EU 적정성 결정에 따른 개인정보보호위원회 고시인 보완규정의 법적 분석 = Legal Analysis of the Personal Information Protection Commission’s Public Notice: the Supplementary Rules Adopted in Relation to the EU Adequacy Decision

다국어 초록 (Multilingual Abstract)

In December 2021, the European Commission of the European Union adopted the adequacy decision on the data protection of the Rep. of Korea(Korea). The adequacy decision means that the personal information of the EU citizens and residents may freely be transferred to Korea. The Personal Information Protection Commission of Korea adopted the public notice which is the supplementary rules applicable to the personal information transferred from the EU to Korea for the interpretation and application of the Personal Information Protection Act(PIPA). This public notice(‘Supplementary Rules’) became effective upon the adoption of the adequacy decision by the European Commission. This public notice or the Supplementary Rules is identical to the Annex I of the adequacy decision.
The Supplementary Rules is a legal instrument which was regarded necessary in relation to the adoption of the adequacy decision, but it has some interpretations of some of important provisions of the PIPA. For example, it is to note that the PIPA provisions on the limitation to out-of-purpose use and provision of personal information applies to the personal information transferred from third countries as well as from the EU. However, some of the Supplementary Rules’ interpretations seem to go beyond the legal meanings and legislative contexts of the PIPA. For example, the Supplementary Rules interpret Article 17(4) on the provision of personal information for the purposes compatible to the original ones to be a legal basis for the provision of personal information to third parties abroad. However, considering the legal meanings of GDPR Article 6(4), a model of the PIPA Article 17(4), and the legislative context of the latter during the so-called ‘three data law amendment’, this interpretation of the Supplementary Rules is certain to be excessive and immoderate. Further, the PIPA does not require the destruction of pseudonymized personal information, when achieving its purpose of processing, but the Supplementary Rules interprets that personal information transferred to Korea on the basis of the adequacy decision, including its pseudonymized personal information, should be destroyed when its purpose is achieved. It is a serious matter that the PIPA does not require the destruction of such personal information at present, but it is also another serious matter that the public notice exceeds the PIPA, which is at a higher status than itself.
In addition, the Supplementary Rules’ interpretation in relation to the analysis of personal information related to national security in Article 58(1)(i) of the PIPA seems to be most wrongful. Article 58(1) of the PIPA provides that Chapters III through VII are not applicable in this case. The provisions of those chapters are most important substantive provisions of the PIPA. However, the Supplementary Rules interprets that Article 3 of Chapter I on the principles of data protection is still applicable in lieu of those chapters including Chapters III and V on the processing of personal information and the guarantee of data subjects’ rights respectively. Article 58(4) still provides how to process personal information to benefit the protection of data subjects in this case, although it may be at a minimum. For national security purposes, however, the government department concerned should devise and implement those relevant measures stipulated in Article 58(4) of the PIPA.
It is certain to find that the Supplementary Rules wrongly goes well beyond the legal meanings and legislative contexts of the PIPA in the name of interpretation to benefit the personal information transferred from the EU. The Supplementary Rules, the public notice of the Personal Information Protection Commission, should be revised to interpret the PIPA to fulfill the legal system’s purpose: legal expectation and stability.

참고문헌 (Reference)

• 1 "헌재 2005.7.21. 2003헌마282 결정"
• 2 "헌재 2005.5.26. 99헌마513 결정"
• 3 임영호, "행정판례연구 XII" 2007
• 4 홍정선, "행정법특강" 박영사 2014
• 5 개인정보보호위원회, "한국, EU 개인정보보호 적정성 결정 최종 통과"
• 6 "서울고등법원 2008.1.16. 선고, 2006나92006 판결"
• 7 "대법원 1999.1.26. 선고, 97다10215, 10222 판결"
• 8 남상택, "고시의 법적 성격에 관한 재고찰 – 판례를 중심으로" 2014
• 9 개인정보보호위원회, "개인정보위, 국정원에 개인정보보호 관련 법규 준수 권고"
• 10 박노형, "개인정보보호법" 박영사 2020
• 11 European Commission, "Exchanging and Protecting Personal Data in a Globalised World, COM(2017) 7 final"
• 12 박노형, "EU개인정보보호법-GDPR을 중심으로" 박영사 2017
• 13 European Commission, "Commission Implementing Decision of 17.12.2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act" 65 : 2022
• 14 개인정보보호위원회, "2020 개인정보 보호 법령 및 지침·고시 해설" 2020