개인정보 역외 이전의 국제통상법적 규율방안

As the volume of goods and services traded in electronic commerce or through exchanges of digital commodities or digital services, it has become important to regulate cross-border data transfer, in particular personal data transfer involved in digital trade. A set of international trade agreements have incorporated a separate digital trade (or e-commerce) chapter which regulates basic principles. Furthermore, those international agreements include a number of exceptions provisions concerning legitimate public policy objectives, and national security. The most effective methods to protect personal data in international exchanges and commerce is outright prohibition of cross-border data transfer. However, this kind of regulation can dampen national competitive edge and economic growth opportunities which are made possible through the 4th Industrial Revolution and the growth of digital trade. Against this backdrop, major countries have strived to strike a subtle balance between data protection and data regulation. In line with this, they have revised national laws on personal data protection, as well as have incorporated cross-border data transfer provisions in international trade agreements. This article examines basic contours and related provisions found in recently revised personal data protection laws in the United States of America, the European Union, and in the People’s Republic of China. Based on comparative analysis of personal data protection and cross-border data transfers in a number of jurisdictions, this article suggests limitations of Korea’s recently revised Personal Data Protection Law. Next, this article explores several provisions concerning cross-border data transfer and exceptions in recent international trade agreements. Thirdly, this article considers another hurdle to the regulation of cross-border data transfer, protection of rights of private persons provided by the Court of Justice of the European Union. By examining a set of national laws, international trade agreements, and international court’ decisions, this article would provide a meaningful consideration in order to harmonize different laws and regulations among countries in the cross-border data transfer issue.