The Limitations on the Use of Big Data Pursuant to Data Privacy Regulations in Korea

Abstract

This study provides an overview of the current big data industry and regulatory parameters in Korea. It also makes policy and legislative recommendations for stimulating the big data industry, while preserving a balance between industry growth and the privacy of data subjects. For this purpose, we begin by reviewing privacy legislations from the European Union, the United States, and Japan. We also present domestic and overseas data breach cases. Further, we study relevant Korean court precedents and Korean privacy legislations to pinpoint obstacles to the promotion of big data under the current legislative regime. South Korea’s thorough privacy protection regulations essentially rival those of Europe. As of 2017, key privacy policy legislations applicable in Korea are given under the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilisation and Information Protection, etc., and the Act on the Use and Protection of Credit Information, etc. Because Korean privacy legislations define “identifiability” vaguely, businesses that employ big data technology face uncertainty about how to comply with various statutes and regulations, and this uncertainty restricts their production and use of big data. Korean privacy legislations generally require personal information processors to acquire opt-in consents from data subjects to collect, use, and give third parties personal information. As a result, acquiring advance opt-in consents is necessary to generate big data from information that contains personal information. Legislative direction that stimulates the big data industry must strike a fine balance between the constitutional rights to privacy and consumers’ rights (i.e., the data subject of collected personal information) and the property rights of companies that own such information (i.e., big data companies). On the one hand, legislative changes extracting one-sided concessions from individuals about their privacy will likely be met with public resistance. On the other hand, continuing with laws that hamper the growth of the big data industry will undoubtedly sideline Korea from the fourth industrial revolution. Hence, scholars, legislators, and legal professionals must explore comprehensive measures that reconcile these two perspectives.