개인정보 국외이전 관련 유럽연합과 우리나라의 비교법적 연구-2023년 개정 개인정보보호법을 고려하여

Before the amendment, the Personal Information Protection Act stipulates that personal information processors must obtain the consent of the information subject in order to transfer personal information abroad. Therefore, the criticism that the movement of personal information between borders is rigid and the difficulties in business practice were faced. The revised Personal Information Protection Act adopts a way to diversify the requirements for transferring personal information to meet international standards. The revised Personal Information Protection Act can be evaluated to make a significant contribution to resolving these criticisms and difficulties. The Personal Information Protection Act, amended in 2023, has worked to diversify the requirements for transferring personal information abroad, but the protection committee may order the personal information processor to suspend the transfer of personal information abroad in certain cases. For example, a case in which a contract for the transfer of personal information to a foreign country is concluded in violation of the provisions related to the Personal Information Protection Act may be a representative case, and a person who transfers personal information may not adequately protect personal information, This is also the case where there is a significant risk of damage to the information subject. Specific matters related to the standards for orders suspending overseas relocation and procedures for appeals are stipulated in the Enforcement Decree. It is highly likely that the amendment will be resolved by pointing out that the Privacy Act before the amendment is not comparable in various ways compared to the European Union GDPR. As the point of being rigid and narrowing the requirements for overseas transfer has been resolved, it can be evaluated that a more positive signal has been turned on for Korean companies to enter overseas markets.