긴급상황 하에서의 개인정보보호와 알 권리의 균형에 관한 연구

This study examines how large-scale personal data collection and disclosure during the COVID-19 response created legal tensions between personal data protection and the public’s right to know in emergency situations. It focuses on practical measures—such as route disclosure, contact tracing, and location tracking of self-quarantined individuals—that were introduced to protect public health but also generated serious privacy risks, including identification, stigma, and secondary harm. The analysis highlights structural inconsistencies among Korea’s key legal frameworks, including the Personal Information Protection Act, the Disaster and Safety Management Act, the Infectious Disease Control and Prevention Act, and the Official Information Disclosure Act. The right to self-determination of personal information, grounded in constitutional principles protecting human dignity and private life, refers to an individual’s ability to control the disclosure and use of personal information. The right to know, grounded in freedom of expression and popular sovereignty, supports citizens’ access to government-held information and democratic oversight. When these rights conflict in emergencies, the proportionality principle provides the central standard for assessing whether restrictions on fundamental rights are justified and whether less intrusive alternatives are available. This study proposes legislative and institutional reforms in three directions. First, emergency conditions should be defined more precisely, with clear limits on the scope, duration, retention, and post-emergency deletion of collected data. Second, the Personal Information Protection Commission should be equipped with expedited procedures for prior review of high-risk mass processing, stronger corrective powers during emergencies, enhanced post-monitoring, and fast remedies for data subjects’ correction and deletion requests. Third, transparency and privacy should be reconciled through legally structured partial disclosure, anonymization or pseudonymization, time-limited publication, strict access control, and accountability mechanisms such as audit trails and Privacy by Design.