디지털 무역과 개인정보 보호: 공동 컨트롤러 개념의 필요성을 중심으로

Digital trade has emerged as a transformative force in the global economy, transcending tradi tional boundaries of commerce and reshaping the way goods, services, and data are exchanged across borders. As this shift accelerates, personal data has become a critical asset in the digital economy, leading to complex legal challenges surrounding its protection and regulation. Among these, the tension between the free flow of data—essential for digital trade—and stringent pri vacy regulations imposed by individual jurisdictions has become increasingly pronounced. This paper explores the legal and institutional conflicts between digital trade and personal da ta protection from an international trade law perspective. Through a comparative analysis of the European Union’s General Data Protection Regulation (GDPR), the United States’ California Privacy Rights Act (CPRA), and the Republic of Korea’s Personal Information Protection Act (PIPA), the study identifies fundamental differences in regulatory approaches that hinder cross-border data flows and create legal uncertainty for multinational businesses. A central argument of this research is that the GDPR’s “joint controller” concept offers a via ble legal framework for allocating responsibility in transnational data processing activities. In contrast, Korea’s binary regulatory model—dividing all data processing relationships into either consignment (outsourcing) or third-party provision—is no longer adequate to capture the com plexity of contemporary digital services involving multiple stakeholders across jurisdictions. By examining landmark cases such as Fashion ID v. Verbraucherzentrale NRW, the paper illustrates how joint controllership can serve as a regulatory solution that promotes both accountability and interoperability. The paper concludes by advocating for the adoption of the joint controller model within Korean data protection law and encourages the development of multilateral norms within the WTO or other international frameworks. Such legal innovation is essential for reconciling the dual imperatives of protecting personal data and facilitating the growth of a robust, inclusive global digital economy.