As concerns grew in the fintech industry over public data scraping ahead of the rollout of the right to request personal data transfers under the Personal Information Protection Act, the Personal Information Protection Commission expanded pre-consultation support to include small and non-mydatabusinesses. It said it will not impose a blanket block on scraping from the 20th, but will keep existing services while public agencies and companies transition in stages to safer transfer methods.

The commission said on the 11th it will accept third-round applications from Monday through the 31st for support with pre-consultations for personal data transfer request agents. This round is open not only to the existing eligible applicants but also to small businesses and firms that do not have mydata qualifications. The commission plans to review their service types and security levels and consider safety management measures that can be applied in practice.

The step is intended to reduce concerns that services could be halted for companies that have used existing scraping services, ahead of the enforcement decree under the Personal Information Protection Act that takes effect on the 20th.

The commission has drawn a line, saying the rollout does not amount to a blanket ban on scraping itself. Under the revised enforcement decree, when a business acting on behalf of a user uses automated tools such as scraping to retrieve information from a public agency, it must consult with that public agency in advance.

The consultation sets in advance the scope of information subject to transfer, how the agent is verified, the access and authentication level of automated tools, and personal data protection measures and safety management plans. Once safeguards are in place, scraping can be used within the agreed scope, and the system aims over the medium to long term to shift to API-based transfers.

In particular, companies and institutions that apply for pre-consultations during the third-round application period will receive support to temporarily maintain their existing information transfer methods while consultations with information transmitters are under way. That means services such as automated document submission will not be halted all at once just because the system takes effect on the 20th. The commission said it will support businesses that need preparation time by keeping current services and transitioning in stages to safer methods.

Pre-consultations can continue even after the third pilot operation ends. After the 31st, businesses that newly have scraping demand or need consultations can apply directly for pre-consultations with individual public agencies that hold the information. The commission explained that the 20th is not a uniform end point for scraping services but the point when the pre-consultation system by public agency begins full operation.

◆ Lowering the bar for pre-consultations... applications possible even without mydata status

The commission said the first two pilot rounds confirmed more scraping demand than expected. During the first pilot period, from June 25 to July 10, about 70 companies and institutions filed 150 applications, and during the second, from July 20 to 31, about 300 companies and institutions submitted 550 cases.

Across the two rounds, there were about 700 cases of pre-consultation demand. The commission said scraping has been used across many services but the overall picture has been hard to grasp, and it plans to use the third round to identify demand from small businesses and others that has not yet been confirmed.

The eligibility criteria have also been clarified. Under the third pilot operation, regardless of whether they hold separate qualifications such as being a specialist personal information management institution, personal data transfer request agents who use automated tools to receive personal information managed by public system operators can apply.

Those without qualifications can submit the application leaving the qualification classification field blank. Public agencies will, however, verify the agent's access methods, protection measures and safety management plans during the pre-consultation process, so separate preparation is needed.

Fintech companies that use external scraping solutions can also apply. A contractor that handles scraping tasks for multiple client companies can apply in a single submission, but each client company becomes the agent as the actual entity making the transfer request.

Fintech companies that use information such as from HomeTax can also apply for the third pilot operation. The fintech industry had previously been concerned about whether services could continue, believing it was difficult for businesses without mydata qualifications to join pre-consultations. With the expanded eligibility, it sees much of the immediate uncertainty as having been resolved.

An industry official expressed relief about the step, saying, "Now that businesses like us can also apply, it feels like we have cleared one higher hurdle."

Yang Cheong-sam (양청삼), secretary general of the commission, said, "The purpose of the right to request personal data transfers is not to abruptly stop services that people have been using, but to keep necessary services running while changing personal data transfer methods to safer ones." He said, "We will support agreed scraping methods and safe transitions such as APIs through consultations with public agencies."

A fintech industry official said, "Now that businesses without mydata qualifications can also apply for pre-consultations, I think we have gotten over a big mountain." The official added, "Still, there are concerns in the area of accumulating data for analysis and use, so I think additional discussions on this will be needed going forward."