개인정보 보호의 규범적 의의와 한계 – 사법(私法) 영역에서의 두 가지 주요 쟁점을 중심으로 –

In this study, I ask the following two questions in order to consider the normative meaning of personal information protection; first, is the right to protection of one’s personal information a natural right, and second, is the legal right we seek to protect by enforcing personal information protection jurisprudence the right of self-determination of personal information? The first question explores the meaning of personal information protection in light of the ever changing modern landscape whereas the second seeks to understand what the legal right that ought to be protected by personal information protection really is. Originally, the notion of personal information protection was discussed as one part of the larger concept of the “privacy” and was not conferred with separate treatment due to any particular properties “personal information” may have over other types of protectable information. It is only in the relatively modern era of rapid digitalization which has permitted certain capabilities such as mass storage, unlimited copying, unlimited analysis and distribution at the speed of light, which has created a need for giving separate normative treatment to personal information. This empirical change must be given due consideration if we are to properly understand and interpret personal information related to the laws and regulations. In this respect, the concept of a “personal information file” under the Personal Information Protection Act, a concept which has been somewhat neglected until now, lends itself as a mean of ascertaining the normative aspects of personal information protection in the face of massification and automatization of personal information in the modern era. A modern interpretation of personal information protection should be able to normatively limit the scope of protection through the concept of a “personal information file.”As to what legal right is being protected through personal information protection, we may consider, on the one hand, the right of self-determination of one’s personal information, which could be described as a procedural, formal right, and on the other hand, the more substantive right to maintain a free private life. Clearly, the two rights should be evaluated separately, and normative standards, such as legality thresholds and remedies applied to the protection of each right should depend on the right we are seeking to protect and the seriousness of the infringement. Because the right of self-determination of one’s own information is fundamentally a mean to protect one’s substantive rights, such right cannot be treated as an end in and of itself, and understanding the true nature of the right to self-determination of one’s own information is an important starting point for properly ascertaining the meaning of personal information protection and evaluating the appropriate compensation for any infringement thereof. Only after such considerations are given, we would be able to reasonably evaluate the actions which violate the Personal Information Protection Act and properly assess the derivative damages.