가명정보 활용을 위한 위험도 산출 방법에 관한 연구
A Study on the Risk Calculation Method for Using Pseudonymized Information
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
빅데이터 환경에서 데이터의 안전한 활용을 위해 EU는 개인정보를 가명처리하여 활용하는 방법을 법률에 도입하였고 우리나라도 가명정보 개념이 포함된 개인정보보호법 개정안이 국회에서 통과되었다. 가명정보 개념이 도입되더라도 가명처리 범위에 따라 데이터 활용도가 낮아지는 문제는 여전히 존재하게 된다. 이 논문은 실제 기업에서 개인정보 가명처리시 위험도를 기반으로 가명처리 범위를 결정할 수 있게 하는 프레임워크를 적용하기 위해 필요한 위험도 산출방법을 제안한다. 구체적으로는 주요 국가에서 제시한 비식별처리 프레임워크를 분석하여 가명처리에 영향을 미치는 요소를 도출하고 이를 기반으로 전문가 설문을 통하여 실제 가명처리시 재시별 위험 등에 영향을 미치는 요인을 식별하고 검증하였다.
Abstract
For the safe use of data in the big data environment, the EU has introduced a method in their legislation to use personal information in a pseudonymized manner, and Korea is also passing a revision of the Personal Information Protection Act, which includes the concept of pseudonymized information. Even if the concept of pseudonymized information is introduced, there is still a problem that data utilization becomes lower depending on the scope of pseudonym processing. This paper proposes a risk calculation method for applying a framework that allows companies to determine the scope of pseudonymization based on the risk of personal information pseudonym processing. Specifically, we analyzed the de-identification process framework proposed by major countries to derive the factors that affect the pseudonym processing, and based on this, identified and verified the factors influencing the reassessment risk in actual pseudonym processing through expert questionnaire.
참고문헌 (27)
- Paul Sutton, "Data Protection in South Koorea:Why You Need to Pay Attention" (2018), IAPP
- "World Digital Competitiveness Ranking", IMD, 104~105 (2019)
- Ministry of the Interior and Safety, "Manual of the Personal Information Protection Act", ~ (2016)
- 이대희, "개인정보 보호 및 활용 방안으로서의 가명⋅비식별정보 개념의 연구", 정보법학, 21(3), pp.217~251 (2017), 한국정보법학회
- 오길영, "데이터 비식별화 논의의 쟁점과 맹점", 공법연구, 45(2), pp.289~321 (2016), 한국공법학회
- Office for Government Policy Coordination, "The Guidline for De-identification", ~ (2016)
- "Article 29 Data Protection Working Party, Opinion 05", 2014 on Anonymisation Techniques, 2014
- 전승재, "개인정보, 가명정보, 익명정보에 관한4개국 법제 비교분석", 정보법학, 22(3), pp.183~218 (2018), 한국정보법학회
- 이순환, "개인정보 비식별 조치 가이드라인의 법적 문제와 개인정보보호법제 개선방향", 공법연구, 45(2), pp.257~287 (2016), 한국공법학회
- Miranda Mourby, "Are ‘pesudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK", Computer Law & Security Review, 34(2) (2018)
- John Rumbold, "Contextual Anonymization for Secondary Use of Big Data in Biomedical Research: Proposal for an Anonymization Matrix", JMIR Medical Information (2018)
- Geoffrey K. Neumann, "Pseudonymization risk analysis in distributed systems", Journal of internet Services and Applications (2019)
- Florian Kohlmayer, "Pseudonymization for research data collection: is the juice worth the spueeze?", BMC Medical Information and Decision Making (2019)
- Otto Jonassen Wittner, "Data Anonymization for Reseach", Master, pp.2019
- NIST, "Guide to Protecting the Confidentiality of Personally Identifiable Information (Special Publiation 800-122)", ~ (2010)
- International Organization for Standardization, "ISO 25237:2017 Health informatics — Pseudonymization", ~ (2017)
- International Organization for Standardization, "ISO", IEC FDIS 20899 IT Security techniques —Privacy enhancing data de-identification terminology and classification of techniques, 2018
- Canada Information and Privacy Commissioner of Ontario, "De-identification Guidelines for Structured Data", ~ (2016)
- Office of the Australian Information Commissioner, "De-identification Decision-Making Framework", ~ (2016)
- UK Information Commissioner’s Office, "Anonymisation:Managing Data Protection Risk Code of Practice", ~ (2012)
- UK Anonymisation Decision-Making Framework, "The Anonymisation Decision-Making Framework", ~ (2016)
- US Office of Human Rights, "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule", ~ (2012)
- US National Institute of Standards and Technology, "De-Identification of Personal Data", ~ (2015)
- Minna Tamper, "Anonymization Service for Finnish Case Law: Opening Data without Sacrificing Data Protection and Privacy of Citizens" (2019), Semantic Computing Research Group
- Arttu Oksanen, "Anoppi: A Pseudonymization Service for Finnish Court Documents" (2018), Semantic Computing Research Group
- US Office of Human Rights, "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule", ~ (2012)
- US National Institute of Standards and Technology, "De-Identification of Personal Data", ~ (2015)