「개인정보 보호법」상의 ‘개인정보’ 개념에 대한 해석론– 익명화한 처방전 정보를 중심으로 -

Abstract

There is a set of medical prescription data which indicates that an orthopedic surgeon at the Jinhae Yonsei Clinic prescribed five day doses of ALBIS TAB made by the Daewoong Pharm for a woman born in August 30th, 1966 whose resident registration number was encrypted. Do the anonymized prescription data fall under the category of ‘personal data’ under the Personal Data Protection Act of Korea? Or not? It is apparent that the data is about some particular person. But the problem is whether she can be identified from the data or other information which is in the possession of, or is likely to come into the possession of, the data controller. Under the Act of Korea, the term “personal data” means “information that pertains to a living person, including the full name, resident registration number, images, etc., by which the individual in question can be identified, (including information by which the individual in question cannot be identified but can be identified through simple combination with other information).” The main issue of this paper is whether a particular woman as the above data subject can be identified by the encrypted resident registration number, date of birth and sex. It concludes that an encrypted resident registration number which can not be deciphered, birth date, and sex themselves can not be used as personal identifiers. In its final analysis, the above anonymized prescription data fall out of the category of ‘personal data’ under the Act.