• The Journal of Society for e-Business Studies
• /
• v.19 no.4
• /
• pp.135-150
• /
• 2014

As the collection and use of personal information increases, the accidents that abuse and leak personal information are continuously increasing. The nation has established new laws and strengthened related laws for the prevention of the mass leakage of personal information and the secondary damage due to the leaked personal information. The nation also established the guidelines that need to be implemented by the institutions handling personal information for the safety of the personal information. For the efficient implementation of guidelines under the limited time and resources, it is necessary to establish the priorities between guidelines. This paper compares the relative importance of the guidelines by AHP (Analytic Hierarchy Process) technique. We performed the analysis on two expert groups, the group of consultants working in information security consulting company and the group of information security staffs handling personal information directly in the company. We compared the differences between groups and recommended the relative importances of the guidelines.

• Convergence Security Journal
• /
• v.23 no.1
• /
• pp.35-43
• /
• 2023

Since the Personal Information Protection Act was enacted in 2011, it has played a role in safely protecting people's personal information and protecting their rights. Personal information controller must comply with the duty of safeguards for safe personal information management. Even though administrative regulation is an accompanying issue, it is not clear to whom, when and how it applies. According to the imposition of duties, the scope, standards, safety measures, procedures, etc. for the target person should be clearly and specifically specified, but the current legal system is insufficient .In this study, problems and reasonable improvement plans were presented for the classification criteria for applicable subjects, the criteria for the criteria for determining the targets, and the criteria for measures to ensure safety. Through this, we intend to contribute to enhancing the effectiveness of the system by presenting reasonable measures by clarifying and specifying the scope and standards of application.

• Convergence Security Journal
• /
• v.18 no.3
• /
• pp.87-94
• /
• 2018

Privacy means the right not to interfere with the private life of an individual. Bio data is the most private personal information about the person itself, and according to advancement of technology, it is possible to analyze and judge individual as well as identify individual. The Personal Information Protection Act is based on global privacy principles, but the legislation for the protection of bio information has yet to be enacted. Therefore, it is time to protect biometric data as more sensitive information than general personal information. We will review the global privacy discussions for protecting biometric information and propose additional privacy principles and measures for utilization that should be defined in the biometric information protection guideline.

• Convergence Security Journal
• /
• v.11 no.5
• /
• pp.99-108
• /
• 2011

The purpose of this study is to profile actual conditions of personal information protection systems operated in overseas countries and examine major considerations of personal information that security service providers must know in the capacity of privacy information processor, so that it may contribute to preventing potential occurrence of any legal disputes in advance. Particularly, this study further seeks to describe fundamental idea and principle of said Personal Information Protection Act; enhancement of various safety measures (e.g. collection / use of privacy data, processing of sensitive information / personal ID information, and encryption of privacy information); restrictions on installation / operation of video data processing devices; and penal regulations as a means of countermeasure against leakage of personal information, while proposing possible solutions to cope with these matters. Using cases among foreign countries for this study. Possible solutions proposed by this study can be summed up as follows: By changing minds with sufficient legal reviews, it is required for security service providers to 1) clearly and further specify any purposes of collecting and using privacy information, if possible, 2) obtain any privacy information by legitimate means as it is necessary to collect such information, 3) stop providing any personal information for the 3rd parties or for any other purposes except fundamental purposes of using privacy information, and 4) have full knowledge about duty of safety measure in accordance with safe maintenance of privacy information and protect any personal information from unwanted or intentional leakage to others.

• Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology
• /
• v.6 no.7
• /
• pp.17-26
• /
• 2016

Information spill was occurred several times in the country due to the negligence of the large internet service providers including SK Communications, Auction, KT. In order to judge the Internet Service Provider(ISP)'s liability in individual data spill caused by hacking, the violation of existing legislation or general principle of law's good faith principle has to be examined. However, based on current ISP's good faith principle, there is no objective standard for judging liability. Such uncertain range of protection action duty based on good faith principle generates complaint toward companies, therefore presentation of objective judgement range index on how to determine this range is needed. However due to the legal characteristic of above-mentioned law, it is not possible to fix the range of protection action duty and regulate it on law. In order to resolve this, rather than concerning simply on legal system level, fusion approach method is needed. Thus, this research will discuss the measure for objective standard for predicting ISP's range of protection action duty through fusion view dividing in technical, legal and administrative aspects.

• Informatization Policy
• /
• v.28 no.4
• /
• pp.76-92
• /
• 2021

The value of personal information is increasing with the digital transformation of the 4th Industrial Revolution. The purpose of this study is to analyze the efficiency of personal information protection efforts of 2,000 private companies. It uses a stochastic frontier approach (SFA), a parametric estimation method that measures the absolute efficiency of protective activities. In particular, the personal information activity index is used as an output variable for efficiency analysis, with the personal information protection budget and number of personnel utilized as input variables. As a result of the analysis, efficiency is found to range from a minimum of 0.466 to a maximum of 0.949, and overall average efficiency is 0.818 (81.8%). The main causes of inefficiency include non-fulfillment of personal information management measures, lack of system for promoting personal information protection education, and non-fulfillment of obligations related to CCTV. Policy support is needed to implement safety measures and perform personal information encryption, especially customized support for small and medium-sized enterprises.

• Journal of Digital Convergence
• /
• v.12 no.7
• /
• pp.1-10
• /
• 2014

In February 2014 Korean Bar Association has amended Professional Ethics Code as to stipulate attorney's duty to protect personal information. While existing Korean law and Professional Ethics Code has made attorney to keep client's confidential information, attorney's newly promulgated obligation has its meaning in that personal information of subject other than client is not protected through confidentiality rules, given that confidentiality obligation is interpreted to protect only client's information relating to representation. Moreover, duty to protect personal information deals with not only disclosure and use of information, which confidentiality rules is about, but also collection and retention process, access to and correction and care of information and even destruction of information. Amid unprecedented theft of personal data in several national banks and other serious leakage reported recently, this paper is going to contemplate the scope and application of the duty to protect personal information with hope to contribute to starting discussion on it.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2016.10a
• /
• pp.297-300
• /
• 2016

최근 빅데이터 산업이 발전하고 있는 상황에서 빅데이터 산업에 활용되는 개인정보의 보호에 관한 문제가 대두하고 있다. 빅데이터 산업에서 개인정보를 활용하기 위해서는 비식별화 조치를 해야 한다. 하지만 비식별화는 비식별화 평가 모델 자체의 취약성과 더불어 비식별화된 개인정보를 재식별화 하는 위험성도 존재한다. 본 논문은 적정성 평가 모델, 비식별화 조치 기술, 재식별에 관한 위험성을 연구하고 각 위험성에 대한 대응 방안을 통해 재식별화의 문제를 해결하여 빅데이터 산업에서 비식별화된 개인정보가 안전히 쓰일 수 있도록 해야 한다.

• Journal of Convergence for Information Technology
• /
• v.11 no.3
• /
• pp.20-33
• /
• 2021

This study is to suggest improvements of personal information protection in South Korea, according to requiring the safety of process and protection of personal information. Accordingly, based on data collection and analysis through literature research, this study derived the issues and suitable standards of personal information for major artificial intelligence services. In addition, this cases studies were reviewed, focusing on the legal compliance and porcessing compliance for personal information proection in major countries. And it suggested the improvement plan applied in South Korea. As the results, in legal compliance, it is required reorganization of related laws, responsibility and compliance to develop and provide AI, and operation of risk management for personal information protection laws in AI services. In terms of processing compliance, first, in pre-processing and refining, it is necessary to standardize data set reference models, control data set quality, and voluntarily label AI applications. Second, in development and utilization of algorithm, it is need to establish and apply a clear regulation of the algorithm. As such, South Korea should apply suitable improvement tasks for personal information protection of safe AI service.

• Review of KIISC
• /
• v.19 no.6
• /
• pp.9-14
• /
• 2009

IT 기술이 발전함에 따라 인터넷을 통한 개인정보의 수집 이용이 용이해지고 있다. 하지만 이에 대한 역기능으로 웹사이트를 통하여 개인정보가 노출되어 공개되어 있거나, 악의적인 사용자에 의해 개인정보가 유출되어 악용되는 사건이 지속적으로 발생하고 있다. 이렇게 노출 및 유출이 된 개인정보는 오 남용이 되어 국민에게 정신적 금전적 피해를 준다. 이를 해결하기 위해 한국인터넷진흥원은 2006년부터 인터넷 상의 개인정보 노출에 대해 지속적인 삭제조치 등의 노력을 하고 있으나 여전히 개인정보가 노출되고 있다. 따라서, 한국인터넷진흥원은 개인정보 노출을 최소화하기 위해 예방 대응 사후 관리를 종합적으로 할 수 있도록 "개인정보 노출대응 체계(Privacy Incident Response SysTem)"를 2009년 11월에 구축하여, 개인정보를 신속히 검색하여 삭제 및 대응할 수 있는 체계를 마련하였다. 본 논문에서는 개인정보 노출대응 체계에 대하여 소개하고자 한다.