빅 데이터(Big Data) 시대 개정 개인정보 보호법에 관한 법적 고찰

Abstract

With the revision of the Personal Information Protection Act, the concept of ‘pseudonymized information’, which cannot identify a specific individual without using or combining additional information, was newly established, and it was possible to process pseudonym information without the consent of the data subject. It is meaningful that a legal basis for contributing to the development of the ICT industry was prepared by using such pseudonymized information. The revised Personal Information Protection Act does not apply to information that can no longer be recognized by an individual, ie, ‘anonymous information’ when other information is used when reasonably considering time, cost, and technology. However, the distinction between pseudonymized information and anonymous information is not a definitive concept, but a tentative concept that can be changed depending on the level of technology available at the time of information processing. In the Personal Information Protection Act, ‘scientific research’ is defined as “research that applies scientific methods such as technology development and demonstration, basic research, applied research, and private investment research.” The scope of use of ‘scientific research’ in personal information is unclear. It should be considered that the statistical preparation, scientific research, and preservation of public records recorded in the Personal Information Protection Act are limited to public works or activities for the public good. Between the Personal Information Protection Act and the Credit Information Use and Protection Act, it is limited to writing statistics, scientific research, and preserving records in the public interest to the extent that it can process pseudonymized information without the consent of the data subject or statistics for commercial purposes. There is a difference whether writing and industrial research are also included. The Personal Information Protection Act stipulates that, in relation to relationship with other Acts, “The protection of personal information shall be governed by this Act, except as otherwise specifically provided for in other Acts.” Between the ‘Personal Information Protection Act’ and ‘Bioethics and Safety Act’, ‘Medical Service Act’, and ‘Act on the Protection, Use, etc. of Location Information, there is a question as to which law should be applied first with regard to the application of pseudonymized information processing.