개인정보 개념의 해석 및 범위에 관한 연구 = A Study on the Interpretation and the Scope of Personally Identifiable Information (PII)

다국어 초록 (Multilingual Abstract)

Under the Korea`s legislation for the protection of personal information, the term ‘personal information’ is defined as information that pertains to a living person, including the full name, resident registration number, images, etc., by which the individual in question can be identified, (including information by which the individual in question cannot be identified but can be identified through simple combination with other information). This definition is based upon the term ‘personally identifiable information (PII)’ which means any data that could potentially identify a specific individual. Thus PII is the central concept to decide whether personal data statutes are applicable or not, and define their scope and boundaries of application. Despite its importance in personal data statutes, the concept of PII is ambiguous and it may extend the scope of personal data, resulting both in unreasonably expansive application of personal data protection and in curbing free flow of information. Korean courts tend to have expanded the definition of personal data. From the perspective of striking a balance between the protection of privacy and the free flow of information, this paper argues that the current definition on personal data under the Korea`s legislation be construed rather narrowly. This paper introduces issues raised from the definition and how this definition is construed in the European Union. Finally this paper emphasizes that whether an individual is reasonably identifiable depends on the context and circumstances, and that the scope of personal information not be overly expanded.

참고문헌 (Reference)

1 문재완, "개인정보의 개념에 관한 연구" 공법연구 42 (3) : 53 ~ 77, 2014

2 행정안전부, "개인정보보호법령 및 지침고시 해설서" 2011

3 이대희, "개인정보 유출통지제도의 효과적인 운영 및 개선방안" 경영법률 24 (3) : 461 ~ 499, 2014

4 김주희, "개인정보 여부 판단시 결합의 용이성에 관한 이슈" 보안뉴스(2015.9.29), 2015

5 구태언, "개인정보 보호법의 제문제" 법학평론 3, 2012

6 이인호, "「개인정보 보호법」상의 ‘개인정보’ 개념에 대한 해석론– 익명화한 처방전 정보를 중심으로 -" 정보법학 19 (1) : 59 ~ 87, 2015

7 "Working document on data protection issues related to RFID technology, adopted on 19.1.2005 : 8 ~"

8 Paul M. Schwartz, "The PII Problem: Privacy and a New Concept of Personally Identifiable Information" NUY L. REV. 86 : 1876 ~ 1877, 2011

9 Daniel J. Solove, "The FTC and the New Common Law of Privacy" COLUM. L. REV. 114 : 593 ~ 594, 2014

10 L. Sweeney, "Simple Demographics Often Identify People Uniquely, Carnegie Mellon University" 2000

11 "Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)" 2012

12 Paul M. Schwartz, "Reconciling Personal Information in the United States and European Union" CAL. L. REV. 102 : 888 ~ 890, 2013

13 CoE, "RECOMMENDATION NO.R (90) 19 AND EXPLANATORY MEMORANDUM OF THE COMMITTEE OF MINISTERS TO MEMBER STATES ON THE PROTECTION OF PERSONAL DATA USED FOR PAYMENT AND OTHER RELATED OPERATIONS §1.2" 1990

14 FTC, "Protecting Consumer Privacy in an Era of Rapid Change: Recommendations For Businesses and Policymakers" 2012

15 The Parliament of the Commonwealth of Australia House of Representatives, "Privacy Amendment (Enhancing Privacy Protection) Bill 2011 Explanatory Memorandum"

16 Damian Clifford, "Personal data and dynamic IPs – time for clarity?" The London School of Economics and Political Science, Media Policy Project Blog,

17 UK Information Commission’s Office (ICO), "Personal Information Online Code of Practice 9" 2011

18 FRA, "Handbook on European Data Protection Law" 2014

19 "Guide to Protecting the Confidentiality of Personally Identifiable Information (PII): Recommendations of the National Institute of Standards and Technology 2-1" 2010

20 Jeremy M. Mittman, "German Court Rules that IP Addresses Are Not Personal Data"

21 Jones Day, "Framework for amendment to Japan's Personal Information Protection Act, Lexology, August 28, 2014; TaylorWessing, A new Bill to amend the personal data protection legislation in Japan, Global Data Hub, May 2015" 2015

22 Amalia R. Miller, "Encryption and the Loss of Patient Data" J. POL’Y ANALYSIS & MGT 30 : 534 ~, 2011

23 "Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data" O.J : 31 ~,

24 "Dir., Div. of Privacy and Identity Prot., FTC, to Reed Freeman, Morrison & Foerster LLP, Counsel for Netflix" Letter from Maneesha Mithal, Assoc, 2010

25 Paul Ohm, "Broken Promises of Privacy" UCLA L. REV. 57 : 1701 ~ 1746, 2010

26 White House, "Big Data: Seizing Opportunities, Preserving Values 54" 2014

27 Omer Tene, "BIG DATA FOR ALL: PRIVACY AND USER CONTROL IN THE AGE OF ANALYTICS" N.W. J. TECH. & INTELL. PROP 11 : 238 ~ 259, 2013

28 "Arvind Narayanan and Vitaly Shmatikov, Robust De-anonymization of Large Sparse Datasets" 2008 IEEE Symposium on Security and Privacy : 111 ~, 2008

29 Article 29 Data Protection Working Party, "Article 29 Data Protection Working Party, Opinion 4/2007 on the concept of personal data, 16-17" 2007

30 Michael Barbaro, "A Face is Exposed for AOL Searcher No. 4417749" N.Y. Times (2006.8.9.), 2006