위치정보법의 규제 및 개선방안에 관한 연구

Abstract

Act on the Protection and Use of Location data intends to protect location data of ananonymized individual and a mobile object, as well as identifiable personal location data. In this regard, the Act provides that consent of data subjects should be obtained when collecting and using location information and technical and administrative measures should be taken, for all of the location informations of people and objects, regardless whether the information is about a person or an object and the person is identified or not. Further, the Act gives criminal punishment to anyone who collects, uses or provides personal location data (except for location data of objects) without obtaining the consent of the person, or fails to take technical and administrative measures. The purpose of this Act is to protect privacy against the leak, abuse and misuse of location data (refer to Article 1), thus, legal protections for simple location data not belonging to personal data should be carefully decided upon. Particularly, considering that Data Protection Act declares principle of anonymization of data processing (refer to Clause 8 of Article 3), regulating the anonymized location data at a similar level to the personal location data may make the service providers(data controllers) lose a cause for anonymization, thereby rather running counter to protection of privacy. With regard to location data of a object, in a specific case,if it is related to infringement against protection of privacy, it should be regarded aspersonal location data, meanwhile, if it is merely to trace its movement, it should be dealt with as a contract with owner or a tort, on a case-by-case basis. One of the major tasks of Korean Acts for data protection, including Act on the Protection and Use of Location data, is about determining of the scope of the personal data and the matter of consent of data subjects. The scope of the personal data and the personal location data is comprehensive, because the personal data under the acts is defined as including the information that can be easily combined with other information to identify a certain person. Therefore, when imposing legal sanction such as criminal punishment or a fine, there is a great risk that principle of definiteness may be violated. With regard to the concept of ‘easily combined’, it does matter what the probability is that a data controller obtains other information to be combined. For this, considering contractual relationship, information system connectional relationship, and so on, the realistic and substantial possibility that the data controller gets other information should be thoroughly examined. Meanwhile, with regard to the consent of data subjects, particularly the time and the manner of the consent has become an issue. However, considering that opt-in is obtained perfunctorily in practice, it seems to be needed to permit consents in the manner of notification and opt-out, similarly to legislation of other countries, although opt-in is required under Korean Acts for data protection. Further, the legislations, systems and technical studies should proceed toward allowing the data subject to control the accuracy level of the location data for oneself, considering that the location data is sensitive information. The Act on the Protection and Use of Location data stood on the basis of the station-based mobile communication in the age of the feature phone, the cargo contro system, and so on. However, recently a smart mobile system using WIFI and GPS on smart phone and tablet is developed, thereby problems of the procedural regulation which was unforeseeable at the time when the Act was established are arising. Particular examples are given as follows: obligation to immediately notify the data subject each time, obligation to specify service agreement in mobile advertisements, the manner of obtaining consent, permission/report system for the location-based service providers. Governmental supervision for the service providers and strict regulations on the location data were highly regarded in the days when the Act was established, but now, the validity of those procedural regulations is contestable in view of personal data protection.