블록체인과 개인정보 규제 합리화 방안 검토
A Study on Rationalization of Personal Information Regulation in Block Chain Technology and Services
0
조회
0
다운로드
11
인용
0
참고문헌
키워드
초록
개인정보에 대한 권리는 절대적 권리가 아니며, 비례성 원칙에 부합하도록 다른기본권들과도 조화되어야 한다. 특히 개인정보 보호제도는 혁신적 기술에 장애가 되고자 고안된 제도는 아니다. 이러한 관점에서 본 연구는 최근 이슈가 되고 있는 블록체인 기술 및 서비스를 둘러싼 개인정보 규제 쟁점을 검토하고 그 개선방안을 모색해 보았다. 블록체인의 거래정보는 그 자체만으로는 개인의 식별이 곤란하다 할지라도 현행법상의 식별가능성의 판단에 비추어 볼 때 개인정보에 해당될 수 있다. 따라서 블록체인 서비스에 있어서 ‘거래정보’의 처리가 법 위반이 되지 않도록 ‘가명정보’ 의 이용근거 마련, 이에 상응하는 ‘재식별 금지’ 규정의 도입 등이 필요하다. 또한 ‘퍼미션리스(permissionless) 블록체인’의 경우 거래의 참여자가 개인정보처리자에 해당될 수 있으나 그 수가 무제한이므로 실질적으로 개인정보처리자에게 규범준수를 강제하도록 설계하는 것이 곤란하다. 결국 블록체인 시스템 운영자(사업자)에게 일정한 책임을 부여하는 입법의 가능성이 있다. 이러한 경우 면책요건도 함께 규정하여블록체인 시스템 운영자의 부담을 경감시킬 필요가 있다. 한편 블록체인의 기술적특성에 비추어 볼 때 현행법상 ‘적법한 동의’의 요건을 충족하는 것은 상당히 곤란하다. 안정적 서비스가 가능하도록 현행법상 ‘ 동의’ 규정의 개선이 필요하다. ‘블록체인’은 많은 영역에 새로운 가치와 서비스를 제공할 수 있고 이로부터 많은 혜택을 얻을 수 있다. 이러한 혜택에 개인정보 규제가 걸림돌이 되어서는 안 될 것이다.
Abstract
The right to personal information is not an absolute right, and it must be harmonized with other fundamental rights to conform to the principle of proportionality. Especially, personal information protection system is not designed to be a hindrance to innovative technology. From this point of view, this study examined the issue of regulation of personal information about the block chain technology and service which is becoming a recent issue and searched for improvement plan. The transaction information of the block chain can be regarded as personal information in the light of the judgment of the identifiability in the current law even if it is difficult to identify the individual by itself. Therefore, it is necessary to establish the basis of the use of ‘pseudonymized information’ in order to prevent the processing of ‘transaction information’ in the block chain service from violating the law, and to adopt the corresponding prohibition of re-identification. Also, in the case of ‘permissionless block chain’, the participant of the transaction may correspond to the personal information processor, but since the number is unlimited, it is difficult to actually design the personal information processor to comply with the norm. In the end, there is a possibility of legislation that gives the block chain system operator a certain responsibility. In such a case, it is necessary to alleviate the burden on the block chain system operator by stipulating the requirements for exemption of liability. On the other hand, in view of the technical characteristics of the block chain, it is very difficult to meet the requirements of “legitimate agreement” under the current law. In order to provide stable service of the block chain, it is necessary to improve the ‘agreement’ regulation in the current law. ‘Block Chain’ can provide new value and service in many areas, and our society, including users, can benefit from it. These benefits should not hinder the regulation of personal information.
참고문헌 (44)
- 김민호, "공공부문 개인정보보호법제의 현황과 과제", 토지공법연구, 37(1), pp.207~224 (2007), 한국토지공법학회
- 김민호, "개인정보처리자에 관한 연구", 성균관법학, 26(4), pp.241~266 (2014), 법학연구원[DOI]
- 김일환, "個人情報保護機構 法制整備의 原則과 方向에 관한 公法體系的 考察", 토지공법연구, 36, pp.255~280 (2007), 한국토지공법학회
- 김제완, "블록체인 기술의 계약법 적용상의 쟁점 - ‘스마트계약(Smart Contract)’을 중심으로 -", 법조, 67(1), pp.150~200 (2018), 법조협회[DOI]
- 김현경, "개인정보보호제도의 본질과 보호법익의 재검토", 성균관법학, 26(4), pp.267~297 (2014), 법학연구원[DOI]
- 김현경, "기술혁신환경에서 프라이버시와 공권력의 충돌과 조화", 가천법학, 9(3), pp.81~124 (2016), 법학연구소
- 성승제, "블록체인 활성화의 법적 과제 -소극 규제론-", 기업법연구, 31(2), pp.325~352 (2017), 한국기업법학회[DOI]
- 유승언, "블록체인에 기반한 합의 알고리즘", 한국컴퓨터정보학회 학술발표논문집, 26(1) (2018), 한국컴퓨터정보학회
- 개인정보 국외이전 관련 국내 현황 분석 및 대응 방안, "이병준", 한국인터넷진흥원, ~ (2016)
- Amuial, S., "The Blockchain: A Guide for Legal & Business Professionals" (2016), Legal Works
- ENISA., "Distributed Ledger Technology & Cybersecurity- improving information security in the financial sector", ENISA(European Union Agency for Network and Information Security), 15, pp.21~ (2016)
- Reid, F., "An analysis of anonymity in the bitcoin system" (2013), Springer Link
- Borgesius, F. J. Z., "Singling out people without knowing their names – Behavioural targeting, pseudonymous data, and the new Data Protection Regulation", Computer law & Security review, 9 (2016)
- De Filippi, P., "The interplay between decentralization and privacy: The case of blockchain technologies", Journal of Peer Production, 7 (2016), Alternative Internets
- El Khourya, A., "Dynamic IP Addresses Can Be Personal Data, Sometimes. A Story of Binary Relations and Schrodinger’s Cat", European Journal of Risk Regulation, 8(1) (2017)
- Esayas, S. Y., "The role of anonymisation and pseudonymisation under the EU data privacy rules: beyond the ‘all or nothing’ approach", European Journal of Law and Technology, 6(2) (2015)
- Levy, K., "Book-Smart, Not Street-Smart: Blockchain-Based Smart Contracts and The Social Workings of Law", Engaging Science, Technology, and Society, 2017(3) (2017)
- Matthias, B., "Blockchain Technology and the GDPR - How to Reconcile Privacy and Distributed Ledgers", European Data Protection Law Review, 2 (2016)
- Narayanan, A., "Bitcoin and Cryptocurrency Technologies, A Comprehensive Introduction" (2016), Princeton University Press
- Salmensuu, C., "The General Data Protection Regulation and the Blockchains", Liikejuridiikka, 2018(1), pp.10~ (2018)
- Contract Law 2.0: «Smart» Contracts As the Beginning of te End of Classic Contract Law, "Savelyev, A.", 15~, pp.Higher School of Economics Research Paper. No. WP BRP71 (2016), LAW[DOI]
- Spindler, G., "Personal Data and Encryption in the European General Data Protection Regulation", JIPITEC, 2016(7), pp.14~ (2016)
- Stalla-Bourdillon, S., "Anonymous Data v. Personal Data- A False Debate: An EU Perspective on Anonymization, Pseudonymization and Personal Data", Wisconsin International Law Journal, 34(2) (2017)
- Wright, A., "Decentralized Blockchain Technology and the Rise of Lex Cryptographia", SSRN Electronic Journal, 21 (2015)
- Zetzsche, D., "The distributed liability of distributed ledgers:Legal risks of blockchain", University of Illinois Law Review (2017)
- Zyskind, G., "Decentralizing Privacy : Using Blockchain to Protect Personal Data", 2015 IEEE CS Security and Privacy Workshop (2015)
- General Data Protection Regulation, "2016", 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95, EC, 2016[DOI]
- "Regulation (EU) No 910", 2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999, EC[DOI]
- "Article 29 Working Party 2007 on the concept of personal data, WP 136", ~
- "Article 29 Working Party 2014 on the Anonymisation Techniques, WP 216", ~
- "Article 29 Working Party, ‘Opinion 05", 2012 on Cloud Computing’ WP 196
- "Article 29 Working Party, ‘Opinion 04", 2014 on surveillance of electronic communications for intelligence and national security purposes’ WP 215
- "Article 29 Working Party, ‘Opinion 01", 2010 on the concepts of “controller” and “processor”’ Article 29 Working Party ‘Opinion 2016 on Guidelines on the right to data portability”
- Enisa Report 2016 Distributed Ledger Technology, , Ledger Technology & Cybersecurity- improving information security in the financial sector, ~
- Enisa Report 2015 on Privacy by design in big data, An overview of privacy enhancing technologies in the era of big data analytics, , ~