글로벌 CBPR(개인정보보호) 인증제도와 WTO 협정 합치성

As digital technologies are advanced, data is emerging as a core element in industry and international trade. In particular, cross-border data transfer functions as an essential element for business management and provision of digital services. Global CBPR Privacy Rules certification system is designed as a voluntary certification mechanism for promotion of digital trade by enhancing the reliability of personal information protection and harmonizing personal information protection systems among countries. Although CBPR certification had been discussed within APEC but switched over new phase since United States established an independent Global CBPR Forum. However, some concerns are raised on this certification system since only member countries can access the system and can function as a ‘de facto requirement’. This study examine the formation and operation process of Global CBPR certification system and consistency with WTO TBT and GATS Agreements. So, it will be studied whether the certification is regarded as conformity assessment procedure and whehter the action of private responsible agency belonged to country. In addition, the effectiveness of GATS Agreement on the supply of services(Mode 1 and 3) is examined, assuming that CBPR certification affects data transfer and provision of digital service. The result shows that access to certification is structurally limited to only forum member countries and if certification serves as a practical prerequisite, it can conflict with the non-discrimination and other obligations of the TBT agreement. Theses differences of accessibility can cause de facto discrimination under TBT and GATS agreements, and problems in terms of obligation of harmonization with international standards. In addition, as the impact of authentication on service provision expands, it will become more difficult to justify an exception based on privacy, if the non-discrimination requirements of the chapeau are not met. So, this study suggests enhanced interoperability through enhanced compliance with international standards, expanded openness and transparency of the CBPR system, recognition of alternative measures of personal information protection, and institutional support for domestic industries, as a policy response.