개인정보 유출통지제도의 효과적인 운영 및 개선방안
Reform Proposals for Effective Operations of Korea's Data Breach Notification Law
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
Under data breach notification law, person or business who owns or licenses data that includes personal information is required to notify the data subject of the breach of the security system of personal information. Since the enactment of California's data breach notification law in 2003, other forty five states of the United States have legislated notification law. Korea adopted data breach notification law under which a personal information controller is supposed to notify the subject of the breach. While Korea's legislation is expected to improve practices of personal information protection, it would be more effective with some amendments. This paper suggests some proposals to improve the operation of data breach notification in Korea. First, publicly available information that is lawfully made available to the general public from government needs to be excluded from the scope of personal information, although its definition is flexible enough to cover new types of sensitive personal information. Second, encryption exemption is necessary so that the controller may not be required to notify the breach if data which includes personal information has been encrypted. It will create incentives to adopt encryption, improving practices of protection, and would alleviate burden on the controller. Third, Korea's legislation should require, in addition to the acquisition of personal information by a third party, an additional element of harm to trigger notification. This additional element will limit unnecessary notification of breach, preventing the subject from becoming desensitized to notification with over-notification.
Abstract
Under data breach notification law, person or business who owns or licenses data that includes personal information is required to notify the data subject of the breach of the security system of personal information. Since the enactment of California's data breach notification law in 2003, other forty five states of the United States have legislated notification law. Korea adopted data breach notification law under which a personal information controller is supposed to notify the subject of the breach. While Korea's legislation is expected to improve practices of personal information protection, it would be more effective with some amendments. This paper suggests some proposals to improve the operation of data breach notification in Korea. First, publicly available information that is lawfully made available to the general public from government needs to be excluded from the scope of personal information, although its definition is flexible enough to cover new types of sensitive personal information. Second, encryption exemption is necessary so that the controller may not be required to notify the breach if data which includes personal information has been encrypted. It will create incentives to adopt encryption, improving practices of protection, and would alleviate burden on the controller. Third, Korea's legislation should require, in addition to the acquisition of personal information by a third party, an additional element of harm to trigger notification. This additional element will limit unnecessary notification of breach, preventing the subject from becoming desensitized to notification with over-notification.
참고문헌 (19)
- Abraham Shaw, "Data Breach: From Notification to Prevention Using PCI DSS", COLUM. J. L. & SOC. PROBS, 43, pp.517~ (2010)
- Amanda C. Border, "Untangling the Web: An Argument for Com- prehensive Data Privacy Legislation in the United States", SUFFOLK TRANSNAT’L L. REV, 35, pp.363~ (2012)
- Brendan St. Amant, "The Misplaced Role of Identity Theft in Triggering Public Notice of Database Breaches", HARV. J. LEGIS, 44, pp.505~ (2007)
- Flora J. Garcia, "Data Protection, Breach Notification, and the Interplay between State and Federal Law: The Experiments Need More Time", FORDHAM INTEL. PROP. MEDIA & ENT. L. J, 17, pp.693~ (2007)
- Gideon Emcee Christian, "A New Approach to Data Security Breaches", CAN. J. L. & TECH, 7, pp.149~ (2009)
- Jacqueline May Tom, "A Simple Compromise: The Need for A Federal Data Breach Notification Law", ST. JOHN'S L. REV, 84, pp.1569~ (2010)
- Jane K. Winn, "Are "Better" Security Breach Notification Laws Possible?", BERKELEY TECH. L. J, 24, pp.1133~ (2009)
- Lilia Rode, "Database Security Breach Notification Statutes: Does Placing the Responsibility on the True Victim Increase Data Security?", HOUS. L. REV, 43, pp.1597~ (2007)
- Mark Burdon, "Contextualizing the Tensions and Weaknesses of Information Privacy and Data Breach Notification Laws", SANTA CLARA COMPUTER & HIGH TECH. L. J, 27, pp.63~ (2010)
- Michael E. Jones, "Data Breaches: Recent Developments in the Public and Private Sectors", J. L. & POL'Y FOR INFO. SOC'Y, 3, pp.555~ (2007)
- Michael Greenberger, "The Maryland Personal Information Protection Act: Strengthening Maryland's Security Breach Notification Law", U. BALTIMORE L. FORUM, 42, pp.129~ (2012)
- Michael Turner, "Towards a Rational Personal Data Breach Notification Regime", Information Policy Institute, 28 (2006)
- Paul M. Schwartz, "Notification of Data Security Breaches", MICH. L. REV, 105, pp.913~ (2007)
- Priscilla M. Regan, "Federal Security Breach Notifications: Politics and Approaches", BERKELEY TECH. L. J, 24, pp.1103~ (2009)
- Sasha Romanosky, "Privacy Costs and Personal Data Protection: Economic and Legal Perspectives", BERKELEY TECH. L. J, 34, pp.1061~ (2009)
- Sasha Romanosky, "Do Data Breach Disclosure Laws Reduce Identity Theft?", 7th Workshop on the Economics of Information Security, pp.2~3 (2008)
- Timothy H. Skinner, "California's Database Breach Notification Security Act: The First State Breach Notification Law Is Not yet A Suitable Template for National Identity Theft Legislation", RICH. J.L. & TECH, 10, pp.1~ (2003)
- Thomas M. Leonard, "Much Ado about Notification", Regulation, 29(1) (2006)
- Thomas Smendinghoff, "The State of Information Security Law: A Focus on the Key Legal Trends 36; Gideon Emcee Christian, A New Approach to Data Security Breaches", CAN. J. L. & TECH, 7, pp.149~ (2009)