The South Korean data protection authority (PIPC) has provided clarifications regarding the new regulation on automated data collection by the financial sector.

Starting August 20, a new provision of the enforcement act of the Personal Data Protection Act will require agents using automated tools on behalf of natural persons to conclude a prior agreement with the entity holding the information. This agreement must define the data to be transmitted and the terms of their secure transfer. The PIPC specifies that this is not a total ban on automated collection, but a restriction on unauthorized collection to reduce the risks of excessive collection or data leakage. Information already available via the public service "My Data" application programming interface (API) must be obtained through this channel.

To ensure a seamless transition for users, the PIPC has extended the prior agreement request period. Originally scheduled to end on July 10, it is extended from July 20 to 31. Agents submitting their request during this period may temporarily maintain their current transmission methods until their agreement is finalized. The PIPC emphasizes that this measure is transitional and that the principle of voluntary prior consultation between agents and data holders will be the norm in the future.