South Korea sets rules for protecting Koreans' biometric data shared overseas

South Korean police have established new standards to protect the personal data of Korean nationals shared with foreign law enforcement agencies and international organizations during cross-border cooperation, including the repatriation of fugitives and the tracking of missing persons.

The Korean National Police Agency announced Monday that regulations governing the overseas transfer of personal data for international law enforcement cooperation will take effect Tuesday. The regulations set out the criteria and procedures for sharing Korean nationals' personal data abroad and follow the revised Personal Information Protection Act, which took effect in September 2023. The move comes amid growing demand for international cooperation and aims to establish safeguards for personal data transferred overseas.

Under the new framework, police can require foreign agencies that receive Korean nationals' personal data to refrain from using it beyond its stated purpose and to restrict further transfers. Authorities can also request deletion or destruction of the data once the purpose for which it was shared has been fulfilled, establishing a post-transfer monitoring system.

The revised Personal Information Protection Act tightened the conditions under which personal data may be transferred abroad, requiring that the recipient country or international organization maintain a data protection regime meeting standards recognized by the Personal Information Protection Commission.

The act also requires a statutory basis for overseas data transfers, prompting police to add a new provision — Article 8-4 — to the Police Duties Execution Act. The provision states that personal data may be transferred to foreign government agencies and international organizations when necessary for international law enforcement cooperation, or urgently needed to protect life, physical safety or property. This gives police a clear legal basis for transferring Korean nationals' personal data to foreign law enforcement agencies and organizations such as Interpol.

The types of data that may be shared include biometric information such as fingerprints and facial recognition data. Police said they expect the new framework to speed up identity verification for Korean nationals abroad, including fugitives, missing persons and crime victims.

Park Jun-seong, director of the Korean National Police Agency's International Police Cooperation Bureau, said the regulations are significant because they both strengthen the effectiveness of international cooperation and systematize the standards and procedures for protecting personal data. "We will continue to refine the system so that combating transnational crime and protecting personal data can go hand in hand," he said.