earticle

영어

Anyone who collects and uses other people’s data must meet legal requirements such as prior consent from the data subject. Data controllers who can legally process other people’s data must comply with the corresponding rules. In this context, controllers also disclose and inform all matters related to the processing of such data subject. After the OECD adopted the privacy principle of transparent and fair processing, most countries have accepted it, including the EU and Korea. The data subject must know who, for what purpose, and how their data is processed in order to control their data. The data subject’s right to basic information on data processing is the prerequisite for exercising their rights to rectification, erasure, etc. However, this basic principle has been mitigated as Korea revised the Personal Information Protection Act in February 2020. The PIPA introduced an exceptional case of data processing, pseudonymization. When data controllers process pseudonymized personal data, they can process it without prior consent from the data subject and without notifying the data subject of relevant information related to the processing. Korea publicly announced it would revise the PIPA by referring to European Union’s General Data Protection Regulation. Still, GDPR does not eliminate the data controller’s obligation to notify when pseudonymized processing. Only consent is exempted if the data initially collected is pseudonymized for compatible purposes such as statistical, scientific research, or archiving purposes in the public interest. This inconsistency appears because the systems of both laws do not match perfectly even though they are much similar. This paper suggests how the PIPA guarantees the data subject’s right to basic information when processing by a comparative study between Korea’s PIPA and the EU’s GDPR. Notification of data processing is crucial in ensuring the right to informational self-determination that the PIPA should accomplish as the ultimate goal.