http://chineseinput.net/에서 pinyin(병음)방식으로 중국어를 변환할 수 있습니다.
변환된 중국어를 복사하여 사용하시면 됩니다.
EU 적정성 결정에 따른 개인정보보호위원회 고시인 보완규정의 법적 분석
박노형 고려대학교 법학연구원 2022 고려법학 Vol.- No.106
In December 2021, the European Commission of the European Union adopted the adequacy decision on the data protection of the Rep. of Korea(Korea). The adequacy decision means that the personal information of the EU citizens and residents may freely be transferred to Korea. The Personal Information Protection Commission of Korea adopted the public notice which is the supplementary rules applicable to the personal information transferred from the EU to Korea for the interpretation and application of the Personal Information Protection Act(PIPA). This public notice(‘Supplementary Rules’) became effective upon the adoption of the adequacy decision by the European Commission. This public notice or the Supplementary Rules is identical to the Annex I of the adequacy decision. The Supplementary Rules is a legal instrument which was regarded necessary in relation to the adoption of the adequacy decision, but it has some interpretations of some of important provisions of the PIPA. For example, it is to note that the PIPA provisions on the limitation to out-of-purpose use and provision of personal information applies to the personal information transferred from third countries as well as from the EU. However, some of the Supplementary Rules’ interpretations seem to go beyond the legal meanings and legislative contexts of the PIPA. For example, the Supplementary Rules interpret Article 17(4) on the provision of personal information for the purposes compatible to the original ones to be a legal basis for the provision of personal information to third parties abroad. However, considering the legal meanings of GDPR Article 6(4), a model of the PIPA Article 17(4), and the legislative context of the latter during the so-called ‘three data law amendment’, this interpretation of the Supplementary Rules is certain to be excessive and immoderate. Further, the PIPA does not require the destruction of pseudonymized personal information, when achieving its purpose of processing, but the Supplementary Rules interprets that personal information transferred to Korea on the basis of the adequacy decision, including its pseudonymized personal information, should be destroyed when its purpose is achieved. It is a serious matter that the PIPA does not require the destruction of such personal information at present, but it is also another serious matter that the public notice exceeds the PIPA, which is at a higher status than itself. In addition, the Supplementary Rules’ interpretation in relation to the analysis of personal information related to national security in Article 58(1)(i) of the PIPA seems to be most wrongful. Article 58(1) of the PIPA provides that Chapters III through VII are not applicable in this case. The provisions of those chapters are most important substantive provisions of the PIPA. However, the Supplementary Rules interprets that Article 3 of Chapter I on the principles of data protection is still applicable in lieu of those chapters including Chapters III and V on the processing of personal information and the guarantee of data subjects’ rights respectively. Article 58(4) still provides how to process personal information to benefit the protection of data subjects in this case, although it may be at a minimum. For national security purposes, however, the government department concerned should devise and implement those relevant measures stipulated in Article 58(4) of the PIPA. It is certain to find that the Supplementary Rules wrongly goes well beyond the legal meanings and legislative contexts of the PIPA in the name of interpretation to benefit the personal information transferred from the EU. The Supplementary Rules, the public notice of the Personal Information Protection Commission, should be revised to interpret the PIPA to fulfill the legal system’s purpose: legal expectation and stability.