정보보호인증제도의 확대에 관한 연구

Abstract

The information security is essential in the information society. Methods of information protection are divided into damage prevention measures and relief measures. To remedy damages, it was introduced systems of conversion of proving liability and punitive damages in the Personal Information Protection Act. However, a prevention is more important than a relief. Therefore, a personal information manager should bear a variety of duties to protect personal informations according to the Personal Information Protection Act and Act on Promotion of Utilization of Information and Communication Network. In particular, both Act introduced personal informations certification systems(PIMS : Personal Information Management System, ISMS : Information Security Management System). With respect to a person who established and is operating a comprehensive management system including administrative, technical and physical protective measures in order to systematically and continuously perform the activities for protection of personal information in the information and communications network, the Korea Communications Commission may certify as to whether the management system meets the standards pursuant to paragraph (2). With respect to the person who has established and operates a comprehensive management system, including administrative and technical protective measures, for securing stability and reliability of an information and communications network, the Minister of Science, ICT and Future Planning may certify as to whether he/she meets the standards pursuant to paragraph (3). But both systems are not sufficient to protect personal informations. Thus, both systems should be improved, the improvements are as follows. First, the law governing personal informations certification systems entirely must be enacted. Second, the certification should be mandatory and certification authorities shall be extended. Third, the certification standards should be established for the sector. Fourth, It should be a continuous check on the compliance with certification standards. Finally, administrative regulations should be strengthened.