Rule or Standard: The De-Identification of Personal Information in Korea
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Korea is a data-rich country with huge potential in this era of the data-driven economy. Nonetheless, it is unclear if the country is actively utilizing its potential. A central reason for this hesitancy appears to be related to Korea’s strict privacy law regime. In an effort to encourage utilization of data, the Korean government issued multi-agency de-identification guidelines in 2016. The guidelines rely heavily on the statistical concept of “k-anonymity.” In the context of academic discourse distinguishing between rules and standards, the adoption of k-anonymity can be identified with the adoption of a rule. By analogy, employing the concept of k-anonymity is akin to imposing the same speed limit in all cases, regardless of road conditions such as the traffic situation, time, and number of lanes. On the other hand, a standard would demand that drivers drive at a reasonable speed. As such, while a rule is simpler and easier to follow, a standard could be adapted to suit diverse circumstances. This article suggests that Korea needs to adopt a risk-based approach for de-identifying personal information and argues that a risk-based approach would be predicated upon providing a suitable standard, not a rule.
Abstract
Korea is a data-rich country with huge potential in this era of the data-driven economy. Nonetheless, it is unclear if the country is actively utilizing its potential. A central reason for this hesitancy appears to be related to Korea’s strict privacy law regime. In an effort to encourage utilization of data, the Korean government issued multi-agency de-identification guidelines in 2016. The guidelines rely heavily on the statistical concept of “k-anonymity.” In the context of academic discourse distinguishing between rules and standards, the adoption of k-anonymity can be identified with the adoption of a rule. By analogy, employing the concept of k-anonymity is akin to imposing the same speed limit in all cases, regardless of road conditions such as the traffic situation, time, and number of lanes. On the other hand, a standard would demand that drivers drive at a reasonable speed. As such, while a rule is simpler and easier to follow, a standard could be adapted to suit diverse circumstances. This article suggests that Korea needs to adopt a risk-based approach for de-identifying personal information and argues that a risk-based approach would be predicated upon providing a suitable standard, not a rule.
참고문헌 (22)
- Haksoo Ko, "Methodology for de-identification of personal information-with a focus on health big data", 48~56 (2017)
- "Health Insurance Guide - Health Checkup"[URL]
- (2016)[URL]
- 박노형, "빅데이터 분석기술 활성화를 위한 개인정보보호법의 개선 방안 - EU GDPR과의 비교 분석을 중심으로 -", 고려법학, (85), pp.1~39 (2017), 법학연구원
- Haksoo Ko, "Structure and Enforcement of Data Privacy Law in South Korea", Int’l Data Privacy L, 7, pp.100~ (2017)
- Institute of Medicine of the National Academies, "Beyond the HIPAA Privacy Rule— Enhancing Privacy, Improving Health Through Research", 230~ (2009)
- Daniel J. Solove, "Information Privacy Law", pp.593~594 (2011)
- Khaled El Emam, "Guide to the De-identification of Personal Health Information", 16~18 (2013)
- "PIPA Article 2", ~
- "Laws and Policies, Personal Data Protection Laws in Korea"[URL]
- Office for Government Policy Coordination, "The Guidelines for De-identification of Personal Data—Guide for De-Identification Standards and Support", Management System, 2016, pp.7~
- OECD, "Health Data Governance", 67~ (2015)
- Louis Kaplow, "Rules Versus Standards: An Economic Analysis", Duke L. J, 42, pp.557~ (1992)
- Robert Cooter, "Law & Economics", pp.222~ (2012)
- Richard Posner, "Regulation Vs. Litigation—Perspectives from Economics and Law" (2011)
- Kathleen M. Sullivan, "The Justices of Rules and Standards", Harv. L. Rev, 106, pp.22~62 (1992)
- Khaled El Emam, "Anonymizing Health Data" (2014)
- Khaled El Emam, "Policy Issues surrounding Artificial Intelligence Algorithms & Privacy: Principles of Risk Based Anonymization of Health Data", 4~7 (2017)
- "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA)Privacy Rule, Health Information Privacy"[URL]
- OCR, "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portabi lity and Accountabi lity Act (HIPAA) Privacy Rule", 12~ (2012)