가명정보의 미동의 처리의 기본권 침해 검토

As the 「Personal Information Protection Act」 and 「Act on the Use and Protectionof Credit Information」 were revised in 2020, the concept of ‘pseudonym information’was introduced. ‘Pseudonym information’ refers to information in which the subjectof information cannot be identified without additional information by deleting orreplacing part of personal information, but the Personal Information Protection Actstill classifies it as one of personal information because there is a possibility that thepseudonym information is re-identifiable. It is expected that the use of pseudonyminformation will expand the range of data use, and the use of big data analysis andartificial intelligence (AI) will create information services in various fields such astransportation, finance, and medical care. In particular, it seems that it will contributeto the creation of a converged information industry that will enable new added valueand innovation by combining heterogeneous industrial data. However, it is understoodthat the introduction of pseudonym information has been so focused on the supportof the information industry that the minimum protection as personal information isomitted. In fact, the introduction of pseudonymized information was modeled on theprovisions related to’pseudonym processing’ of the EU’s General Data ProtectionRegulation (GDPR, hereinafter referred to as “GDPR”) There is a significantdifference when it comes to the protection of pseudonym information. This studycriticizes the fact that the newly introduced pseudonym information system basicallyexcludes the exercise of the data subject’s right to consent and the data subject’sother rights when processing pseudonym information. In addition, while making itpossible to combine pseudonymized information of different information controllersregardless of the content and type of information, critically reviewed the regulations that prevented the subject of any objection from being exercised. For this review, areview of the concept of pseudonym information and the status of regulations,comparison with the European GDPR regulations, and an examination of the rules forsurplus funding were conducted. In addition, it was judged that the provisions relatedto pseudonymized information in the Personal Information Protection Act violate theright to self-determination of personal information.