캘리포니아 소비자 프라이버시법(CCPA)에 대한 비교법적 연구

Abstract

California Consumer Privacy Act (CPA), effective from January 1, 2020, is the first general law on personal information protection across the U.S. federal and states to ensure Californians’ constitutional rights to privacy. The CCPA has significant meaning in that it has specifically declared the rights of consumers in relation to their personal information protection and has also provided specific means for enforcing law. However, the regulation on personal information is likely to be recognized as the concern requiring national uniformity treatment by Dormant Commerce Clause Doctrine, so Congress might try to preempt the CCPA by enacting federal laws. Someone could challenge the CCPA contending it violates the Freedom of Commercial Speech guaranteed by the First Amendment. Unlike our personal information protection law which is based on human dignity, the CCPA is based on a contractual relationship. Therefore, the CCPA does not recognize the consent requirements for collecting personal information and the right to rectification by consumer, also narrowly recognizes the personal information that is subject to deletion. On the other hand, the scope of personal information is wider and more specific than our personal information protection law, and the exceptions to personal information deletion are widely recognized. Thus, the CCPA takes a pragmatic approach to protect consumers’ personal information while trying not to undermine the data utilization of each company. We need to consider these characteristics of the CCPA. In this regard, the recent amendment of the Personal Information Protection Act for promoting the data use in the secure manner is significant. Finally, although companies should prepare for compliance of the CCPA, it is unlikely that the CCPA will cause any material disruption for the IT industry business.