일본의 개인정보보호 법제에 관한 연구 - 2020년 개정법을 중심으로 -

Abstract

Today, in terms of personal information, we are facing very difficult tasks to solve such as how to harmoniously maintain balance between vitalization of personal information use and personal information protection, and consideration of international consistency in relation to cross-border transfer of data. Under this circumstance, recently, the major countries are improving the personal information protection laws by focusing on the solution of those tasks. The representative examples are the ‘General Data Protection Regulation(GDPR)’ of the EU in 2016, ‘California Consumer Privacy Act (CCPA: Effective from January 2020)’ of the United States, and the revision of ‘Personal Information Protection Act’ of Japan in 2015 and 2020. Korea also revised so-called ‘Data 3 Act’ in February 2020, which has been enforced since August 2020. After fully revising the Personal Information Protection Act in 2015, Japan has enforced it by phases. Through the mutual evaluation of appropriateness with the EU in 2019, the effects of revision were proved in the aspect of international consistency. The items pointed out in this evaluation process were complemented in the revised law in 2020. Regarding the improvement direction of personal information protection laws, Korea also aims to establish the appropriate standard for personal information protection/use by considering the international consistency according to legislative changes in the United States or EU, which is almost the same as Japan. For this reason, it would be necessary to closely review the improvement of laws in Japan as Korea also has to get the evaluation of appropriateness from the EU in the future. Thus, after examining the enactment process of Personal Information Protection Act, the main contents of revised law in 2015, and the contents of revised law of Japan in 2020, this study presents the improvement direction of Korean laws based on the implications. Especially, it would be advisable to introduce some contents of Japanese laws to Korean laws, such as regulations of extraterritorial application of law and cross-border transfer of personal information, and the business association certification system for strengthening the duties and independent personal information protection activities of businesses. This study suggests that the Personal Information Protection Commission of Korea should refer to the roles of Personal Information Protection Commission of Japan established earlier than Korea, for establishing all sorts of guidelines related to personal information protection/use, by reviewing and analyzing them.