근로자 개인정보보호에 관한 비교법 연구

Abstract

Data protection laws in Korea include only the 「Personal Information Protection Act」 as the general law and do not have any special regulations for employees. However, due employees’ dependency on their employers, there are concerns of employers misusing and manipulating employees’ personal information. This presents a case for setting out special rules regarding labor law in the Personal Information Protection Act. Specific regulations to be applied to employment relations should also be considered because of the extensivity of the Personal Information Protection Act. To do this, this study seeks to investigate the privacy regulations of international organizations and foreign countries under the comparative framework and suggest implications accordingly. The OECD's eight principles have become the legislative principles of many countries, including Korea. By interpreting the recent effectuation of the EU General Data Protection Regulations (GDPR) in terms of employment relationships, it becomes meaningful to ensure the authenticity of the consensual method. The ILO is not legally binding but is a leading guideline for legislation, with specific guidance on the personal information of employees in accordance with its nature. Its features include restrictions on access to medical information and immunity. Although Japan has no special rules on employees like Korea, it fills this inadequacy with many relevant guidelines. Among them, a representative guideline has 'employment management information' as a sub-concept of personal information. Germany has recently revised its federal information protection laws, one of which provides special provisions for employment relationships. We can thus conclude that the concept of employees extends beyond those with dependencies to apprentices, rehabilitators, volunteers and job seekers. In addition to general data protection laws, France has included special provisions on the personal information of employees in its labor law, emphasizing the principle of personal information processing to be proportionate, that is, that the interests of employers and employees should be balanced. It also requires that personal information is closely related to work tasks. Furthermore, France also has an integrated regulatory body on general personal information processing called the Commission nationale de l'informatique et des libertes (CNIL). Australia has a special law on workplace surveillance, which is the Workplace Surveillance Act for Australian Capital Territory. It is characterized by dividing monitoring at workplaces into public, secret and prohibited surveillance, recognizing certain portions of surveillance while also enabling employees to predict. In comparison, Korea's guideline on personal information processing for employees acts as the manual under the Personal Information Protection Act, in which any expansion of the scope of personal information processing for employee is limited due to inability to create new contents. The implications of international organizations and laws from foreign countries are as follows. After establishing a chapter on employment within the Personal Information Protection Act, the concept of employees should be expanded within it and “employment information” should be introduced as a sub-concept of personal information. In addition, in the case of medical information, users should not be allowed access outside the course of work, and employees should be pre-notified in cases of legitimate monitoring. Furthermore, immunity should be granted if an employee provides false or inaccurate information for an unjust employer's personal information requirements. Finally, an independent, unified information protection body should be established which integrates the currently dispersed review, arbitration, and regulatory institutions.