소비자데이터 주권 강화와 관련한 최근 입법동향과 향후 과제 - 2023년 「개인정보 보호법」 개정을 중심으로 -

Abstract

After the end of the COVID-19 pandemic, our transaction environment has rapidly transitioned to non-face-to-face interactions. In this context, digital consumer policy should focus on strengthening consumer data sovereignty. In this regard, our 「Personal Information Protection Act」 has recently been amended. This paper reviews the recent amendments to the 「Personal Information Protection Act」 from the perspective of enhancing consumer data sovereignty, based on the content of the 2023 amendment, and examines what the desirable legal and policy challenges should be moving forward. The 2023 amendment to the 「Personal Information Protection Act」 includes ① the data subject's Request for Transmission of Personal Information, ② the data subject's right to refuse decisions made using artificial intelligence and the right to demand explanations, and ③ the introduction of the Submission of Data order system. These amendments are generally evaluated positively. However, the regulation of non-personal information, such as Cookies, is not only a global trend but also necessary. Behavioral information may not be personal information but has the potential to become personal information in the future, making it difficult to regulate adequately under current laws. This difficulty arises because, at the time of collection, it is hard for consumers to recognize or sufficiently anticipate this. Therefore, like Japan, we should establish regulations at the legal level for behavioral information, initially defining it as non-personal but related information and regulating it only in exceptional cases. In the long term, like the EU, we should comprehensively classify it as a type of personal information, with exceptions being unregulated.