개인정보 관련 평가ㆍ인증의 비교법적 고찰

Abstract

Nowadays personal information protection has become increasingly important to our sense of information privacy. Therefore have been made the legislative efforts to enact Information Privacy Act and developed PETs(Privacy Enhancing Technologies). From the viewpoint of preventive measures to guarantee the information privacy, the PIA(Privacy Impact Assessment) is designed as one of those systematic schemes. The PIA is a tool in aspect of precautionary principle to ensure that new or modified electronic collections of information on individuals are evaluated for privacy risks and that appropriate personal information protection measures are in place. As the PIA means a systematic process to review the impact on information privacy by prediction and research on the induction of a new information system and collection of personal information on planning ahead, building a system to operate in advance, it could be stated that certification system including ISO/IEC 27001 would have a similar effect in comparison as the PIA with conducting a precautionary means to guarantee a certain security of information system by submitting the results of evaluation influential to information privacy. Such is the same as ISMS(Information Security Management System) and safety diagnosis ruled by the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. Consequently, this article reaches the conclusion that the PIA must be pursuant to certification and so target, executing criteria, methods, and procedures of evaluation would be equivalent to key points of PIA.