빅데이터 시대 생성정보의 처리 체계 - 추론된 정보의 처리에 관한 우리 개인정보보호법의 규율과 개선 방안에 관한 고찰 -

Abstract

This paper aims to provide insight on data protection laws in Korea relating to big data, including recommended amendments to the Personal Information Protection Act (“PIPA”) of Korea, by mainly addressing the ‘generation of new information through the convergence of existing information’ from among the various aspects of big data. Specifically, we have analyzed how the current PIPA regulates information created in such manner and have reviewed the propriety of provisions therein when measured against the principle of the right to informational self-determination enshrined in Korea’s Constitution. Based on the foregoing analysis, we provide recommendations for improving any provisions within the PIPA that have been found to be improper. We have referred to the EU’s General Data Protection Regulation (“GDPR”) when conducting our analysis and have decided to use the terms “generative information” or “generated information” to broadly encompass concepts such as observed information and inferred information. The results of our review indicted that the provisions within the PIPA tended to rely on the prior informed consent of data subjects in order to legitimize the generation of inferred information based on personal information or the generation of new knowledge that is not personal information and that exceptions were only recognized in certain limited circumstances. Therefore, it is necessary to provide additional flexibility regarding the severity of punishments under the PIPA based on other legitimate interests without compromising the fundamental principles of the right to informational self-determination. Additionally, we discovered that provisions of the PIPA, in comparison to the EU regime, were inadequate in obligating the full disclosure to data subjects of the actual conditions under which their data is processed. As such, we propose amending relevant provisions therein relating to the provision of notice to data subjects because the regulation of the collection and use of personal information presumes there is a proper understanding of the concepts of “collection” and “use”. In particular, we believe it is recommendable to contemplate imposing legal obligations to provide adequate notice on matters related to inferred information as is the case under the EU regime. However, when determining whether to provide detailed information such as the logic, significance, or results of profiling, etc. to data subjects, it may be necessary to adopt a more measured approach that takes into account the necessity and justification for providing such information and the need to protect the trade secrets of the data handler. Further, the PIPA’s approach towards ensuring the rights of data subjects to control the processing of their data appears to be somewhat rigid. However, in regards to the generation of inferred information, especially the generation of new knowledge that is not personal information, it may not be necessary to recognize the data subject’s right to request the suspension of processing under all circumstances when considering the impact to data subjects, nature and utility of the subject processing, and the degree of restriction of the data handler’s rights and commercial interests. Meanwhile, it may necessary to contemplate the introducing provisions such as those under the GDPR which grant data subjects the right to overturn decisions rendered by automatic methods that may significantly affect the individual and are based on inferred information. This is because data subjects may face situations where they will be unable to comprehend and challenge important decisions that have been rendered through artificial intelligence.