근로자 개인정보 처리의 정당성 요건과 한계–종속성의 관점에서

“Personal Information Protection Act”(PIPA), a general law for personal date protection, guarantee the free exchange as well as the protection of the personal data. That clears the PIPA’s characteristics as the private law. If the personal information manager obtain the consent of the subject of information, the manager can process the personal information unconstrainedly, and The PIPA can admit the employer to process the worker’s personal data including providing a third person and using for any purpose other than intended ones, so long as he gets the worker’s consent. So, the worker’s consent in the PIPA functions as the master-key to obtain the legitimacy to process the personal data. But, due to the worker’s subordination to the employer, the real intention of workers as the subject of information is suspected. Furthermore, the PIPA article 15 (1) 6 should allow the personal information manager, without the consent of the subject of information, to process the personal data, if the manager demonstrate his legitimate interests which is limited to cases. Thus the employer not given the worker’s consent can assert his right to obtain the worker’s personal data for his legitimate interest in the facilities and human resources management. The PIPA has a few blind spot. For example, the PIPA does not have any provisions of the biometrics. The employers use the worker’s biometrics for the facilities security and worker’s job description. The biometrics remain unchanged worker’s whole life, so if the biometrics abused, the damages are incalculable. The PIPA article 23 enacts a provision of the sensitive information (thought, beliefs, health information, etc.). The biometrics should be interpreted analogically as a sort of health information regulated so that it can regulated in the PIPA. Recently, the employer use the GPS and the electronic tag to trace the worker’s location data. The personal location data is regulated in “Act on the Protection, Use, etc., of Location Information”, but this act does not consider the unbalanced relationship of the employer and the worker, so the employer given the worker’s consent can get the worker’s location data freely. The person who has the other party’s information rules those who can’t. If those who can’t is the worker, along with the subordination to the employer, he suffers from the double power-imbalance. To overcome the double imbalance, firstly, the regulations of processing the worker’s personal data should be established in the PIPA. As a role model, the German personal data protection act is in the process of revision, which tries to insert the worker’s data protection part in the act. When the PIPA is changed, the scope of individual object should be expanded. The current law regulates the workers who offer his service to the employers, but the job-seeker, retiree, and contract laborers have to be included. Moreover, in the illegal processing of the worker’s personal data, the workers should have the right of veto and immunity. Secondly, to secure the truth of worker’s consent, in other words, to obtain the equal standing between the employer and the worker, the group decision of the labor-management representatives substitutes for the worker’s individual consent of processing his personal data. For that, the workers can entrust the representative such as the labour union representative with the right of agreement on processing. Finally, on interpreting the legislation concerned on personal data protection containing the PIPA, the regulations should be construed in the principle of being involved in the occupation and of proportion. The principle of being involved in the occupation is relevant to interpret the employer’s legitimate interests on the processing the worker’s personal data, and if the employer’s processing of the worker’s personal data is proved to be involved in the occupation, in addition, the proportion between the profit of the employer and the damage of the workers should be well-balanced.