Skip to the text
In this act Article 3 of 4
Text as of 26 Oct 2026 · Commission Implementing Decision (EU) 2022/254, OJ L 44, 24.2.2022 · Same wording as today’s text.Today’s text

Article 3

Consumer protectionLevel 2Implementing DecisionGDPRIn forceOfficial source

3(1)

1.The Commission shall continuously monitor the application of the legal framework upon which this Decision is based, including the conditions under which onward transfers are carried out, individual rights are exercised and Korean public authorities have access to data transferred on the basis of this Decision, with a view to assessing whether the Republic of Korea continues to ensure an adequate level of protection within the meaning of Article 1.

Copy link
3(2)

2.The Member States and the Commission shall inform each other of cases where the Personal Information Protection Commission, or any other competent Korean authority, fails to ensure compliance with the legal framework upon which this Decision is based.

Copy link
3(3)

3.The Member States and the Commission shall inform each other of any indications that interferences by Korean public authorities with the right of individuals to the protection of their personal data go beyond what is strictly necessary, or that there is no effective legal protection against such interferences.

Copy link
3(4)

4.After three years from the date of the notification of this Decision to the Member States and subsequently at least every four years, the Commission shall evaluate the finding referred to in Article 1(1) on the basis of all available information, including the information received as part of the review carried out together with the relevant Korean authorities.

Copy link
3(5)

5.Where the Commission has indications that an adequate level of protection is no longer ensured, the Commission shall inform the competent Korean authorities. If necessary, it may decide to suspend, amend or repeal this Decision, or limit its scope, in accordance with Article 45(5) of Regulation (EU) 2016/679, in particular where it has indications that:

Copy link
3(5)(a)
(a)controllers in Korea that have received personal data from the European Union under this Decision do not comply with the additional safeguards contained in Annex I, or there is insufficient oversight and enforcement in this regard;
Copy link
3(5)(b)
(b)the Korean public authorities do not comply with the representations, assurances and commitments contained in Annex II, including as regards the conditions and limitations for the collection of and access to personal data transferred under this Decision by Korean public authorities for criminal law enforcement or national security purposes.
Copy link

The Commission may also adopt such measures if the lack of cooperation of the Korean government prevents the Commission from determining whether the Republic of Korea continues to ensure an adequate level of protection.