개인정보보호법의 개인정보 활용 기준에 대한 법적 고찰

Abstract

There is a practical distinction between the entrustment of personal information processing and provision of personal information whether the consent of the data subject is required and who supervises the data processing. Court considers the concept of entrustment - third-party processing of personal information is related to the purpose of collecting and using personal information. It is required that the entrusted party does not derive independent benefits beyond the processing of entrusted tasks. However, if the benefit to the personal information controller from the third-party processing of personal information is related to the purpose of collecting and using personal information, then even if the third party obtains benefits other than personal information processing, it should be considered as an incidental benefit derived from personal information processing. In cases where the distinction is ambiguous, the predictability or potential intent of the data subject can be used as a supplementary criterion. This is established through the agreement between the data subject and the personal information controller. Even if the data subject is unaware, it relies on presumed intent regarding actions taken if data subject had known. Entrustment of processing of personal information aims at professional and stable processing of personal information. It is required to amend the law to differentiate the supervisory duty of the personal information controller according to the type of entrusting personal information processing.