지능정보사회에서 민감정보의 보호와 이용을 위한 법제 정비방안 연구

Personal information gradually turns into be one of the key resources in the intelligent information society in which the cutting-edge technologies such as artificial intelligence, big data, internet of things, clouds play significant roles for innovative services and products. However, there is no doubt that the probability of data breach rises as the importance of personal information grows with the latest technologies. The definition of sensitive information is clearly written in the Personal Information Protection Act. The Act explicitly provides examples to define what the sensitive information is. Pursuant to the article 23 of the Act, information about one’s ideology, belief, admission to or withdrawal from a trade union or political party, political opinions, health, sex life falls into the scope of the sensitive information. Besides, other personal information that is likely to markedly threaten the privacy of any data subject is equivalently treated as the sensitive information. Furthermore, the Act limits the use of such information since sensitive information is highly related to the right to privacy given to each data subject. How we set balance between the protection and the use of personal information comes to the critical task in the fast-evolving society driven by latest data technologies. The sensitive information is not in difference. To that end, this article looks into global protection laws in order to compare the protection scope of sensitive information. In addition, under the perspective that the safe use of personal information is required for economical innovation driven by the data technologies, this article suggests to amend the Personal Information Protection Act. First, the Act should expand the scope of sensitive information by adding information about sexual orientation and information about criminal victimization. Second, in order to protect data subjects, the legal basis for processing sensitive information should be limited to laws only passed by the legislature body. These would expand the protection scope of data subjects with regard to sensitive information. Currently, the Act only allows two conditions to process sensitive information, consent from a data subject or by other statute that allows to process sensitive information. Comparing to relevant provisions written in the EU GDPR, this limitation is likely to be narrowly regulated. Thus, the Act should be amended in order to process sensitive information by adding four exceptions like the EU GDPR. With four exceptions, the task to balance the protection and the use of personal information, including sensitive information, would be completed without harming the data subject in the intelligent information society.