온라인 플랫폼 법인사업자에 대한 개인정보 보호법상 벌칙규정 적용의 이론적 및 현실적 한계

Abstract

As the voices raising concerns about the possibility of personal identification through extensive information collection and data combination of online platforms, interest in legal mechanisms for personal information protection is growing. The current Personal Information Protection Act, amended in 2020, introduced penalties for information and communications service providers. Online platforms are subject to the Privacy Act as a information and communications service provider. However, in reality, the application of joint penal provisions under the Personal Information Protection Act to online platforms is expected to be extremely rare. First of all, most information and communication service providers have the status of corporations or organizations, but since corporations and organizations do not have criminal liability, criminal identity is not recognized. Therefore, it cannot be punished by the penalty provisions. Through the punishment regulation, the supervisor is responsible for the violation. As it falls under negligence, there is no liability if the duty of care is fulfilled. Furthermore, there is a possibility that the online platform, which is a legal entity, will be held directly responsible for the illegal acts of the representative under the penalty regulations. Cookie collection is a representative case of personal information infringement involving the representative of a corporation. This is related to the profit structure of the online platform. If the collected cookie information is directly processed by the collector, there is a possibility of identifying an individual, so it is personal information. However, it is not easy to prove that the actual consent does not exist or that it is outside the scope of consent as the platforms have obtained prior consent from the data subject to collect cookies. When the platform provides the cookie information collected by the platform to a third party, there is a limitation in that there is no recognition that the platform provides personal information that can identify an individual. It is difficult for the platform to know the details of the information held by the third party. In the end, criminal punishment for online platforms will be a very unusual phenomenon, so it is expected that civil protection measures will be actively used.