The Personal Information Protection Commission (PIPC) is facing scrutiny as its investigation into the foreign private equity firm EQT's acquisition of Remember Company has extended for several months. On June 21, Kang Min-guk, a member of the National Assembly from the People Power Party, highlighted concerns regarding the prolonged nature of the inquiry.
According to Kang, the PIPC initiated a preliminary review in January to assess the implications of EQT's acquisition of Remember Company, particularly regarding changes in major shareholders and the potential transfer of personal data abroad. However, nearly six months later, the commission has yet to reach a final conclusion. Kang criticized the PIPC for not disclosing specific details, citing the ongoing nature of the investigation as the reason for its lack of transparency despite requests for information from the National Assembly.
EQT, a global private equity firm, acquired Remember Company, which operates the domestic business card management platform Remember, last year. This acquisition raised concerns in the industry about the potential transfer of large amounts of personal data and sensitive information to foreign entities.
The controversy over the investigation's delay extends to the case involving SK Shieldus. The PIPC began its investigation into a hacking incident at SK Shieldus that occurred in October of last year, but has not yet announced any final findings, with approximately nine months having passed since the inquiry began.
Kang urged the PIPC to take a more proactive approach to address privacy protection issues arising from foreign acquisitions of domestic companies. He noted that the current merger and acquisition (M&A) reviews primarily focus on assessments by the Fair Trade Commission and financial authorities, while there is a lack of a dedicated verification system for the potential mass transfer of personal data.
With the recent surge in foreign private equity firms acquiring domestic companies amid high exchange rates, Kang emphasized the growing need for regulatory reforms to protect personal data and data sovereignty.
The PIPC is aware of the risks associated with personal data leaks and transfers abroad due to foreign capital acquisitions of data companies and is currently reviewing measures for improvement. The commission has included the establishment of privacy protection measures during the M&A process in its work plan for this year and aims to finalize related strategies before the regular National Assembly session in September.
Kang stated, "There is a need for a pre-verification system from the perspective of privacy protection in the M&A process of data companies containing citizens' personal information. We are preparing legislation to mandate the PIPC's pre-review in cases where there are concerns about the large-scale transfer of personal data abroad."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.