Potential for overseas transfer of pseudonymized information from domestic medical institutions and review of pseudonymized information provision contract.

Law firm Veat received a request from domestic medical institution A (hereinafter referred to as "the client") to review the legal requirements and procedures, and effects, that must be met in order to transfer pseudonymized personal information overseas.

The client's pseudonymized information, while having had patient identification information removed or pseudonymized, still contained detailed treatment and examination records based on medical procedures, and was assessed as having high added value. Accordingly, Law firm Veat conducted a review of the legality of overseas transfer of the information under the Personal Information Protection Act, and also reviewed the English contract (pseudonymized information provision contract) based on this.

Concept of pseudonymized information and differential legal regulations

As social interest in the importance of personal information and its protection increases, the related legal environment is rapidly changing. In particular, the introduction of the concept of 'pseudonymized information' through amendments to the Personal Information Protection Act has brought about new possibilities and legal disputes regarding existing personal information processing methods.

Under the Personal Information Protection Act, pseudonymized information refers to information that has been processed to prevent the identification of a specific individual without using additional information. This is a institutional measure to enable more flexible use of data in various fields such as research, statistics, and public record preservation.

Pseudonymized information is subject to several different regulations compared to general personal information. Firstly, it can be processed without the consent of the data subject when the purpose is to perform statistics, scientific research, or public record preservation. However, pseudonymized information is still a type of personal information and basic protection principles still apply, and unlimited use is not permitted. In particular, third-party provision is generally prohibited and only allowed in limited cases such as for statistical and research purposes.

Furthermore, pseudonymized information must prevent it from being restored to its original personal information. Therefore, separate storage with additional information, access control, establishment of internal management plans, and other technical and administrative protective measures must be taken. Moreover, data subjects may have their right to access and correct information limited, which means there is a certain restriction on protecting data subject rights, while increasing the efficiency of data utilization.

Ultimately, the Personal Information Protection Act establishes a differentiated and relaxed regulatory system that places pseudonymized information within the scope of protection while also expanding the possibility of use for public purposes. Accordingly, companies and institutions that process pseudonymized information must accurately understand these legal characteristics and requirements, and have a corresponding legal and technical response system.

Pseudonymized information provision contract

Although pseudonymized information is subject to some relaxed regulations compared to general personal information, it still constitutes 'personal information' and, particularly when transferred overseas, must strictly comply with specific legal requirements and procedures under the Personal Information Protection Act. One of the most important steps in this process is the conclusion of a 'pseudonymized information provision contract' with the overseas recipient.

This contract should specifically include the purpose of information provision, scope of use, retention period, processing procedures after expiration, restrictions on third-party provision, establishment of information protection management system, and other security obligations. This is a key measure to prevent information leakage or misuse and to prevent potential legal disputes.

In particular, when drafting an English contract, legal risks can be expanded due to differences in interpretation regarding how to reflect the protective measures required by domestic laws, or ambiguity in translation. Therefore, a refined wording and review that goes beyond simple translation and accurately reflects domestic regulations is essential.

Ultimately, it is important to have the contract thoroughly drafted through professional legal advice from the pre-stage to safely promote the overseas transfer of pseudonymized information, including medical information, and to clearly define the scope and limitations of international cooperation.

Law firm Veat has expertise in advising on complex legal issues related to the overseas transfer of pseudonymized and medical information. Based on experience in providing advice based on domestic and international laws, such as the Personal Information Protection Act, pseudonymized information provision contracts, and English personal information transfer contracts, we systematically support the entire process from contract conclusion with overseas recipients to specifying protective measures, removing translation ambiguities, and responding to regulatory agencies. In particular, we provide strategic advice to client companies dealing with sensitive data such as AI, bio, and digital healthcare to simultaneously achieve safe data utilization and minimize legal risks.

If you need legal advice regarding overseas transfer of personal (pseudonymized) information, please feel free to contact Law firm Veat.

Thank you.

Law firm Veat