Implications of GDPR and EU Adequacy Decision for Regulation of Profiling and Automated Decision-making in Korea

다국어 초록 (Multilingual Abstract)

Despite the outsized role of artificial intelligence in the processing of personal data in the age of 4IR, South Korea does not have cross-sector data protection regulations concerning the automated processing of personal data. The European Union’s General Data Protection Regulation (GDPR), on the other hand, prohibits solely automated decision-making subject to certain limited exceptions and requires appropriate safeguards when processing personal data based on such exceptions. Significant gaps in the South Korean and EU regulations on automated processing could potentially be an issue in the European Commission’s evaluation (i.e., re-examination) of the South Korean GDPR adequacy decision.
A GDPR adequacy decision, which permits the transfer of EU data subjects’ personal data to the relevant recipient country, is based on a finding by the European Commission that such country’s data privacy laws afford essentially the same protections regarding the transferred personal data as the GDPR. The adequacy decision for South Korea went into effect in December 2021 and will be subject to evaluation within three years from the effective date. While the lack of regulations specifically addressing automated decision-making did not serve as a deal breaker in the original adequacy decision, it is highly likely that the issue will be subject to closer scrutiny in future negotiations between the European Union and South Korea on adequacy.
This paper analyzes the regulations on automated processing (including profiling) under the GDPR and Korean law, and makes suggestions for improving Korean regulations and enforcement practice for closer alignment with the GDPR, which is emerging as a de facto global standard. Relevant requirements should be enacted through a cross-sectoral statute like PIPA rather than merely through subordinate legislation or sector-specific laws. Although the Korean government has already submitted a bill to amend PIPA that contains regulations on solely automated decision-making, such draft amendment departs from the GDPR standard on a number of issues. These include no explicit right to human intervention or duty to provide meaningful information about the logic involved, and no regulation of profiling as a separate concept. Moreover, a duty to provide meaningful information on the logic involved may be of limited utility without clearer guidance on transparency requirements as well as measures to induce voluntary compliance with such guidance. Overall, it would be desirable for the regulators to undertake organizational measures to heighten their expertise and competence over AI issues.

참고문헌 (Reference)

• 1 개인정보보호위원회, "한국으로 이전된 개인정보의 처리와 관련된 개인정보보호법의 해석과 적용을 위한 보완규정)"
• 2 안수현, "인공지능(AI)의 발전에 따른 보험업 법제 정비 방향과 과제" 보험연구원 2021
• 3 개인정보보호위원회, "인공지능(AI) 개인정보보호 자율점검표"
• 4 한국사회여론연구소, "의원발의 법률안에 대한 입법부와 행정부의 협의방식에 관한 연구" 법제처 2007
• 5 박주현, "유럽사법재판소 ‘Schrems II’ 판결의 한국 GDPR 적정성 평가에 대한 시사점 – 공공기관의 개인정보처리에 대한 제한 중심으로 –" 한국법학원 192 : 242-271, 2022
• 6 임규철, "사물인터넷과 블록체인 시대에 있어 개인정보보호법제의 최근 동향과 과제 ― 국내의 개인정보보호법과 GDPR을 중심으로 ―" 미국헌법학회 29 (29): 195-239, 2018
• 7 박광배 ; 채성희 ; 김현진, "빅데이터 시대 생성정보의 처리 체계 - 추론된 정보의 처리에 관한 우리 개인정보보호법의 규율과 개선 방안에 관한 고찰 -" 한국정보법학회 21 (21): 159-201, 2017
• 8 박노형 ; 정명현, "빅데이터 분석기술 활성화를 위한 개인정보보호법의 개선 방안 - EU GDPR과의 비교 분석을 중심으로 -" 법학연구원 (85) : 1-39, 2017
• 9 양수진, "국내외 개인정보보호정책의 비교분석을 통한 프로파일링 관련 소비자 이슈의 고찰과 적용" 한국경쟁법학회 43 : 297-321, 2021
• 10 방송통신위원회, "개인정보 처리에서의 프로파일링사례집" 2020
• 11 대한민국정부, "개인정보 보호법 일부개정법률안"
• 12 개인정보보호위원회, "개인정보 보호 법령 및 지침·고시 해설서"
• 13 Yavar Bathaee, "The Artificial Intelligence Black Box and the Failure of Intent and Causation" Harvard Law School 2018
• 14 European Parliament & European Council, "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data"
• 15 European Commission, "Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonized Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts"
• 16 European Data Protection Board, "Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea"
• 17 European Data Protection Board, "Opinion 28/2018 regarding the European Commission Draft Implementing Decision on the adequate protection of personal data in Japan"
• 18 Article 29 Data Protection Working Party, "Guidelines on transparency under Regulation 2016/679"
• 19 Article 29 Data Protection Working Party, "Guidelines on consent under Regulation 2016/679"
• 20 Article 29 Data Protection Working Party, "Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679"
• 21 김재완, "EU 일반정보보호규정(GDPR)의 알고리즘 자동화 의사결정에 대한 통제로써 설명을 요구할 권리에 대한 쟁점 분석과 전망" 민주주의법학연구회 (69) : 277-298, 2019
• 22 박효주 ; 양진홍, "EU 개인정보보호 적정성평가 이슈와 정책 대응 방안" 한국통신학회 44 (44): 983-991, 2019
• 23 Christiana Markou, "EU Internet Law" Springer 2017
• 24 Michael Kim, "Data Protection: Korea" aosphere 2020
• 25 Privacy International, "Data Is Power: Profiling and Automated Decision-Making in GDPR"
• 26 Sandra Wachter, "Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR" Harvard Law School 2018
• 27 European Commission, "Commission Implementing Decision of 17. 12. 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act"
• 28 Ronan Hamon, "Bridging the Gap Between AI and Explainability in the GDPR: Towards Trustworthiness-by-Design in Automated Decision-Making" IEEE Press 2022
• 29 이언컨설팅그룹, "AI보안 법·제도·정책 현황 및 전망" 한국인터넷진흥원 2021
• 30 우라옥, "AI-지적재산권의 관점에서" 11 : 2021
• 31 윤수영, "4차 산업 혁명 시대의 소비자 데이터 주권에 대한 고찰: EU GDPR을 중심으로" 한국소비자학회 29 (29): 93-115, 2018