개인정보보호법상 가명처리정지요구권에 대한 검토* -대법원 2025. 7. 18. 선고 2024다210554 판결-

he rights of data subjects regarding their personal information are aimed at protecting the right to self-determination over personal information, which is a type of personality right. Regarding ‘pseudonymized information,’ which is a type of personal information, lower court rulings and the Supreme Court ruling reached different conclusions in a case where mobile communication service users requested that telecommunications companies refrain from pseudonymizing their personal information for the purpose of applying the special provisions on processing pseudonymized information under Article 28-2 of the Personal Information Protection Act, namely for statistical purposes, scientific research purposes, and archiving purposes in the public interest. The essence of the first-instance and second-instance rulings was that while data subjects cannot exercise the right to request suspension of processing for information that has already been pseudonymized (i.e., pseudonymized information), they do possess the right to request prior suspension of pseudonymization. However, the Supreme Court ruled that if pseudonymized information falls under the special provisions governing its processing, the data subject is not entitled to the right to request suspension of pseudonymization under Article 37 of the Act, regardless of whether the information has already been pseudonymized or not. In my view, the Personal Information Protection Act conceptually distinguishes between ‘pseudonymization’ and ‘processing of pseudonymized information,’ and Article 28-2 of the Act, a special provision concerning the processing of pseudonymized information, regulates ‘processing of pseudonymized information.’ Therefore, Article 28-7 of the Act, which deprives data subjects of their right to request suspension of personal information processing as stipulated in Article 37, does not apply to pseudonymization itself. Therefore, the conclusions of the first-instance and second-instance judgments in the case — that the data subject retains the right to request suspension of pseudonymization — are considered reasonable interpretations under the current Personal Information Protection Act. However, regarding the utilization of pseudonymized information, for the Personal Information Protection Act to actively respond to the need for fostering new data-related industries and the industrial sector's requirement for data usage, as considered in the Supreme Court's ruling on the Case, it is necessary to establish technical safeguards against the risk of re-identification of pseudonymized information and to enact legislative supplements based on societal consensus regarding the restriction of data subjects' exercise of their right to self-determination over their personal information in relation to pseudonymization.