「개인정보 보호법」상 국내 인터넷·모바일 플랫폼 기업에 대한 규제 형평성에 관한 연구

In various domestic internet and mobile platform markets, the market share of foreign internet service providers such as Google, Facebook, and Netflix has been continuously increasing, while domestic internet service providers have been gradually shrinking. According to a study, as of May 2018, Google's YouTube held a dominant position with an 85.6% share of mobile video usage time in South Korea, whereas domestic services such as AfreecaTV and NaverTV accounted for only 3.3% and 2.0%, respectively. Amidst this situation, concerns over "regulatory discrimination" against domestic internet service providers, which exacerbates competitive disadvantages in the market, have been raised for several years. While both domestic and foreign service providers cater to the same domestic consumers, regulatory enforcement is significantly stricter for domestic providers, whereas enforcing domestic regulations on foreign providers remains challenging, thereby perpetuating an unfair competitive landscape. Among the regulatory measures frequently cited as contributing to such discrimination are those under the Personal Information Protection Act (PIPA), the Act on Promotion of Information and Communications Network Utilization and Information Protection (hereinafter, the "Information and Communications Network Act"), the Act on the Protection and Use of Location Information (hereinafter, the "Location Information Act"), and the Act on the Use and Protection of Credit Information (hereinafter, the "Credit Information Act"). This study analyzes the causes of regulatory discrimination arising from South Korea’s personal information protection laws and proposes measures for improvement. Another area of regulatory discrimination concerns the deletion or destruction of personal information. Under current laws, when a data subject requests the deletion of their personal information, companies bear the burden of proof regarding compliance. However, practical difficulties arise because companies may need to retain data for the agreed-upon period rather than immediately destroying it within the legally mandated timeframe. Furthermore, while personal identifiers can be deleted, the remaining data may still be useful. However, due to the broad legal definition of personal information, companies are often required to destroy all data—including non-identifiable data—rather than just the personal identifiers. This requirement imposes a significant burden on businesses, forcing them to delete entire datasets unnecessarily. The issue is not a lack of commitment to personal data protection; rather, the excessively broad definition of personal data makes it nearly impossible to distinguish between personal and non-personal information. Consequently, businesses face an ongoing risk of violating the law, even when they have a genuine intent to comply. Additionally, the blanket requirement to delete all data impedes system and service operations, making full compliance practically unattainable. In conclusion, the current regulatory framework places a disproportionate burden on domestic internet service providers while foreign companies remain largely unaffected, leading to an uneven playing field. To foster a fairer regulatory environment, it is essential to reevaluate and amend the relevant personal information protection laws to ensure balanced enforcement and eliminate regulatory discrimination.