개인정보의 제3자 제공과 처리위탁간의 명확성에 대한 연구

Abstract

The Personal Information Protection Act was revised in 2020 to introduce the use of pseudonym information, and to ease the "principle of informed consent," a major principle for collecting and using personal information, through the revision in 2023. Some modifications were made regarding the provision of personal information to third parties and the entrustment of processing, particularly introducing regulations on the re-entrustment of personal data processing tasks. However, since the collection and use of personal information and the provision of personal information to third parties are essentially different, it should focus on ensuring system consistency rather than modifying the content of the current regulations. It is not desirable to stipulate the entrustment of personal data processing as an exception to the provision of personal information to a third party, as in Japan's Personal Information Protection Act, given that it distinguishes both. The EU distinguishes between the two based on whether the consent of the data subject is required, but this approach has the disadvantage that it is difficult to regulate differently for each stage of use of personal information. Regulations on provision personal information to third parties and the entrustment of personal data processing should remain separate as they are now, but alternative proposals are provided to ensure system consistency. First, when regulating the provision of personal information to third parties, it should be based on the principle of providing it with the consent of the data subject, with non-consensual provision being an exception. Second, it should be stipulated that the provision of pseudonymous data also requires the consent of the data subject, considering that pseudonymous data is one of the types of personal information. Third, since the collection and use of personal information and the consent of providing personal information to a third party are similar, the accessibility of the law should be increased through the integration of similar provisions. Finally, the regulations regarding entrusting personal data processing, currently found in the section on "Restrictions on Processing Personal Information," should be relocated to the section concerning the "Collection, Use, and Provision of Personal Information.