개정 개인정보 보호법에 관한 시론적 고찰

Intelligent information technologies such as big data and artificial intelligence are continuing to develop based on vast amounts of information. The development of new technologies also has the advantage of enhancing national competitiveness, but it is concerned that the right to self-determination of personal information would be violated due to the profiling of personal information and the increase in automated decisions. In order to actively respond to the intelligent information society, the need to revise the Personal Information Protection Act emerged, and in March 2023, substantial revision of the Personal Information Protection Act was made. The revised Personal Information Protection Act is based on the development of new technologies and mainly includes strengthening information subject’s right to self-determination of personal information, and was revised to meet the global level. In the revised law, the establishment of the right to data portability and the right to automated decisions are noteworthy. These rights were already introduced in the 2016 EU GDPR and were considered revised tasks to the Personal Information Protection Act. The right to self-determination of personal information could be further strengthened by being reflected in the revised Personal Information Protection Act in 2023. In the future, the Personal Information Protection Act requires the establishment of platforms to specifically realize the right to data portability, however. It is necessary to add regulation that prohibits automated decisions based on sensitive information, in principle. There is no need to stipulate the right to object profiling, but an amendment is required to specify the provision including ‘profiling’ in Article 37 “Processing of Personal Information”, in addition.