개인정보의 국경 간 이전에 관한 EU 법률의 이해 - 글로벌 환경과의 조화 - = EU Law on Cross : Border Flows of Personal Data in a Global Perspective

다국어 초록 (Multilingual Abstract)

This year’s conference of the Center for Law and Public Utilities (CeLPU) explored the Law’s Evolution and Response to Data-Driven Innovation.
As a topic it connects the rise of data-intensive businesses and the global flow of data with law’s responses to these phenomena. It rekindles notions of countries’ jurisdiction and sovereignty, human rights and the corresponding need for the interoperability of legal systems. One legal sub-system that springs to our mind concerns the protection of individuals’ privacy and personal data.
Personal data is peculiar in the way it brings the dignity of a human being together with valuable economic properties. This ambiguity is the reason why personal data protection and data flows are closing in on each other in an increasingly connected and data-driven society. The EU has a key role to play in the global governance of privacy and in particularly regarding the protection of personal data. This role accrues to the EU by virtue of its external relations with third countries stretching over two policy areas for which it has exclusive competences: international transfers of personal data and external commercial policy.
This paper aims to convey EU data protection law and reflect its approach to cross-border flows of personal data in a global perspective. The argument passes through four consecutive stages: first, we will lay the necessary background in the constitutional and regulatory trajectory of personal data protection in the EU. We will proceed to revisit EU governance of cross-border flows of personal data to third countries that will help us to understand the logic of adequacy that is central to EU fundamental rights approach. Next we are going to turn our attention to the impeding stand-off between free trade agreements and domestic data protection law before we explain how the EU plans to regain consistency between its external trade and data protection policies. Last but not least, we will resolve some of the tension between cross-border digital trade and EU-style personal data protection with recourse to a study from the Privacy Bridges project family.
Grounded in the understanding of how deeply entrenched the protection of privacy and personal data have become in EU law and jurisprudence,this paper sets out to establish realistic coordinates for cross-border flows of personal data. We conclude that the EU will throw its weight behind its brand-new General Data Protection Regulation when negotiating digital trade and cross-border data flows. Building privacy bridges could offer a more realistic and constructive path forward that is to a certain extent respectful of local differences while focusing efforts on practical solutions that deliver for individuals and companies alike.

국문 초록 (Abstract)

2018년 공익산업법센터(CeLPU) 국제학술대회의 대주제는 ‘데이터 주도 혁신에 대한 법의 대응과 진화’다. 데이터를 중심으로 새로운 서비스와 산업이 증가함에 따라 국경을 넘어 활발하게 이루어지는 데이터의 흐름에 관한 법적 대응의 양상을 논하고자 하는 것이 그 핵심이다. 데이터 이전의 문제는 필연적으로 국가 주권과 관할권의 개념, 그리고 인권의 문제를 야기하기 마련이며, 이에 상응하는 법체계의 상호운용성을 필연적으로 다룰 수밖에 없다. 결국 개인의 프라이버시와 개인정보의 보호에 관한 법체계를 살펴보아야 한다.
개인정보는 인간의 존엄성과 깊은 연관성을 가짐과 동시에 경제적 가치도 가지게 되었다. 흔히 말하는 데이터 중심의 초연결시대에서 개인정보의 보호와 그러한 정보의 활용 및 이전에 관한 문제는 반드시 충돌할 수밖에 없다. 유럽연합(EU)은 프라이버시, 특히 개인정보보호에 관한 글로벌 거버넌스(global governance)의 중추를 이루고 있다. 국가 간 개인정보의 전송이 이루어지는 환경에서 특정 국가들의 대외 경제 및 무역정책은 배타적인 관계를 갖게 마련인데,유럽연합에서는 그러한 논의가 활발히 이뤄져 왔기 때문에 관련된 법체계가 빠르게 정립될 수 있었기 때문이다. 본 논문은 유럽연합의 정보보호법을 살펴보고 동 법이 개인정보의 국경 간 이전을 다루는 방식을 글로벌 관점에서 논하고자 한다. 이를 위해 필자는 먼저 유럽연합에서 개인정보를 보호하게 된 헌법적 배경을 살피고 역외 개인정보이전에 관한 유럽연합의 현행 거버넌스를 검토하였다. 나아가 자유무역협정(FTA)과 역내 정보보호법의 충돌 문제를 다룸으로써 유럽연합이 역내 시민의 정보보호와 대외 경제정책을 어떻게 조화시키고자 하는지 살펴보았다. 결론으로 프라이버시 연결 프로젝트(the Privacy Bridges Projectfamily)의 연구를 인용하며 유럽연합의 개인정보보호 정책과 국경 간 디지털 무역 사이에 존재할 수밖에 없는 긴장관계를 해결하기 위한 실마리를 제시하고자 하였다. 유럽연합의 법조계 및 법학계에서 프라이버시와 개인정보보호의 문제는 매우 깊게 다루어져 왔다. 이에 대한 이해를 도모하며 본 연구는 개인정보의 국외 이전에 대한 현실적인 좌표를 제시하고자 하였다. 유럽연합은 정보의 국외 이전과 디지털 경제의 문제를 중대하게 다룸으로써 대외 영향력을 확보하고 보편적으로 적용될 수 있는 새로운 개인정보보호 체계를 이끌 것이라고 보았다. 무엇보다 이러한 접근은 프라이버시 브릿지(privacy bridge)에 관한 제도적 토대를 마련함으로써 개인과 기업에 동등하게 적용되는 실용적인해결책을 마련하고 지역적 차이를 해소할 수 있는 방향을 제시할 수 있다.

참고문헌 (Reference)

• 1 CJEU, "joined cases C-465/00, C-138/01 and C-139/01 (Österreichischer Rundfunk)"
• 2 CJEU, "case C-362/14 (Maximillian Schrems v Data Protection Commissioner)"
• 3 CJEU, "case C-311/18 (Facebook Ireland and Schrems), pending"
• 4 CJEU, "case C-131/12 (Google Spain SL and Google Inc. v AEPD and Mario Costeja González)"
• 5 "Yakovleva and Irion (n 35)"
• 6 "Treaty on European Union articles 3(5) and 21"
• 7 European Commission, "Trade for All: Towards a More Responsible Trade and Investment Policy"
• 8 Kristina Irion, "Trade and Privacy: Complicated Bedfellows? How to Achieve Data Protection-Proof Free Trade Agreements"
• 9 Mira Burri, "The Regulation of Data Flows Through Trade Agreements" 48 : 407-, 2017
• 10 Marija Bartl, "The Japan EU Economic Partnership Agreement: Flows of Personal Data to the Land of the Rising Sun"
• 11 Svetlana Yakovleva, "The Interface between Trade and Privacy: Reconciling the European Governance of Personal Data Flows with External Trade"
• 12 European Commission, "The European Union and Japan agreed to create the world’s largest area of safe data flows, press release"
• 13 European Commission, "The European Union and Japan agreed to create the world’s largest area of safe data flows (n 27)"
• 14 Bart Van Vooren, "The EU’s Role in Global Governance The Legal Dimension" Oxford University Press 2013
• 15 Grainne de Burca, "The EU’s Role in Global Governance The Legal Dimension" Oxford University Press 2013
• 16 Kristina Irion, "The Best of Both Worlds? Free Trade in Services and EU Law on Privacy and Data Protection" 2 : 191-, 2016
• 17 Beate Roessler, "Social Dimensions of Privacy: Interdisciplinary Perspective" Cambridge University Press 2015
• 18 Stefano Rodotà, "Reinventing Data Protection?" Springer Netherlands 2009
• 19 "Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Official Journal of the European Union L 119/1-88"
• 20 Chris Marsden, "Regulating Code: Good Governance and Better Regulation in the Information Age" MIT Press 2013
• 21 Christopher Kuner, "Reality and Illusion in EU Data Transfer Regulation Post Schrems" 18 : 881-, 2017
• 22 Privacy Experts, "Privacy Bridges: EU and US Privacy Experts in Search of Transatlantic Privacy Solution"
• 23 Manon Oostveen, "Personal Data in Competition, Consumer Protection and IP Law - Towards a Holistic Approach?" Springer Press 2018
• 24 "Note that the Commission hosted three official GDPR launch events in Brussels"
• 25 Graham Greenleaf, "Japan joins APEC-CBPRs: Does it matter?" 144 : 2016
• 26 "Irion (n 13)"
• 27 "International Report, 18"
• 28 European Commission, "Horizontal provisions on cross-border data flows and personal data protection"
• 29 "Granger and Irion (n 3)"
• 30 Kristina Irion, "Gesellschaftliche Bewegungen - Recht unter Beobachtung und in Aktion: Festschrift für Wolfhard Kohte" Nomos 2016
• 31 "General Court, case T-738/16 (La Quadrature du Net and Others v Commission), pending"
• 32 Nikolaj Nielson, "GDPR - a global ‘gold standard?"
• 33 "GDPR"
• 34 Cedric Villani, "For a Meaningful Artificial Intelligence:Towards a French and European Strategy"
• 35 McKinsey Global Institute, "Digital Globalization: The New Era of Global Flow"
• 36 "Comprehensive and Progressive Agreement for Trans-Pacific Partnership between Australia, Brunei, Canada, Chile, Japan, Malaysia, Mexico, New Zealand, Peru, Singapore, Vietnam"
• 37 European Commission, "Communication from the Commission to the European Parliament and the Council:Exchanging and Protecting Personal Data in a Globalised World COM(2017)7 Final"
• 38 "Commission Implementing Decision of 12.7.2016 Pursuant t o Directive 95/46/EC of the European Parliament and of the Council on the Adequacy of the Protection Provided by the EU-U.S. Privacy Shield"
• 39 Marie-Pierre Granger, "Civil Rights and EU Citizenship" Edward Elgar Publishing 279-302, 2018
• 40 "Charter of Fundamental Rights of the European Union, 2010 Official Journal of the European Union C 83/02"
• 41 "CJEU (Schrems v Data Protection Commissioner) (fn. 14), para. 73"
• 42 "Art. 45 (2)(a) GDPR"
• 43 Susan Ariel Aaronson, "Another Digital Divide:The Rise of Data Realms and Its Implications for the WTO" 21 : 245-, 2018
• 44 "APEC Cross-border privacy rules system"
• 45 Avi Goldfarb, "AI and International Trade"
• 46 Kristina Irion, "A Roadmap to Enhancing User Control via Privacy Dashboards"