유럽의 “위험 제로(zero risk)접근 방식”에 기반한 데이터 국외 이전 규범에 대한 비판적 검토
A Critical Review of Data Cross-border Transfer Norms Based on Europe’s “Zero Risk Approach”
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
EU-미국 간 프라이버시 실드(Privacy Shield)를 무효로 하는 유럽사법재판소(CJEU)의 슈렘스II 결정 이후 EU 국가의 데이터 감독기구(DPA)들은 GDPR 제5장의 개인정보 국외 이전과 관련하여 ‘위험 제로(zero risk)접근 방식’을 발전시켰다. 즉 유럽 개인정보를 처리하는 기업은 외국 정부가 유럽 데이터에 접근할 수 있는 이론상의 모든 위험을 제거해야 한다는 것이다. 또한 이러한 ‘위험 제로(zero risk)접근 방식’은 강력한 데이터 국지화를 포함하고 있다. 그러나 이러한 위험 제로 접근방식이 보안 친화적이며, 실효적인지에 대하여는 의문이다. 그 이유로 우선 유럽의 데이터 컨트롤러 등은 종종 미국의 인적 관할권의 적용을 받으며, 미국 기업과 동일하게 역외 데이터 접근(생성) 요청에 직면할 수 있다. 또한 해외 정보기관이 데이터에 접근하는 방식은 반드시 기업에 강제적 요청을 통해서만이 아니라 자국의 기술적 수단에 의한 직접 접근 방식을 사용한다. 유럽의 데이터 프로세서들은 미국 등 외국의 인적 관할권에 속하는 것을 회피하더라도 해외 정보기관에 의해 '직접 접근'될 위험이 다분하다. 따라서 유럽에서 CSP에게 요구하는 “위험 제로” 요건의 충족은 궁극적으로 달성할 수 없는 것을 추구하고 있다고 볼 수 있다. 또한 GDPR은 근본적으로 ‘위험 기반 접근 방식’에 기반을 두고 있으며, 이는 궁극적으로 상충되는 헌법적 이익 사이에서 최적의 균형을 이루려는 시도를 의미한다. 따라서 개인정보 국외 이전의 세이프가드는 ‘완벽성’이 아닌 ‘비례성’의 기준에 따라 평가되어야 할 것이다.
Abstract
Following the Schrems II decision of the Court of Justice of the European Union(CJEU) invalidating the EU-US Privacy Shield, EU data supervisory authorities (DPAs) have developed a “zero risk approach” to the international transfer of personal data under Chapter 5 of the GDPR. This means that companies processing European personal data must eliminate all theoretical risk that foreign governments will be able to access European data. This “zero risk approach” also includes strong data localization. However, it is questionable whether this “zero risk approach” is security-friendly and effective. First of all, European data controllers are often subject to US personal jurisdiction and may face overseas data access (production) requests in the same way as US companies. In addition, foreign intelligence agencies do not necessarily access data through compulsory requests to companies, but rather through direct access by domestic technical means. Even if European data processors avoid being subject to foreign personal jurisdictions such as the United States, they may be at increased risk of being “directly accessed” by foreign intelligence agencies. Therefore, the “zero risk” requirement that Europe demands of CSPs can be seen as pursuing something that is ultimately unattainable. Furthermore, the GDPR is fundamentally based on a “risk-based approach,” which means “an attempt to strike the optimal balance between ultimately conflicting constitutional interests.” Therefore, safeguards for the international transfer of personal data should be evaluated according to the standard of “proportionality,” not “perfection.”
참고문헌 (41)
- 김민호, "개인정보의 의미", 성균관법학, 28(4) (2016)
- 김현경, "‘데이터 주권’과 ‘개인정보 국외이전’ 규범 합리화 방안 연구", 성균관법학, 31(4) (2019)
- 김현경, "데이터 속성과 국지화 규범의 법적 쟁점에 대한 고찰", 토지공법연구, 78 (2017)
- 김현수, "소비자보호와 정보주체의 권리 실현 집행체계- 미국 FTC의 사례를 중심으로 -", 개인정보보호법학회 학술제미나 자료집 (2024)
- 박선욱, "미국과 EU의 개인정보보호에 관한 법제 비교분석", 동아법학, (83) (2019)
- "Schrems II Re-Examined" (2020)[URL]
- CIPL, "White Paper - A Path Forward for International Data Transfers under the GDPR after the CJEU Schrems II Decision", ~ (2020)
- Claudia Quelle, "Enhancing compliance under the general data protection regulation: the risky upshot of the accountability-and risk-based approach", European Journal of Risk Regulation (2018)
- Clifford Chance, "The GDPR International Data Transfer Regime: the case for Proportionality and a Risk-Based Approach", Clifford Chance LLP & DLA Piper, ~ (2022)
- D. Felz, "New EU data blockage as German court would ban many cookie management providers", IAPP Privacy Perspectives, ~ (2021)
- Giovanni De Gregorio, "The European Risk-Based Approaches: Connecting Constitutional Dots in the Digital Age", Common Market Law Review, 59(2) (2022)
- Building Resilience? The Cybersecurity, Economic & Trade Impacts of Cloud Immunity Requirements, "Matthias Bauer", ECIPE, ~, pp.ECIPE Policy Brief 01 (2023), 2023
- The Economic Impacts of the Proposed EUCS Exclusionary Requirements: Estimates for EU Member States, "Matthias Bauer", ECIPE Study, ~ (2023)
- Application of the CLOUD Act to EU Entities, "Greenberg Traurig LLP", Ministry of Justice and Security NCSC, ~ (2022)
- Lokke Moerel, "What happened to the Risk Based Approach to Data Transfers? How the EDPB is rewriting the GDPR", FPF, ~ (2022)
- Nigel Cory, "France—and Potentially EU—Cybersecurity Regulations: The Latest Barrier to Data Flows, Digital Trade, and Digital Cooperation Among Likeminded Partners" (2021), CBDF
- Nigel Cory, "France’s “Sovereignty Requirements” for Cybersecurity Services Violate WTO Trade Law and Undermine Transatlantic Digital Trade and Cybersecurity Cooperation", ITIF, ~ (2022)
- Randal Milch, "Cybersecurity and Privacy in a Globalized World - Building Common Approaches" (2019), New York University School of Law
- The Effects of Data Localization on Cybersecurity - Organizational Effects, "Peter Swire", Georgia Tech Scheller College of Business, ~, pp.Georgia Tech Scheller College of Business Research Paper No. 4030905 (2023)
- "Risks to Cybersecurity from Data Localization, Organized by Techniques, Tactics, and Procedures" (2023)[URL]
- Theodore Christakis, "Data, Extra-territoriality and International Solutions to Transatlantic Problems of Access to Digital Evidence - Legal Opinion on the Microsoft Ireland Case (US Supreme Court)", ~ (2017)
- "The White Book: USA v. Microsoft: What Impact, CEIS & The Chertoff Group White Paper" (2017)[URL]
- Theodore Christakis, "European Digital Sovereignty: Successfully Navigating Between the ‘Brussels Effect’ and Europe’s Quest for Strategic Autonomy", pp.2020, MIAI
- "After Schrems II : Uncertainties on the Legal Basis for Data Transfers and Constitutional Implications for Europe" (2020)[URL]
- "The 'Zero Risk' Fallacy: International Data Transfers, Foreign Governments’ Access to Data and the Need for a Risk-Based Approach, CIPL/CBDF Paper Series" (2024)[URL]
- "Information on U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S. Data Transfers after Schrems II", US Government White Paper, ~ (2020)
- CNIL, "Mémoire en Observations, Conseil d’Etat, Referé L, 521-2 CJA", ~ (2020)
- CNIL, "Deliberation No. 2023-084 of 7 September 2023 on a draft decree relating to the organisation and operation of the national platform for combating competition manipulation, section D", ~ (2023)
- EDPB, "Recommendations 02", 2020 on the European Essential Guarantees for surveillance measures, 2020
- EDPB, "Coordinated Enforcement Action, Use of cloud-based services by the public sector", ~ (2023)
- EDPB, "Initial legal assessment of the impact of the US CLOUD Act on the EU legal framework for the protection of personal data and the negotiations of an EU-US Agreement on cross-border access to electronic evidence", ~ (2019)
- "Decision of the European Data Protection Supervisor in complaint case 2020-1013 submitted by Members of the Parliament against the European Parliament" (2020)[URL]
- "Decision of the European Data Protection Supervisor in complaint case 2020-1013 submitted by Members of the Parliament against the European Parliament" (2020)[URL]
- "DPA Decision on D155.027, 2021-0.586.257" (2021)[URL]
- "Décision n° 2024-205 du 13 mars 2024 mettant en demeure la société C8 NOR :RCAC2408029S JORF n°0067 du 20 mars 2024 Texte n° 76"[URL]
- "Microsoft Cloud enables customers to keep all personal data within European Data Boundary" (2024)[URL]
- "Digital Sovereignty at AWS"[URL]
- "Announcing Google Cloud’s new Digital Sovereignty Explorer" (2023)[URL]
- "EU Sovereign Cloud"[URL]
- "Setting a new standard in European data security with Project Clover" (2023)[URL]