• Informatization Policy
• /
• v.28 no.4
• /
• pp.76-92
• /
• 2021

The value of personal information is increasing with the digital transformation of the 4th Industrial Revolution. The purpose of this study is to analyze the efficiency of personal information protection efforts of 2,000 private companies. It uses a stochastic frontier approach (SFA), a parametric estimation method that measures the absolute efficiency of protective activities. In particular, the personal information activity index is used as an output variable for efficiency analysis, with the personal information protection budget and number of personnel utilized as input variables. As a result of the analysis, efficiency is found to range from a minimum of 0.466 to a maximum of 0.949, and overall average efficiency is 0.818 (81.8%). The main causes of inefficiency include non-fulfillment of personal information management measures, lack of system for promoting personal information protection education, and non-fulfillment of obligations related to CCTV. Policy support is needed to implement safety measures and perform personal information encryption, especially customized support for small and medium-sized enterprises.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.3
• /
• pp.691-701
• /
• 2015

Recently, with the growing number of services using personal information, government offices' tasks have become more dependent to personal information. Various policies and systems have been made and managed for the safe use of personal information in the circumstances that inevitably require the use of personal information, but the personal information privacy incidents and their scale are on a constant increase. Thus, Korea has been implementing personal information protection management system since 2008 to examine whether public organizations observe the personal information protection act and to how well they manage the personal information, and to improve what is insufficient in the process. However, despite high scores of the outcomes of the system, questions about the effectiveness of the outcomes and about the actual manage level are being raised. Thus, this study seeks to analyze public organizations' activities to protect personal information and the effectiveness of their foundation efforts for them by using the DEA model, and to propose a new model to enhance the effectiveness of the outcomes of personal information protection management system by reflecting them into the outcomes of system, using the derived effectiveness.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.7 no.3
• /
• pp.558-575
• /
• 2013

The purpose of a data leakage prevention system is to protect corporate information assets. The system monitors the packet exchanges between internal systems and the Internet, filters packets according to the data security policy defined by each company, or discretionarily deletes important data included in packets in order to prevent leakage of corporate information. However, the problem arises that the system may monitor employees' personal information, thus allowing their privacy to be violated. Therefore, it is necessary to find not only a solution for detecting leakage of significant information, but also a way to minimize the leakage of internal users' personal information. In this paper, we propose two models for representing the level of personal information disclosure during data leakage detection. One model measures only the disclosure frequencies of keywords that are defined as personal data. These frequencies are used to indicate the privacy violation level. The other model represents the context of privacy violation using a private data matrix. Each row of the matrix represents the disclosure counts for personal data keywords in a given time period, and each column represents the disclosure count of a certain keyword during the entire observation interval. Using the suggested matrix model, we can represent an abstracted context of the privacy violation situation. Experiments on the privacy violation situation to demonstrate the usability of the suggested models are also presented.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.5
• /
• pp.169-179
• /
• 2011

Recent personal data breach incidences draw the public's attention to their privacy and personal rights. The new personal data protection law effective in September 2009 imposes additional legal responsibility on personal data controllers and processors. For instance, if a data breach occurs, this new law requires that the processors must notify individuals (data subjects) and data protection authorities of the nature of incidents. This research reviews the U.S. forty six state laws and related acts, and offers a framework for managing incidents. This framework includes five major components: (1) type of personal data required to be reported and notified, (2) the ultimate subject notifying data subjects, (3) event occurrence and notification time phases, (4) notification message details, and (5) direct/indirect communication media. Along with this framework, we also offer directions for effective/manageable guidelines on data breach notification act.

• Journal of Information Technology Applications and Management
• /
• v.25 no.2
• /
• pp.133-146
• /
• 2018

The technical definition of Blockchain is commonly known 'distributed ledger', however, there is no legal definition for being accepted in worldwide. Therefore, unless legal definitions and concepts of Blockchain are presented, there is a possibility that various legal disputes will occur in the future in Blockchain environment. The purpose of this study is to derive legal issues related to personal information protection that can be conflicted in Blockchain environment based on domestic Privacy Act and GDPR. The outcomes of this study can prevent various legal disputes and provide solutions that may occur due to the spread of Blockchain. It also suggests the foundation for the improvement of Privacy Act. Finally, it contributes to activate of Blockchain, industry, in Korea.

• Journal of the Korea Convergence Society
• /
• v.9 no.10
• /
• pp.55-59
• /
• 2018

Big-data, a revolutionary technology in the era of the 4th Industrial Revolution, provides services in various fields such as health, public sector, distribution, marketing, manufacturing, etc. It is very useful technology for marketing analysis and future design through accurate and quick data analysis. It is very likely to develop further. However, the biggest problem when using Big-data is privacy and privacy. When various data are analyzed using Big-data, the tendency of each user can be analyzed, and this information may be sensitive information of an individual and may invade privacy of an individual. Therefore, in this paper, we investigate the necessary measures for Personal private information infringement that may occur when using Personal private information in Big-data environment, and propose necessary Personal private information protection technologies to contribute to protection of Personal private information and privacy.

• Journal of Convergence for Information Technology
• /
• v.11 no.3
• /
• pp.20-33
• /
• 2021

This study is to suggest improvements of personal information protection in South Korea, according to requiring the safety of process and protection of personal information. Accordingly, based on data collection and analysis through literature research, this study derived the issues and suitable standards of personal information for major artificial intelligence services. In addition, this cases studies were reviewed, focusing on the legal compliance and porcessing compliance for personal information proection in major countries. And it suggested the improvement plan applied in South Korea. As the results, in legal compliance, it is required reorganization of related laws, responsibility and compliance to develop and provide AI, and operation of risk management for personal information protection laws in AI services. In terms of processing compliance, first, in pre-processing and refining, it is necessary to standardize data set reference models, control data set quality, and voluntarily label AI applications. Second, in development and utilization of algorithm, it is need to establish and apply a clear regulation of the algorithm. As such, South Korea should apply suitable improvement tasks for personal information protection of safe AI service.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.07a
• /
• pp.173-174
• /
• 2018

EU의 GDPR(General Data Protection Regulation) 발효로 인해 유럽국가의 개인 정보 데이터를 활용하는 다국적 기업들이 규정에 맞는 데이터 보호정책을 수립하고 보안 투자를 강화하고 있다. 그러나 대다수의 기업들은 해커 등에 의한 사이버 보안을 위해서는 천문학적인 투자를 하고 있지만 기업 내 많은 직원들에 의한 실수나 고의에 의한 개인 정보 유출 방지에 대해서는 대처를 하고 있지 않다. 본 논문에서는 디지털 포렌식 기반의 앤드 포인트 실시간 모니터링 및 인간 행위 분석을 통한 앤드 포인트 개인 정보 보호 기능을 제공하여 기존의 사이버 보안에 국한된 통합 보안 관제의 효율성을 높이는 방안을 제안한다.

• Journal of Convergence for Information Technology
• /
• v.11 no.12
• /
• pp.1-13
• /
• 2021

This study tried to suggest ways to improve the indicator system to strengthen the personal information protection. For this purpose, the components of indicator system are derived through domestic and foreign literature, and it was selected as main the diagnostic indicators through FGI/Delphi analysis for personal information protection experts and a survey for personal information protection officers of public institutions. As like this, this study was intended to derive an inspection standard that can be reflected as a separate index system for personal information protection, by classifying the specific IT technologies of the 4th industrial revolution, such as big data, cloud, Internet of Things, and artificial intelligence. As a result, from the planning and design stage of specific technologies, the check items for applying the PbD principle, pseudonymous information processing and de-identification measures were selected as 2 common indicators. And the checklists were consisted 2 items related Big data, 5 items related Cloud service, 5 items related IoT, and 4 items related AI. Accordingly, this study expects to be an institutional device to respond to new technological changes for the continuous development of the personal information management level diagnosis system in the future.

• Journal of the Korea Society of Computer and Information
• /
• v.29 no.6
• /
• pp.61-67
• /
• 2024

In this paper, we presented a strengthening plan to prevent personal information leakage incidents by securing legal compliance for personal information impact assessment and suggesting measures to strengthen privacy during personal information impact assessment. Recently, as various services based on big data have been created, efforts are being made to protect personal information, focusing on the EU's GDPR and Korea's Personal Information Protection Act. In this society, companies entrust processing of personal information to provide customized services based on the latest technology, but at this time, the problem of personal information leakage through consignees is seriously occurring. Therefore, the use of personal information by trustees.