개인정보의 개념의 차등화와 개인정보이동권의 대상에 관한 연구

Abstract

With the development of technologies utilizing the 4th industry, such as big data and artificial intelligence (AI), operators can easily collect personal information, process it, and use it. Various products are released. However, the current law focuses on protection rather than use of personal information, focusing on various obligations and requirements when processing personal information, including consent. In particular, by using a single concept of 'personal information' as a unit of law application, it is not clear to what extent the scope of information subject to obligations from the operator's point of view. It has become a reason for limiting the use of personal information. Despite the different types of information and costs and manpower for regulatory compliance, interpreting all subjects of regulation equally imposes an excessive burden on the operator or imposes a duty that cannot be implemented. Therefore, it is necessary to discuss the necessity of differentiating the concept of personal information. To this end, it is necessary to first look at the ambiguity of the concept of personal information and see if it is possible to interpret the scope of the same concept of personal information within the same legislation. In addition, it is necessary to classify personal information by type in order to limit the scope of application of personal information regulation to a reasonable range. In particular, it is necessary to classify personal information in accordance with identification or identifiability criteria, which are key factors that obscure and broaden the concept of personal information. Personal identification information that is combined with personally identifiable information and personal identification information that is not combined with personally identifiable information can be distinguished in addition to personal identification information and non personal identification information In addition, the criteria may be whether the information provided by the operator, the information generated and processed by the operator, the operator's internal purpose, or the external purpose Based on this classification, it is necessary to see how appropriate the level of personal information protection is through a standard for balancing conflicting interests between personal information self-determination rights and freedom of operation for each regulation. The same applies to the right to data portability Personally identifiable information that is not combined with personal identification information, i.e., information that is attributed to one person, if the identifiability is maintained only to the extent that the information can be attributed to a specific person whose identity is unknown and information scattered so that it is difficult to attribute to specific person, should be excluded from the provision. In addition, information created by personal information processor such as work evaluation and credit evaluation should not be provided as long as it is used internally. As attempts to rationalize the scope of regulations related to personal information are accumulated and legislation and governmental interpretations are developed, the rights of both service providers and users should be adequately defended, and a regulatory environment suitable for the future ICT new industries should be established.