Government legislation ministry rules out indirect data access for private firms

The Ministry of Government Legislation said May 26 that individuals cannot request access to their personal data held by private companies through the Personal Information Protection Commission. The interpretation clarifies that the commission's indirect request channel applies exclusively to public institutions.

Under the current enforcement decree of the Personal Information Protection Act, data subjects must demand access directly from the private entity handling their information using methods such as written documents, telephone, email or internet portals. The legal reasoning rests on Article 35 of the act, which separates general data access rights from those specific to public bodies; while the law allows individuals to approach the commission when seeking records from government agencies, no such provision exists for private firms.

The Ministry of Government Legislation issued the ruling in response to a public inquiry, case number 26-0271, asking if the commission could serve as a conduit for accessing private sector data. The ministry stated that including the commission in the list of "easy-to-use methods" for private data access would contradict the statutory framework, which mandates direct requests to the data handler unless the holder is a public institution.