Legal Aspects of Personal Data Protection in the Big Data Era- Focused on Legal Consolidation, Information Sensitivity and Re-identification -

These days, countries faces a brand new global wave of big data; Korea is no exception. It is time to inspect the related laws on privacy of personal data and to adjust, if necessary, themselves into today’s changed environment looking for more adequate answer. This paper attempts to find some solutions in the legal aspects mostly focused in consideration of necessity of making efficient use of big data. Firstly, to avoid intricacy, similar privacy protection provisions in the three relevant laws should be consolidated into Personal Information Protection Act which has enacted in 2009 as a general personal data protection law. Secondly, in the definition of personal data in the relevant Acts, a requirement of ‘(easy) identifiability’ had better be replaced by sensitivity. This identifiability is too broad word which might bring about reluctance of processing useful data. For privacy itself, sensitivity in nature of data can be more effective and practical. Thirdly, although the current relevant laws have established the common stance of requiring data subjects’ consent before data collection, etc. there are still loopholes in the big data processing. Therefore, not only collection but also generation of sensitive personal data from mixing de-identified databases should be informed to the data subject.