개정된 개인정보보호법상 개인정보의 국외이전에 관한 규정의 분석: GDPR을 참조하여

Abstract

Cross-border transfer of personal data is inevitable for international trade and cooperation in today’s globalized world. Its importance in the field of entrepreneurship is evidenced from the recent controversy surrounding the European Union(hereinafter ‘EU’)’s regulation of Meta, a US big-tech company, with its European headquarters regarding its transfer of EU citizens’ personal data to the US. The Court of Justice of the EU nullified the relevant adequacy decisions of the European Commission relating to the US for its failure to ensure the adequate level of protection as required in the EU. Since then, Meta has been relying on alternative means known as Standard Contract Clause to facilitate its transfer. However, such a basis has again been invalidated by the order of Ireland Data Protection Commission on 22 May 2023, imposing Meta with a fine of 1.2 billion Euro as well as suspension decisions. Unless the US and the EU succeed in adopting the Trans-Atlantic Data Privacy Framework so as to comply with the ‘General Data Protection Regulation(hereinafter ‘GDPR’)’ in the US, Meta may have to withdraw its business out of the EU. The ‘Personal Information Protection Act(hereinafter ‘Act’)’ of Korea originally provided for the provision of personal data to a third person in Article 17, paragraph 3 simply as it was only based on the consent of the data subject concerned. On 4 February 2020, more detailed provisions on the transfer of personal data out of Korea in the Information and Telecommunications Act were integrated into the Act, and on 14 March 2023, a separate Section 4 on the transfer of personal data was finally inserted into Chapter 3 of the Act, thereby permitting such transfer to be based on diversified legal grounds other than the original consent of data subject concerned. The amendment of the Act, due to its various legal bases for the transfer of personal data out of Korea, is expected to further facilitate the trade in or flows of data including personal data, and consequently, to encourage digital trade. This is a positive improvement considering that Korea is now expected to develop digital trade through the cross-border transfer of personal data with its participation in the APEC Cross-Border Privacy Rules and the Global Cross-Border Privacy Rules systems as well as the adequacy decision of the European Commission. Nevertheless, this Act still needs to be further improved. The amended provisions are insufficient in comparison to the corresponding provisions of the GDPR.