This paper is aimed at constitutional review on Personal Data Protection Act, which was enacted on March 29, 2011 to protect individuals` privacy from collection, leakage, misuse and abuse of personal data. The Act is marked by following features. Fir...
This paper is aimed at constitutional review on Personal Data Protection Act, which was enacted on March 29, 2011 to protect individuals` privacy from collection, leakage, misuse and abuse of personal data. The Act is marked by following features. First, in regard to personal data protection, it is an integrated law that applies to both pubic and private sector. However, in my opinion, individuals`privacy can be more widely protected by separate approach to each of public and private sector. As private sector is based on the equal relationship between private entities, we should focus on public sector where freedom of individuals can be violated unilaterally by the exercise of state power. Second, the data subject`s consent is a key element of Personal Data Protection Act. However, we cannot guarantee the validity of the consent. In order to regard the consent as valid, the data subject should know about the object of the consent, and have the right to choose whether to give consent and the scope of the consent. In reality, either one of these criteria are not being satisfied. Third, Personal Data Protection Act imposes criminal punishment for almost every law violation. It states that the violation can be punished by imprisonment up to ten years, which shows the level of the punishment is also significantly high. Imposing criminal punishment for the violation of processing of personal data without clearly defining the concept of personal data is against the principle of legality, which requires the elements of the statute that imposes punishment to be clear so that one with sound common sense and a reasonable sense of law should know specifically which act is prohibited. In the information society, personal data is not only an object of protection but also that of use. Personal Data Protection Act lacks in the sense of balance between two conflicting values, personal data protection and freedom of information.