the clarification of transfer tools for international data transfers and the strengthening of the sanctioning powers of the Korean data protection authority (PIPC). Consequently, the Board approves the European Commission's proposal to re-examine this adequacy decision every four years.

The EDPB adopted the final version of its recommendations on binding corporate rules for processors (BCR-P), a data transfer tool outside Europe within the same corporate group. These recommendations now apply to all holders of BCR-P, as well as to new and ongoing applications. The entities concerned will have to bring their BCR-P into compliance with these new requirements either during their application process or at the latest during their 2028 annual update.

Finally, the Board has selected the theme of its sixth coordinated enforcement action for 2027, which will focus on automated decision-making, including that using artificial intelligence, in the recruitment field. The action will focus on the application of the right not to be subject to decisions based solely on automated processing and the associated right of access, in the context of automated candidate selection tools. The launch of this action, in which data protection authorities will participate on a voluntary basis, is planned for 2027.