• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.2
• /
• pp.305-312
• /
• 2020

The Privacy Act stipulates that the privacy policy document, which is a privacy statement, should be disclosed in order to guarantee the rights of the information subjects, and the Fair Trade Commission considers the privacy policy as a condition and conducts an unfair review of the terms and conditions under the Terms and Conditions Control Act. However, the information subjects tend not to read personal information because it is complicated and difficult to understand. Simple and legible information processing policies will increase the probability of participating in online transactions, contributing to the increase in corporate sales and resolving the problem of information asymmetry between operators and information entities. In this study, complex personal information processing policies are analyzed using deep learning, and models are presented for acquiring simplified personal information processing policies that are highly readable by the information subjects. To present the model, the personal information processing policies of 258 domestic companies were established as data sets and analyzed using deep learning technology.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.15 no.6
• /
• pp.267-273
• /
• 2015

For newly incoming technologies owing to the advancements in information and communications technology, the new form of information occurs due to the combination form of personal information. In turn, personal information which is combination with existing personal information is on the increase. It is difficult to equalize the method in order to analysis the degree of risk for personal information because it is qualitative method which is defined on the current Personal Information Protection Law. This dissertation presents the model to assess the degree of risk by using the IPA(Importance-Performance Analysis) after measuring the importance and the weighted value for the personal information based on the existing the method of risk assessment. Through the model suggested in this dissertation, the subjective judgement can be excluded, the combination of personal information can be assessed and the standard criteria which is used as the objective indicators from the quantitative degree of risk can be suggested.

• Review of KIISC
• /
• v.23 no.4
• /
• pp.7-14
• /
• 2013

영업비밀 관련 또는 특허문제로 소송이 빈번하게 발생하는 요즘 특허 전쟁에 있어서도 해당 정보를 적절하게 보호하고 유지하기 위한 특허정보 관리체계에 있어서의 정보보안은 매우 중요한 요인으로 인식되고 있다. 이러한 상황에서 보안사고가 발생했을 경우, 이에 효과적으로 대응하기 위한 방안들에 대해 기업 전반에 걸쳐 인지될 필요성 또한 부각되고 있으며 이를 가능하게 해주는 방안으로 국제인증 기준이 떠오르고 있다. 각종 정보보호의 중요성에 따른 기업 관리시스템들이 이러한 인증체계를 도입 및 운영하고 있는 추세이며 이를 뒷받침 해주기 위해 특허법을 비롯하여 관련 컴플라이언스를 준수하기 위한 개인정보보호법(안전성 확보조치), 정보통신망 이용촉진 및 정보보호 등에 관한 법률과 같은 정보보호 법률을 기준으로 제시할 수 있다. 사례 기업에서는 이 중 정보보호 국제인증의 대표격인 ISO27001을 바탕으로 현재 특허관련 기업에 필요한 정보보호관리체계를 정립 및 적용하였다. 해당 정보보호 관리체계는 특허관련 업무분장에서 주요하게 다루어지지 않았던 기술적, 관리적, 물리적 보안에 대한 부적합사항을 충족시키고 특허정보보호업무, 감사업무, 검사업무, 전산운영 등 분산된 업무를 일관된 업무로 통합하는 효과적인 관리체계가 될 수 있음을 제시하였다.

• The Korean Society of Law and Medicine
• /
• v.17 no.2
• /
• pp.315-346
• /
• 2016

With the development of big data processing technology, the potential value of healthcare big data has attracted much attention. In order to realize these potential values, various research using the healthcare big data are essential. However, the big data regulatory system centered on the Personal Information Protection Act does not take into account the aspect of big data as an economic material and causes many obstacles to utilize it as a research purpose. The regulatory system of healthcare information, centered on the primary purpose of patient treatment, should be improved in a way that is compatible with the development of technology and easy to use for public interest. To this end, it is necessary to examine the trends of overseas legal system reflecting the concerns about the balance of protection and utilization of personal information. Based on the implications of the overseas legal system, we can derive improvement points in the following directions from our legal system. First, a legal system that specializes in healthcare information and encompasses protection and utilization is needed. De-identification, which is an exception to the Privacy Act, should also clearly define its level. It is necessary to establish a legal basis for linking healthcare big data to create synergy effects in research. It is also necessary to examine the introduction of the opt-out system on the basis of the discussion on the foreign debate and social consensus. But most importantly, it is the people's trust in these systems.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.1
• /
• pp.247-257
• /
• 2016

It is required to have Personal Information Agreement when a financial company uses personal information by the Law of Privacy. So, financial companies have to demand customers the submission of Personal Information Agreement. Thus, financial companies have made Personal Information Agreement in various formats for customers. However, financial companies are lack of a verification process, the cases of collecting invalid Agreement often occurred. This study focuses on the verification process of Personal Information Agreement and the contents of Personal Information Agreement. In conclusion, this study proposes an improved model that added to the process of verification for the concept of Agreement. Based on this study, I hope financial companies to reform their agreement process and to improve the effectiveness on the implementation of Personal Information Utilization Agreement.

• The Journal of Korean Institute of Information Technology
• /
• v.17 no.5
• /
• pp.129-136
• /
• 2019

Many IoT devices like sensors lack screen and input devices, thus making them hard to meet the consent conditions that GDPR requires. This is acting as a legal barrier for further advancement in the business field. In this paper, we designed the process for consent of personal information collection that meets the legal conditions. In this design, user's personal data is received in an encrypted form by data collecting server first. The encrypted personal data can be decrypted after associating with user agent based on the consent procedure of the collection of personal information. During the consent procedure, user agent understands the privacy policy about personal information collection and offers the key to decrypt the data. This kind of personal information collection agreement procedure will satisfy the transparent and freely given consent requirements of GDPR. Thus, we can speculate from here that the proposed procedure will contribute to the evolution of IoT business area dealing with personal information.

• The Journal of Korean Institute of Next Generation Computing
• /
• v.13 no.2
• /
• pp.7-17
• /
• 2017

In this paper, we propose the TPS (TPM-enhanced Privacy Protection System) which is an automated privacy protection system enhanced with a TPM (Trusted Platform Module). The TPS detects documents including personal information by periodic scanning the disk of clients at regular intervals and encrypts them. Hence, system manages the encrypted documents in the server. In particular, the security of TPS was greatly enhanced by limiting the access of documents including the personal information with regard to the client in an abnormal state through the TPM-based platform verification mechanism of the client system. In addition, we proposed and implemented a VTF (Virtual Trusted File) interface to provide users with the almost identical user interface as general document access even though documents containing personal information are encrypted and stored on the remote server. Consequently, the TPS automates the compliance of the personal information protection acts without additional users' interventions.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.3
• /
• pp.691-701
• /
• 2015

Recently, with the growing number of services using personal information, government offices' tasks have become more dependent to personal information. Various policies and systems have been made and managed for the safe use of personal information in the circumstances that inevitably require the use of personal information, but the personal information privacy incidents and their scale are on a constant increase. Thus, Korea has been implementing personal information protection management system since 2008 to examine whether public organizations observe the personal information protection act and to how well they manage the personal information, and to improve what is insufficient in the process. However, despite high scores of the outcomes of the system, questions about the effectiveness of the outcomes and about the actual manage level are being raised. Thus, this study seeks to analyze public organizations' activities to protect personal information and the effectiveness of their foundation efforts for them by using the DEA model, and to propose a new model to enhance the effectiveness of the outcomes of personal information protection management system by reflecting them into the outcomes of system, using the derived effectiveness.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.4
• /
• pp.801-809
• /
• 2024

In the digital age, the importance of personal information has magnified, underscoring the need for enhanced personal information protection, especially within public institutions. Despite ongoing efforts since 2007, significant breaches in public sector information underline persistent vulnerabilities. This study advocates for a transition from a diagnostic to an assessment framework to fortify privacy management in public institutions, as mandated by recent legislative revisions. The amended Personal Information Protection Act introduces an assessment approach, aiming to comprehensively assess and mitigate risks by expanding the scope of evaluation and implementing robust regulatory measures. This study examines the limitations of the current diagnostic practices through literature review and case analysis and proposes a systematic approach to adopting the new assesment system. By enhancing the assessment framework, the study expects to improve the effectiveness of personal information management in public institutions, thereby restoring public trust and ensuring a stable progression into a more secure digital era. The transition to an assessment system is designed not only to address the gaps in the current framework but also to provide a methodical assessment that supports ongoing improvement and compliance with enhanced legal standards.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.5
• /
• pp.169-179
• /
• 2011

Recent personal data breach incidences draw the public's attention to their privacy and personal rights. The new personal data protection law effective in September 2009 imposes additional legal responsibility on personal data controllers and processors. For instance, if a data breach occurs, this new law requires that the processors must notify individuals (data subjects) and data protection authorities of the nature of incidents. This research reviews the U.S. forty six state laws and related acts, and offers a framework for managing incidents. This framework includes five major components: (1) type of personal data required to be reported and notified, (2) the ultimate subject notifying data subjects, (3) event occurrence and notification time phases, (4) notification message details, and (5) direct/indirect communication media. Along with this framework, we also offer directions for effective/manageable guidelines on data breach notification act.