A Comparative Law Study for Personal Information Protection

Abstract

유럽연합은 2018년부터 한층 구체화되고 정보주체의 권리가 강화된 GDPR을 시행하고 있다. GDPR은 지능정보사회에 걸맞게 정보주체의 권리를 강화하면서 개인정보의 활용에 있어서 보다 탄력적 대응을 통하여 효율성을 제고하고 있다. 이에 반하여 한국은 개인정보보호법제가 단일법 형태가 아니라 복수법으로 분야별로 시행되고 있어서 개인정보침해에 대하여 신속하고 통일적인 대응하기 어려운 문제를 갖고 있다. 그래서 개인정보보호를 위한 통일된 법체계를 갖추어야 한다.As the Personal Information Protection Act passed the National Assembly in 2011, a personal information protection legislation was established that unites the public and private sectors. Although the legislative environment for personal information protection was systemized by the implementation of the Personal Information Protection Act, the Personal Information Protection Act changed once again with the bursting of personal information leakage of the three card companies. The revision of the Personal Information Protection Act prohibits the collection of sensitive personal information, such as social security numbers, in the private sector. Nevertheless, personal information leakage incidents continue to occur. In Korea, the Personal Information Protection Act is the basic law for the protection of personal information, but various laws deal with personal information, so a unified and systematic legal system should be established. The modern information society is moving toward the intelligent information society with the development of artificial intelligence. In the intelligent information society, the protection of personal information is becoming more important due to the wide use of data. The European Union has already enacted and implemented the Privacy Guidelines in 1995 with the growing importance of privacy. In 2002, the Personal Information Protection Guidelines were prepared in the area of electronic communication. Since then, privacy has been upgraded to basic rights through the European Charter of Human Rights. The European Union has implemented a GDPR that has been further embodied since 2018 and strengthened the rights of data subjects. GDPR strengthens the rights of information subjects in line with the intelligent information society, and improves efficiency through more flexible responses in the use of personal information. On the contrary, Korea s privacy protection legislation is implemented not by a single law but by plural laws, which makes it difficult to respond quickly and uniformly to personal information infringement. Therefore, a unified legal system must be established for the protection of personal information. In order to improve the system of oversight of the protection of personal information, the Commission must first become a fully independent institution and authorize equivalent international standards. The Privacy Commissioner shall establish a legal status as a central authority for the protection of personal information. In addition, the authority to supervise, investigate, and execute the supervisory authority should be granted. In addition, the rights of information subjects should be expanded to meet the new intelligent information society, and regulations should be established to specify the right to move personal information and the right for automated decision-making, and to specify the conditions of foreign relocation. In addition, through the introduction of pseudonym processing system, overall improvement is needed, such as activating the use of personal information. As the European Union implements GDPR for personal information protection in the new era of intelligent information, legislation is needed to protect personal information. The European Union has upgraded the right to privacy to basic rights through the Charter of Basic Rights. Accordingly, various measures for the protection of personal information were prospectively included in GDPR. The Personal Information Protection Act should also be improved and maintained in accordance with the intelligent information age.