제정 10주년의 개인정보보호법에 대한 형사법적 검토

This article intends to review major criminal law issues of the Personal Information Protection Act(‘the Act’) in the 10 years since its enactment. The definition of ‘personal information’ relies on the concept of identifiability. The interpretation of the phrase “identifiable by easily combining with other data” is the key issue in deciding the identifiability of a person. Although there has been no Supreme Court decision on this point, lower courts seem to apply the relative approach, which considers combining other data should be easy for the data controller. In my opinion, this position is in line with the amended article of the Act which states “taking into account possibilities of obtaining other data” and the elements of criminal offences requiring status of data controller. The amended Act of 2020 provides the legal basis for processing of ‘pseudonymised data’ and clarifies that ‘anonymised data’ is not subject to the Act. There was a lower court decision which denied the data controller’s intention of processing identifiable personal information where risk of re-identification had remained. The Act stipulates the lawful grounds for processing personal information by specifying collection/use, provision to third parties and out-of-purpose use/provision separately, and criminalises the breach of such rules. The most important policy choice is how to ensure the right to informational self-determination of the data subject; the Act has adopted an opt-in regime. The Supreme Court has issued rulings on conditions for obtaining lawful consent and exemption for consent requirements in case of disclosed personal information. Also, the Supreme Court decides the legality of processing activities by reviewing whether they are in accordance with the original purpose for which the consent was given. Under the amended Act of 2020, further processing of personal information may be permitted without the data subject’s consent, if such processing is within the scope which is reasonably related to the original purpose of collection. The Act also makes it a criminal offence for data controllers to violate data security measures. The court indicates the technical standards to be met, and requires both intention of such violation and negligence in the leakage of personal information. Through this legal analysis of criminal cases accumulated during 10 years after the enforcement of the Act, I have emphasised that it is necessary to establish well-defined regulations by balancing interests between protection and utilisation of personal information.