개인정보자기결정권과 이익형량 - 대상판결: 대법원 2016. 8. 17. 선고 2014다235080 판결 -

Abstract

The Personal Information Protection Act (PIPA) stipulates stringent controls over personal information. Data processors are, in principle, prohibited from collecting or processing personal information without the data subject’s consent. This grants the data subject exclusive control over their personal information, which can be compared to the rights of a property owner. However, personal information covers a wide range of data, including neutral information unrelated to the secrecy of private life. Furthermore, since concepts like "identifiability" are vague and indeterminate, it is not easy to define the exact scope of personal information. This suggests that a more flexible approach to protecting personal information is required. The right to control personal information remains abstract, retaining much of its idealistic and declaratory nature from its initial advocacy. As such, this right must consider not only the need for information control but also the public's access to information, freedom of expression, the technological and industrial utility of information, and the interests of data processors who collect and process that information. In the case under review, the data processor collected and provided publicly available personal information without the explicit consent of the data subject. While this may partially limit the data subject's right to control their personal information, the general public interest in utilizing publicly available personal information must also be considered. The current PIPA does not provide a clear legal basis for the broad utilization of publicly available personal information. Justification for such use must instead be found in the general principles of civil law, such as those in Articles 2, 103, 750, and 751 of the Civil Act, along with the balancing of competing interests. This was the general approach to protecting the right to control personal information under Korea's legal system before the enactment of the PIPA, and it remains applicable even after its implementation.