個人情報 處理委託의 법적 규율에 관한 小考 - 유럽 GDPR, 일본법과의 비교를 포함하여 -

The so-called ‘three data acts’, including the Personal Information Protection Act (hereinafter referred to as the "PIPA"), were revised and implemented extensively. Although there are many notable changes in this amendment, this article review the consignment of personal data processing. With the disappearance of various personal data-related regulations contained in the Information and Communication Network Utilization Promotion and Information Protection Act, the PIPA has become integrated with respect to the consignment of personal data processing, and these changes can be evaluated positively overall. But more specifically, there is something to think about. First, though the consent requirement for handling consignment has disappeared, all consignees are still required to be disclosed. However, the risks arising from such disclosure seem greater than the benefits provided to guarantee the right to self-determination of personal data. In addition, in view of the actual consignment practice, it seems that there is no need to uniformly regulate the responsibility of the consignee. Basically, it seems necessary to change the existing perspective on consignment. In other words, it is necessary to recognize the consignment of personal data as the usual way of doing business in modern society, rather than an exceptional aspect that causes a certain risk in the processing of personal data. These ideas can also be found in the content of the European GDPR and the Japanese Personal Data Act. From that point on, we have to understand it as an option in the performance of their duties, and consider it in a way that the consignors itself is responsible for the choice of themselves. In other words, the consignment of processing is not directly related to the issue of the right to self-determination of personal data, so it should be approached from the perspective of proper business handling or safe management, not from the intervention of the data owners. From that point of view, it seems necessary to make some improvements to the current PIPA which requires all consignees to be specified.