개인정보보호 관리등급제 도입 연구

Abstract

According to the 「Personal Information Protection Act(PIPA)」 Article 2 (1). The term Personal information means “information that pertains to a living person, including the full name, resident registration number, images, etc., by which the individual in question can be identified, and including information by which the individual in question cannot be identified but can be identified through simple combination with other information”. “Subject of information” means a person who can be identified by the managed information and therefore is the subject of the given piece of information(PIPA art. 2(3)). “Personal information manager” means a public institution, corporate body, organization, individual, etc. who manages personal information directly or via another person to administer personal information files as part of his/her duties(PIPA art. 2(5)). When processing personal information manager to collect personal information, He shall be obligated to comply with the privacy principles of the PIPA. But there will be differences in the degree of Personal information protection due to the difference in the quality of human and material equipment, Qualities, Ability, Will etc. for Personal information protection. Personal information, becomes larger the potential infringement by the nature of the Integration, economic value, and commonality, is larger than the wavelength of the social, economic. The system for the general information protection introduced into certification system of the Information Security Management System(ISMS) Certification system and Information Security Management Level(ISML). On the other hand, The Evaluation system on the Personal Information Management System is not existed. The certification system of the Personal Information Management System introduce into resently only. When taking into consideration that the increase the risk of infringement by the integrity of the personal information, Size of the social wave and Lack of relief to the Infringement of the personal information, Maturation of social consensus for the personal information protection etc., requires the introduction of the Personal Information Security Management Level(PIML) by the highest level for personal information protection. This study presents a need for PIML the introduction, design criteria for the evaluation and establish a pre-frame for the introduction of the system. Therefore, I expect to utilize as the basis for the introduction of the PIML system.