개인정보자기결정권 보호의 한계의 관점에서 본 「개인정보보호법」 개정의 문제점

Abstract

The right to self-determination of personal information is not an absolute right of the data subject, and legal interests of the right must not be unreasonably expanded. This right is a right recognized as a new protection system for areas outside the scope of normal privacy right protection, because it is not appropriate to apply the laws related to privacy protection to general personal information. Though the Constitutional Court defines the right to self-determination of personal information simply as “the right to decide on their own personal information”, the definition shall be construed that it means “the totality of tangible rights such as personal rights and civil contract rights, as well as the right of privacy that the data subject ultimately enjoys by guaranteeing the rights of control such as procedural and formal risk regulation such as the right to refuse consent and the right to access” and that it means furthermore “the right of information subjects to actively form their own personal information distribution in order to enjoy various personal and economic benefits.” Therefore, the 「Personal Information Protection Act」, which specifies the right to self-determination of personal information, is a law that contains regulations for personal information protection such as legality standards and procedural requirements for personal information processing, and that, in addition, personal information is not only the object of protection, but a balance between protection and use is promoted, premising the free movement of personal information as a “medium that identifies and evaluates the information subject or as a medium that establishes social relations.” But the formulas of ‘prior consent = formal consent' and 'violation of consent obligation = criminal punishment' based on notice and consent, which have been adhered to even after the revision, not only strengthens the 'universalism of consent', but also causes excessive protection of personal information, which is the cause of regulating even legitimate personal information processing. In particular, the use of new types of personal information, such as the use of inferred data through big data analysis, not only increased the risk of personal information, but also changed the nature of the risk. In addition, it is defeating the traditional regulatory method of the Personal Information Protection Act, which has been adhered to so far, “informed consent,” and is demanding a new regulatory method. While the EU and the UK still adhere to the principle of 'notice and consent' as a core principle, on the other hand, through the collection of public opinions on the legal handling of personal information in the AI and big data environment, and publication of guidelines, notifications suitable for the new environment and it provides detailed information on cases related to the method of consent. As such, it is urgent for Korea to seek practical solutions to cope with the big data environment. In addition, although not mentioned in this paper, it is necessary to review the legal system and policy on matters to be considered in the big data environment, such as the right to veto automated decision-making such as profiling and the right to move personal information in GDPR. The 「Personal Information Protection Act」 is a law that aims to protect individual freedom and rights and ultimately realize individual dignity and values by setting matters on the processing and protection of personal information as specified in its purpose. To this end, efforts are needed to prepare an appropriate and effective regulatory method in consideration of not only the benefits given to individuals from using data, but also the benefits to companies and the country as a whole, without sacrificing the nature of the self-determination of personal information.