EU GDPR상 개인정보보호를 위한 기업의 책임 제도 개선 방안에 대한 고찰

Abstract

Entering the era of the 4th industrial revolution, such as big data, the Internet of Things, artificial intelligence, and cloud computing, the value of personal information of data subjects is constantly increasing. In particular, companies analyzed data in almost real-time through big data analysis architecture, artificial intelligence-based algorithms, and cloud computing. It provides efficiency and insight to each field of society and provides a new engine for the sustainable development of the economy and industry through future prediction. However, it was pointed out that the risk of exposing or exposing sensitive personal information while processing the data of the data subject increases accordingly. Accordingly, the EU enacted and revised general data protection regulations to protect the rights of data subjects to personal information and to strengthen corporate responsibility. Therefore, this paper compares and reviews the EU's system to strengthen corporate responsibility to protect the rights of data subjects and suggests ways to improve Korea's current legal system. As a result, some improvement measures are as follows. First, First, Korea also needs to define it as a segmented personal information controller, not a comprehensive personal information controller. By doing this, I think it is possible to clarify the relationship of responsibility between them. Second, Korea's Personal Information Protection Act, like the GDPR, needs to introduce a personal information protection obligation by design and basic setting. In this way, I think it is possible to thoroughly protect the personal information of the data subject from the design stage. Third, it is necessary to assign a recording obligation according to the number of employees, not the amount of personal information held, in relation to those subject to the recording obligation of personal information processing activities. Finally, for small businesses in relation to personal information protection managers, it is necessary to consider integrating several companies to have one personal information protection manager, and it is necessary to prepare confidentiality obligations or conflict of interest obligations.