EU 개인정보 역외이전 규제의 GATS 양립성이 국내 상호주의 법안에 주는 정책 시사점
Compatibility of EU Regulation on Overseas Transfer of Personal Data with GATS and Its Policy Lessons for Korea’s Reciprocity Bills
3
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
금년 3월 시행 예정인 정보통신망법과 현재 국회 계류 중인 개인정보보호법 개정안은 EU 개인정보보호법 상의 적정성심사에 착안해 온라인서비스 분야의 개인정보 국외이전에 대한 상호주의 적용을 동일하게 명시하고 있다. 상식적으로 이는 최혜국대우를 일반적 의무로 규정한 GATS에 정면 배치된다. 이에 본고는 EU 적정성심사의 GATS 양립성 분석 결과에 기초해 국내의 상호주의 적용 규정의 통상쟁점 및 개선방향을 제시하고자 했다. 분석 결과는 EU 적정성심사조차도 GATS 비차별대우 의무에 저촉될 가능성이 없지 않음을 보여준다. 동 적정성심사가 명시적으로 국적에 따른 구분을 시도하지 않음에도 불구하고, 경우에 따라 동종 서비스(공급자)를 차별하는 조치로 간주될 여지가 없지 않기 때문이다. 하지만 동 적정성심사가 이행조치로서의 형식을 갖추고 있기 때문에 EU는 GATS 제XIV조(일반적 예외)를 그에 대한 방어기재로 활용할 여지를 갖고 있다. 이와 대조적으로 국내 상호주의 적용 규정은 명백하게 국적을 기준으로 온라인서비스 분야의 동종 서비스(공급자)를 구분･차별하는 조치에 해당되며, 이행조치로 볼만한 여지도 전혀 없다. 이러한 맥락에서 국내법(안) 상의 상호주의 적용 규정에 대한 전향적 대응이 시급해 보인다. 특히, ‘상호주의’로 명시된 조문 제목은 지양되어야 하며, 국적 구분에 대한 정교한 대응책 마련, 개인정보 국외이전을 위한 요건 및 절차의 구체화 등이 필요하다.
Abstract
Being inspired by the adequacy test in EU GDPR, a reciprocity provision on overseas transfer of personal data in online services is stipulated both in ‘Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.’ going into effect this March, and amendment bill of ‘Personal Information Protection Act’ pending in National Assembly. It runs counter to common sense in that GATS requires MFN treatment as a general obligation. That question has motivated this paper to probe into trade issues and policy suggestions over the reciprocity provision by analyzing consistency of EU’s adequacy test with GATS. Research results are summarized as follows. EU’s adequacy test is not free from the infringement of GATS non-discrimination obligations. Whereas it seeks no explicit nationality-based distinction, it still could be treated as a measure discriminating between like services or service suppliers, depending on occasion. However, EU affords to make use of GATS Article XIV(general exceptions) as a defense mechanism against such a violation, since the adequacy test is formalized as a compliance measure. In contrast, Korea’s reciprocity provision is unambiguously a measure of nationality-based distinction discriminating between like online services or service suppliers. Not to mention, there exists no room to think of it as a compliance measure. In this context, it requires forward-looking modifications, including revision of the provision title written as ‘reciprocity’, preparation of sophisticated policy responses to cope with nationality-based distinction, and substantiating requirements and procedures for overseas transfer of personal data.
참고문헌 (39)
- "개인정보보호법 일부개정법률안(인재근의원 대표발의), 의안번호 16621", 국회의안정보시스템, ~ (2018)
- 신일순, "프라이버시 염려와 SNS 활동: 프라이버시 역설의 존재 및 이유", 정보통신정책연구, 25(2), pp.33~67 (2018), 정보통신정책학회
- "정보통신망 이용촉진 및 정보보호 등에 관한 법률 일부개정법률안(대안), 의안번호 15146", 국회의안정보시스템, ~ (2018)
- 우리 기업을 위한 ‘EU 일반 개인정보보호법’ 가이드북, "한국인터넷진흥원", ~ (2018)
- 2016 CTI Report to Ministers, Appendix 17, "APEC Privacy Framework", ~ (2015)
- Appellate Body Report, Argentina-Measures relating to Trade in Goods and Services(Argentina-Financial Services), , ~, pp.WT (2016), DS453[DOI]
- Appellate Body Report, European Communities–Measures Affecting Asbestos and Asbestos-Containing Products(EC-Asbestos), , ~, pp.WT (2001), DS135[DOI]
- Appellate Body Report, European Communities-Regime for the Importation, Sale and Distribution of Bananas(EC-Bananas Ⅲ), , ~, pp.WT (1997), DS27[DOI]
- Appellate Body Report, Korea-Measures Affecting Imports of Fresh, Chilled and Frozen Beef(Korea-Beef), , ~, pp.WT (2000), DS161[DOI]
- Appellate Body Report, Turkey-Restrictions on Imports of Textile and Clothing Products(Turkey-Textiles), , ~, pp.WT (1999), DS34[DOI]
- Appellate Body Report, United States-Measures Affecting the Cross-border Supply of Gambling and Betting Services (US-Gambling), , ~, pp.WT (2005), DS285[DOI]
- Appellate Body Report, United States-Standards for Reformulated and Conventional Gasoline(US-Gasoline), , ~, pp.WT (1996), DS2[DOI]
- Carla L. Reyes, "WTO-Compliant Protection of Fundamental Rights: Lessons from the EU Privacy Directive", Melbourne Journal of International Law, 12(1) (2011)
- Christopher Kuner, "Reinventing Data Protection?" (2009), Springer
- Christopher Kuner, "Extraterritoriality and Regulation of International Data Transfers in EU Data Protection Law", International Data Privacy Law, 5(2) (2015)
- Christopher Kuner, "Reality and Illusion in EU Data Transfer Regulation Post Schrems", German Law Journal, 18(4) (2017)
- "Convention for the Protection of Individuals with regard to Automatic Data Processing of Personal Data, European Treaty Series-No. 108, Strasbourg, 28 January 1981", ~ (1981)
- "Court of Justice of the European Union, case C-131", 12 (Google Spain SL and Google Inc. v Agencia Espanola de Proteccion de Datos(AEPD) and Mario Costeja Gonzalez), judgment of 13 May 2014, ECLI:EU:C:2014:317
- "Commission Decision of 20 December 2001 pursuant to Directive 95", 46, ~
- "Commission Implementing Decision (EU) 2016", 1250 of 12 July 2016 pursuant to Directive 95, EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield, notified under document C(2016) 4176[DOI]
- "Convention for the Protection of Individuals with regard to Automatic Data Processing of Personal Data, European Treaty Series-No. 108, Strasbourg, 28 January 1981", ~ (1981)
- "European Commission approves provisions for cross-border data flows while consultation on GDPR Article 49 guidance closes, 4 April 2018" (2018)[URL]
- L. 281, "31", ~
- L 249, "21", ~
- K. Irion, "Trade abd Privacy : Complicated Beddellows? ”How to achieve data protection-proof free trade agreements" (2016), Institute for Information Law (IViR)
- OECD, "Taxation and Electronic Commerce: Implementing the Ottawa Taxation Framework Conditions", OECD, ~ (2001)
- Panel Report, Argentina-Measures relating to Trade in Goods and Services (Argentina-Financial Services), , ~, pp.WT (2015), DS453[DOI]
- Panel Report, United States-Standards for Reformulated and Conventional Gasoline(US-Gasoline), , ~, pp.WT (1996), DS2[DOI]
- Perry Keller, "European and International Media Law: Liberal Democracy, Trade and New Media" (2011), Oxford University Press
- "Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5", Minister of Justice of Canada, ~ (2000)
- L. 119, "1", ~
- The Best of Both Worlds? Free Trade in Services, and EU Law on Privacy and Data Protection, "S. Yakovleva", Amsterdam Law School Legal Studies, ~, pp.No. 2016-65 (2016)
- "The Canadian Personal Information Protection and Electronic Documents Act (“the Canadian Act”) of 13 April 2000(3) applies to private sector organisations that collect, use or disclose personal information in the course of commercial activities, 2002", 2, ~