The BSA mainly pertains to bioethics and safety; its purpose is “to ensure bioethics and safety by preventing the violation of human dignity and values or the infliction of harm on a human body in the course of research on human beings, human materials, etc. or of handling embryos, genes, etc.” The purpose of the PIPA is “to realize the freedom, rights, dignity, and value of individuals” by “prescribing requirements for the processing and protection of personal information.” Under Article 16 of the BSA, human-subject research requires consent from the human subjects and approval from the competent IRB. However, according to Article 13 of the BSA’s Enforcement Rule, the IRB review requirement is waived for "research that does not involve invasive activities but only simple measurement or observation, and research that does not identify the research subjects and does not collect or record sensitive information, regardless of whether the research is conducted face-to-face, but uses existing materials or documents"; additionally, when "consent is impracticable, poses a serious risk to the validity of the research, or the risk to the research subjects is extremely low," consent is exempted according to Article 16 paragraph 3 of the Act.

When scientific research is conducted in accordance with the PIPA, personal information may be 1) utilized within the scope of the research purpose after consent to the use of personal information is obtained in accordance with Article 17 of the PIPA, 2) used for scientific research if the information is pseudonymized in accordance with Article 28-2 of the Act and the Guidelines and the appropriateness of pseudonymization is confirmed by the DRB, and 3) provided to third parties conducting scientific research.

Both the BSA and PIPA distinguish between human-subject research and scientific research; however, in practice, this distinction is opaque. Generally, human-subject research dealing with genes, embryos, etc., is prioritized over general personal information, and research utilizing data from medical institutions is subject to human-subject research procedures if it is judged that protection is warranted based on bioethics and values. However, if information is intended to be used for scientific research through pseudonymization, it may fall under the IRB exemption (Article 15 of the Act, Article 13 of the Enforcement Rule) or consent exemption (Article 16 paragraph 3 of the Act), allowing for simplified procedures. Therefore, distinguishing between “human-subject research” and “scientific research” is necessary.

Procedures for human-subject research using information that has already been anonymized or pseudonymized are not clearly defined; both the BSA and the PIPA stipulate that "a person who intends to conduct a human-subject research project shall prepare a research plan and submit it for review by the competent IRB before commencing such human-subject research," and that "a personal information controller may process pseudonymized information for scientific research purposes without the consent of data subjects"; this criteria applies based on the research purpose, not whether the existing information is pseudonymized or anonymized. Therefore, approval should be based on whether the purpose of the research is human-subject research or scientific research.

For human-subject research using already anonymized information, IRB review may be waived because the research is likely to be "non-invasive or utilize existing materials or documents." Consent may also be waived because it is likely to be "impractical to obtain consent, or the risk for the research subjects is extremely low." However, Article 15(1) of the BSA still requires IRB approval of the research plan before conducting human-subject research, and the IRB review may consider whether the research should be exempt from consent requirements or further IRB review.

According to Article 18 of the BSA, a human-subject researcher may provide data subjects’ personal information to a third party after obtaining the consent of the data subjects under Article 16 of the Act and receiving IRB approval under Article 18. In accordance with Article 18 paragraph 2 of the Act, identifying information can be provided to a third party if the research subject has consented to such provision, but if the subject has not consented, then the information must be anonymized. According to Article 17 of the PIPA, the personal information processor may provide personal information to a third party if consent is obtained from the data subject and the personal information is provided within the scope of purpose for which it was collected. Further, according to Article 28-2 of the PIPA, personal information may be pseudonymized for scientific research without the consent of the data subjects and provided to a third party after DRB approval of pseudonymization in accordance with the Guidelines.

The BSA stipulates that human-subject research requires data-subject consent for the provision of information to a third party, IRB review, and anonymization, but PIPA rules for scientific research allow for the provision of pseudonymized information to a third party (with DRB approval of pseudonymization) without data-subject consent. The current Guidelines stipulate that human-subject research using pseudonymized information requires IRB approval of the research plan in accordance with the BSA and explain that exemptions are available if the research falls under "using existing materials or documents" under Article 13 of the Enforcement Rule [9]. However, the Guidelines do not clearly explain the rules for scientific research that falls under the PIPA.

As discussed above, human-subject research using anonymized information under the BSA and scientific research using pseudonymized information under the PIPA have different procedural and methodological requirements. Confusion arises because the scope of what constitutes human-subject research versus scientific research is not clearly distinguished.

The BSA defines human-subject research as "a research project specified by the Ordinance of the Minister of Health and Welfare, such as a research project physically involving a human being as a subject or conducted through communication, physical contact, or other means of interaction with a human being, or a research project conducted using information by which individuals could be identified." The Enforcement Rule of Bioethics and Safety uses a very similar definition, encompassing research that obtains data by directly manipulating the research subject or manipulating the research subject’s environment (intervention research), research that obtains data by observing the behavior of the research subject or conducting face-to-face surveys (interaction research), and research that involves the use of information by which individuals can be directly or indirectly identified (personal information use research). The PIPA defines scientific research as "research that applies scientific methods such as technological development and demonstration, fundamental research, applied research, and privately funded research," and includes "not only natural scientific research, but also historical research that applies the scientific method, research conducted in the public interest in the field of public health, as well as research for industrial purposes, such as research and development and improvement of new technologies, products, and services." Therefore, the classification of research using medical institutions’ health data as human-subject research or scientific research is based on the research plan in terms of "whether there is physical involvement of human beings, communication and other means of interaction, or whether personally identifiable information is utilized" (in the case of human-subject research) or "when the scientific method is applied to technology development and demonstration, fundamental research, applied research, and privately funded research, etc."

For scientific research that utilizes pseudonymized medical data, if there is no "physical intervention, communication, or other interaction with humans," the relevant judgment is whether the pseudonymized information falls under the definition of "using information that could identify an individual" found in Article 2, paragraph 1 of the BSA’s Enforcement Rule. Article 2 subparagraph 17 of the BSA defines "personally identifiable information" as "information by which an individual can be identified, such as the name and resident registration number of a human research subject or the donor of an embryo, oocyte, spermatozoon, or human material (hereinafter referred to as ‘human research subject or donor’)," and subparagraph 18 defines personal information as "information about an individual, such as personally identifiable information, genetic information, or information about health." Under Article 2 subparagraph 1(c) of the PIPA, pseudonymized information is defined as "information that is incapable of uniquely identifying an individual without the use or combination of information for restoration to its original state," so even if the definition in Article 2 paragraph 1 of the BSA’s Enforcement Rule is applied, such research is unlikely to fall under the definition of "research using personally identifiable information."

However, the "Ethical Guidelines for Researchers by the Korea National Institute for Bioethics Policy" [10] defines "research using information that could identify individuals" as "research using information that could directly or indirectly identify research subjects (personal information used for research)." Pseudonymized information, by definition, does not fall under the scope of directly identifiable information because it is "processed so that a specific individual cannot be recognized without additional information," but it could be interpreted as "indirectly identifiable information," so determining the applicability of these regulations is complex [11].

The rule regarding what constitutes human-subject research is still open to interpretation in that pseudonymized information can, in principle, be identified when combined with other information and, thus, could be considered indirectly identifiable information. Another issue is balancing the interests of information utilization procedures. Under the BSA, anonymous information refers to "information that can no longer identify an individual in conjunction with other information with reasonable consideration of time, cost, technology, etc.," while pseudonymous information is defined on the premise that a specific person could be recognized by "using or combining additional information." Anonymized information is considered more secure and more strictly protective in terms of personal identification than pseudonymized information. However, if the information is provided for human-subject research purposes after anonymization, consent is exempted, and if the information is provided for scientific research purposes after pseudonymization, IRB review is required but consent is exempted. Therefore, a review is required to determine whether the balance of legal interests has been met [12,13].