본문 바로가기
KERD
논문KCI 등재

Legal Concerns of Financial Institutions in the Big Data Era - The Use of De - Identified Personal Information without Prior Consent under the Korean Privacy Laws -

조혜찬
한국정보법학회 (Korea Association For Info-Media Law(Kafil))|2016.12|정보법학 (Journal of Korea Infomation Law)|제20권 제3호|pp. 221-258

2

조회

0

다운로드

0

인용

0

참고문헌

키워드

개인정보보호법빅데이터개인정보은행Big DataPersonal Information금융기관BankAnonymization사전동의신용카드사Financial Institutions비식별화De-identification익명화Insurance Company보험사Credit Card CompanyPrior ConsentKorean Personal Information Protection Act (PIPA)
주제분류법학

초록

The importance of big data as a new source of industry development is rapidly on the rise globally. Commonly referred to as being in the “Big Data Era,” business analysts observe that big data will create new value both in public and private sectors. Empirical research shows that the financial industry will perhaps benefit the most from big data capabilities by utilizing large amount of personal information. Korea begins putting a significant value on big data potentials. Korean financial institutions have necessarily demanded deregulation of utilizing personal information to fully take advantage of big data systems for their businesses. Likewise, the Korean government wants to promote a favorable environment for big data utilization. One tangible effort is to relax the regulatory burdens as shown in Big Data Personal Information Protection Guideline (“Big Data Guideline”) published by a governmental authority, the Korea Communications Commission. According to the guideline, personal information managers can collect, use and transfer publicly available information and customer’s usage history information without prior consent if the information is de-identified. However, Korean regulatory agencies are rather cautious of allowing personal information utilization by virtue of big data because they experienced a series of high profile and serious personal information leakage incidents by big corporations in recent times. The Korean Personal Information Protection Act (“PIPA”), known as one of the far-reaching and austere personal information protection laws in the world, is a byproduct of this heightened concern. PIPA strictly requires prior informed consent when a person collects or utilizes other person’s personal information. With the backdrop of this arguably tense atmosphere in Korea, this thesis will attempt to deal with the relevant legal issues surrounding financial institutions’ use of publicly available information and usage history information without prior consent. First, it is posited that it is too risky for financial institutions to solely rely on the Big Data Guideline because it is an administrative rule, lacking relevant statutory basis. Second, de-identification as a sole prerequisite to consent exemption is a vulnerable method. Information profiling enables re-identification of once de-identified personal information, and thus the re-identified information should be subject to PIPA’s prior consent requirement. Especially, much of usage history information is sensitive information where PIPA adds extra caution. Third, taking publicly available personal information for profit is against the Constitutional right of self-determination on personal information. In order to fully appreciate the merits of big data but minimizing infringement of personal information rights, this thesis delivers two possible suggestions. First, PIPA should be amended with possibly three options to relieve or relax the current statutory regulation. The administrative rule alone, possibly conflicting with PIPA, falls short of truly encouraging financial institutions to benefit the value of big data given the reality of harsh potential penalties under PIPA. Secondly, anonymization should be adopted instead of de-identification as a pre-condition to allow personal information utilization without prior consent as UK, EU and Japan.

Abstract

The importance of big data as a new source of industry development is rapidly on the rise globally. Commonly referred to as being in the “Big Data Era,” business analysts observe that big data will create new value both in public and private sectors. Empirical research shows that the financial industry will perhaps benefit the most from big data capabilities by utilizing large amount of personal information. Korea begins putting a significant value on big data potentials. Korean financial institutions have necessarily demanded deregulation of utilizing personal information to fully take advantage of big data systems for their businesses. Likewise, the Korean government wants to promote a favorable environment for big data utilization. One tangible effort is to relax the regulatory burdens as shown in Big Data Personal Information Protection Guideline (“Big Data Guideline”) published by a governmental authority, the Korea Communications Commission. According to the guideline, personal information managers can collect, use and transfer publicly available information and customer’s usage history information without prior consent if the information is de-identified. However, Korean regulatory agencies are rather cautious of allowing personal information utilization by virtue of big data because they experienced a series of high profile and serious personal information leakage incidents by big corporations in recent times. The Korean Personal Information Protection Act (“PIPA”), known as one of the far-reaching and austere personal information protection laws in the world, is a byproduct of this heightened concern. PIPA strictly requires prior informed consent when a person collects or utilizes other person’s personal information. With the backdrop of this arguably tense atmosphere in Korea, this thesis will attempt to deal with the relevant legal issues surrounding financial institutions’ use of publicly available information and usage history information without prior consent. First, it is posited that it is too risky for financial institutions to solely rely on the Big Data Guideline because it is an administrative rule, lacking relevant statutory basis. Second, de-identification as a sole prerequisite to consent exemption is a vulnerable method. Information profiling enables re-identification of once de-identified personal information, and thus the re-identified information should be subject to PIPA’s prior consent requirement. Especially, much of usage history information is sensitive information where PIPA adds extra caution. Third, taking publicly available personal information for profit is against the Constitutional right of self-determination on personal information. In order to fully appreciate the merits of big data but minimizing infringement of personal information rights, this thesis delivers two possible suggestions. First, PIPA should be amended with possibly three options to relieve or relax the current statutory regulation. The administrative rule alone, possibly conflicting with PIPA, falls short of truly encouraging financial institutions to benefit the value of big data given the reality of harsh potential penalties under PIPA. Secondly, anonymization should be adopted instead of de-identification as a pre-condition to allow personal information utilization without prior consent as UK, EU and Japan.

참고문헌 (79)

  1. "Personal Information Protection Act, Act No. 10465, Mar. 29, 2011, art. 15(1), amended by Act No. 13423 July 24, 2015", ~ (2015)
  2. "Commercial Law, Act No. 1000, Jan. 20, 1962, art. 638, amended by Act No. 12397, Mar. 11, 2014", ~ (2014)
  3. "Use and Protection of Credit Information Act, Act No. 4866", ~ (1995)
  4. "Promotion of Information and Communications Network Utilization Act, Act No. 3848", ~ (1986)
  5. "Enforcement Decrees to Personal Information Protection Act, Presidential Decree No.26140, Mar. 11, 2015, art. 17, as amended", ~ (2015)
  6. "Personal Information Protection Act, Act No. 10465, Mar. 29, 2011, art. 24-2, amended by Act No. 11690 Aug. 6, 2013", ~ (2013)
  7. "Enforcement Rules to Legislation, Act No. 671, Dec. 31, 1997, art. 2 amended by Act No. 1005, Jan. 22, 2013", ~ (2013)
  8. "5 U.S.C § 706", ~
  9. National Information Society Agency, "De-identification of Personal Information Estimation Guide", ~ (2014)
  10. "Criminal Act, Act No. 293, Sept. 18, 1953, art 307(2), amended by Act No. 12898, Dec. 30, 2014", ~ (2014)
  11. "15 U.S.C § 1681", ~
  12. "12 CFR 222.20(b)(3)", ~
  13. "5 U.S.C. 552a", ~
  14. "Right to Financial Privacy Act, 12 U.S.C. 3401-22", ~ (1994)
  15. "Fair Credit Reporting Act, 15 U.S.C. 1681-81t", ~ (1994)
  16. "Telemarketing Protections Act, 47 U.S.C. 227", ~ (1994)
  17. "UK Data Protection Act 1998", ~
  18. "Personal Information Protection Act No. 57 of 2003", ~
  19. "Japanese Amended Act on the Protection of Personal Information", ~
  20. "Constitutional Court, 99Hun-Ma513", ~ (2005)
  21. "Seoul District Court, 2013Na49885", ~ (2014)
  22. "Supreme Court, 2006Da81035", ~ (2009)
  23. "Daejeon District Court, 2013Go-Dan17", ~ (2013)
  24. 손영화, "빅데이터 시대의 개인정보 보호방안", 기업법연구, 28(3), pp.355~393 (2014), 한국기업법학회
  25. Personal Information Protection Commission, "A study on the Scope of Personal Information", 227 (2014)
  26. "Personal Information Protection Act Disturbs Big Data Development" (2015)[URL]
  27. "President Park Said “Big Data Is A New Resource In 21st Century" (2015)[URL]
  28. "De-identified information, big data utilization v. personal information protection" (2015)[URL]
  29. "Leading Foreign Banks" (2015)[URL]
  30. "Relieving Big Data Regulation" (2015)[URL]
  31. 이유재, "KB국민카드의 마케팅 활동과 빅데이터 활용", Korea Business Review, 18(1), pp.145~176 (2014), 한국경영학회
  32. Taeeon Koo, "Various Issues of Personal Information Protection Act", Seoul Nat’l Univ. L. Rev, 3, pp.66~67 (2012)
  33. 이선영, "개인정보 수집 및 활용 동의서에 대한 이용자 인식 분석 및 대응 정책에 대한 연구", 한국정보기술학회논문지, 12(08), pp.85~92 (2014), 한국정보기술학회[DOI]
  34. "The Result of Awareness of Personal Information Protection" (2015)[URL]
  35. 이인곤, "개인정보 보호법의 문제점과 실효성 확보방안에 관한 연구", 법이론실무연구, 2(2), pp.183~209 (2014), 사단법인 한국법이론실무학회
  36. 손형섭, "개인정보 보호법의 특징과 앞으로의 방향 ― 업계의 반응에 대한 몇 가지 대안을 중심으로 ―", 언론과 법, 11(1), pp.93~123 (2012), (사)한국언론법학회[DOI]
  37. "Banning Collection of Resident Registration Numbers But Over 400 Exceptions" (2015)[URL]
  38. Boram Lee, "Financial Institutions Can Use De-identified Financial Information from September", Today Journal (2015)
  39. "Face Is Exposed for AOL Searcher No. 4417749" (2006)[URL]
  40. 전응준, "개인정보보호법률상 형사처벌규정의 적정성에 관한 연구", 정보법학, 17(2), pp.213~237 (2013), 한국정보법학회
  41. "Governmental Network Center Started Big Data Analysis" (2015)[URL]
  42. "Need of Contradictory Policy about New ICT" (2015)[URL]
  43. "Proposal to Development of Big Data Industry" (2015)[URL]
  44. Joe Jones, "Japan Amends Its Data Privacy Law: “Big Data” Comes With New Regulations", Nat’l L. Rev (2015)
  45. "Big Data, Big Impact: New Possibilities for International Development 1" (2012)[URL]
  46. Study in Big Data Utilization and Policy Subject 4, "Korea Chamber of Commerce and Industry", ~ (2014)
  47. "Big Data Personal Information Protection Guideline", ~
  48. Seokho Lee, "Big Data Utilization and Issues in Financial Industry", ~ (2014)
  49. Youngdo Kim, "Big-data Utilization and Scheme", ~ (2015)
  50. Jin-A Bae, "A Study on Measuring the Levels of Perception on Privacy (Protection of Personal Information) by Internet Users and Service Providers", ~ (2011)
  51. Woonseok Kim, "An Overview of New Personal Information Protection Law", ~ (2011)
  52. Hyung-Soo Kim, "Legislation System and Procedure", ~
  53. Haesung Jung, "Statute Interpretation Practices and Cases", ~
  54. Financial Services Commission, "Financial Industry Big Data Revitalization Plan", ~ (2015)
  55. A Study for Settling an Authoritative Interpretation System, "Ministry of Government Legislation", ~ (2006)
  56. National Information Society Agency, "De-identification of Personal Information Estimation Guide", ~ (2014)
  57. Gachon University, "A Study of Legal and Systematic Schemes to Strengthen Personal Information Protection under Big Data", ~ (2012)
  58. "Obama Administration Unveils “Big Data” Initiative: Announces $200 Million in New R&D Investments" (2012)[URL]
  59. "Big Data: Seizing Opportunities, Preserving Values" (2014)[URL]
  60. "Data Protection Working Party, 0829/14/EN WP216, Opinion 05/2014 on Anonymisation Techniques, art. 24"[URL]
  61. Information Commissioner’s Office, "Anonymisation: managing data protection risk code of practice", ~ (2012)
  62. Global Agenda Council on Emerging Technologies, "The top 10 emerging technologies for 2012", World Economic Forum (2012)
  63. "Korea National Information Society Agency"[URL]
  64. "Your Rights to Financial Privacy"[URL]
  65. "Kookmin Bank"[URL]
  66. "Prudential Insurance"[URL]
  67. "Samsung Fire"[URL]
  68. "Samsung Life Insurance"[URL]
  69. "Ace Insurance"[URL]
  70. "Shinhan Card"[URL]
  71. "Kookmin Card"[URL]
  72. "Hyundai Card"[URL]
  73. "Woori Bank"[URL]
  74. "Shinhan Bank"[URL]
  75. "Standard Chartered"[URL]
  76. "ICO publishes code of practice for anonymizing data" (2012)[URL]
  77. "Opinion for a legislation about De-identification" (2015)[URL]
  78. "New amendments to data protection law in Japan" (2015)[URL]
  79. "Anonymization: The UK Response to Big Data" (2012)[URL]

관련 논문AI추천

The Limitations on the Use of Big Data Pursuant to Data Privacy Regulations in Korea김세진, 손도일, 최정열아시아태평양법연구소 · Journal of Korean Law2017 · 제17권 제1호개인정보보호법제 관점에서 본 빅데이터의 활용과 보호 방안이창범법학연구원 · 법학논총2013 · 제37권 제1호기업의 빅데이터(Big Data) 활용과 개인정보의 보호의 조화곽관훈법학연구소 · 일감법학2014 · 제27호Protecting and Utilizing Health and Medical Big Data: Policy Perspectives from Korea고학수, 박미정, 이동진대한의료정보학회 · Healthcare Informatics Research2019 · 제25권 제4호빅데이터와 개인정보최경진법학연구원 · 성균관법학2013 · 제25권 제2호빅데이터(Big Data) 환경과 프라이버시의 보호차상육IT와 법연구소 · IT와 법연구2014 · 제8호

이 간행물의 다른 논문 (9건)

후발의약품 진입 후 신약 보험약가 인하와 손실 배분의 정의(正義) - 우리나라 허가특허연계제도 하에서의 해석론과 입법론 -신혜은, 박성민, 정용익pp. 1-42특허권 공동침해법리에 관한 소고전수정, 전성태pp. 43-82인공지능 창작물의 저작권 보호손승우pp. 83-110구 저작권법 제29조 제2항, 제76조의2 및 제83조의2에서 규정하는 ‘판매용 음반’의 개념과 의미박성호pp. 111-140미분배보상금의 활용 방안에 대한 연구최진원pp. 141-171
원문 보기