• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.13 no.3
• /
• pp.250-261
• /
• 2020

Today, data subjects should be considered to utilize various personal data. To support this paradigm, the concept of "My Data" has proposed and has realized in various industrial sectors, including medial sectors. Based on the concept of the medical My Data, this paper proposes a personal health record (PHR) and an electronic medical record (EMR) data trading model. Particularly, this paper proposes a system model to support the medical My Data environment and relevant procedure among stakeholders for PHR/EMR data trading that ensures the rights of data subjects. Based on the proposed system model, this paper also proposes various mathematical models to analyze the behavior of stakeholders and shows the feasibility of the proposed data trading model that satisfies the requirements of both data subjects and data consumers.

• The Journal of the Korea Contents Association
• /
• v.9 no.12
• /
• pp.787-796
• /
• 2009

The electronic commerce keeps going through a tremendous growth since the latter half of 1990's. But the consumer damages are being increased from characteristics such as non-confrontation, anonymity, internationality, unilaterality and possibility of temptation. Accordingly, this thesis has derived legal and systematic improvements for consumer protection in general as follows. First of all, it is necessary to extend the period to exercise the subscription withdrawal rights according to electronic commerce consumer protection law. Second, the electronic commerce has high possibility of causing errors by consumers because it is performed by non-confrontation and the accurate information must be provided to prevent errors in advance because it is not easy for consumers to prove their own errors. Third, a certification mark system on electronic agreement has to be adopted. Fourth, the legal, systematic and technological measures have to be adopted to prevent from having a sense of fear toward leaking or using personal information through a safe personal information management. Fifth, a strict supervision on internet trust mark is required. Finally, because the intervention or interference by a third party may take place through a hacking on messages or documents sent according to procedure in terms of online settlement, it is necessary to raise security on the system through a precise authentication between concerned parties.

• Asia pacific journal of information systems
• /
• v.22 no.1
• /
• pp.53-77
• /
• 2012

Financial firms, especially large scaled firms such as KB bank, NH bank, Samsung Card, Hana SK Card, Hyundai Capital, Shinhan Card, etc. should be securely dealing with the personal financial information. Indeed, people have tended to believe that those big financial companies are relatively safer in terms of information security than typical small and medium sized firms in other industries. However, the recent incidents of personal information privacy invasion showed that this may not be true. Financial firms have increased the investment of information protection and security, and they are trying to prevent the information privacy invasion accidents by doing all the necessary efforts. This paper studies how effectively a financial firm will be able to avoid personal financial information privacy invasion that may be deliberately caused by internal staffs. Although there are several literatures relating to information security, to our knowledge, this is the first study to focus on the behavior of internal staffs. The big financial firms are doing variety of information security activities to protect personal information. This study is to confirm what types of such activities actually work well. The primary research model of this paper is based on Theory of Planned Behavior (TPB) that describes the rational choice of human behavior. Also, a variety of activities to protect the personal information of financial firms, especially credit card companies with the most customer information, were modeled by the four-step process Security Action Cycle (SAC) that Straub and Welke (1998) claimed. Through this proposed conceptual research model, we study whether information security activities of each step could suppress personal information abuse. Also, by measuring the morality of internal staffs, we checked whether the act of information privacy invasion caused by internal staff is in fact a serious criminal behavior or just a kind of unethical behavior. In addition, we also checked whether there was the cognition difference of the moral level between internal staffs and the customers. Research subjects were customer call center operators in one of the big credit card company. We have used multiple regression analysis. Our results showed that the punishment of the remedy activities, among the firm's information security activities, had the most obvious effects of preventing the information abuse (or privacy invasion) by internal staff. Somewhat effective tools were the prevention activities that limited the physical accessibility of non-authorities to the system of customers' personal information database. Some examples of the prevention activities are to make the procedure of access rights complex and to enhance security instrument. We also found that 'the unnecessary information searches out of work' as the behavior of information abuse occurred frequently by internal staffs. They perceived these behaviors somewhat minor criminal or just unethical action rather than a serious criminal behavior. Also, there existed the big cognition difference of the moral level between internal staffs and the public (customers). Based on the findings of our research, we should expect that this paper help practically to prevent privacy invasion and to protect personal information properly by raising the effectiveness of information security activities of finance firms. Also, we expect that our suggestions can be utilized to effectively improve personnel management and to cope with internal security threats in the overall information security management system.

• Informatization Policy
• /
• v.28 no.4
• /
• pp.54-75
• /
• 2021

The right to data portability needs to be introduced to strengthen the self-control of data subjects and promote personal data use. However, the right to data portability constitutes a high risk of invasion of privacy of data subjects and may infringe on the property rights of data controllers, so careful and thorough design is warranted. The right to data portability can intensify the concentration and monopoly of personal data, result in problems of overseas transfer of personal data held by public institutions, and enrich only the profits of giant platforms by burdening the data subject with high transfer cost. By contrast, SMEs are more likely to endure a personal data deprivation. From the proposed amendment to the Personal Data Protection Act are raised various legal issues such as. i) Whether to include inferred/derived data, personal data held by public institutions, activity data, sensitive data, and personal data of third parties within the scope of data portability; ii) whether SMEs are included in the data porting organization; iii) whether to exclude SMEs or large platforms from the scope of the data receiving organization; iv) Whether to allow the right to transmit to other data controllers, v) Whether to allow the overseas transfer of personal data held by public institutions, vi) How to safely exercise the right to data portability, vii) the scope of responsibility and immunity of a data porting organization, etc. The purpose of this paper is to propose the direction for legislative action based on various legal issues related to data portability.

• Journal of Wellbeing Management and Applied Psychology
• /
• v.6 no.4
• /
• pp.1-10
• /
• 2023

Purpose: As an important provision to protect the rights and interests of low-income groups, it is worth studying whether the minimum wage policy can improve the quality of life for people. Research design, data and methodology: Using data from the 2015 and 2017 China General Social Survey (CGSS), this paper employs the logit model to estimate the probability of an individual's annual income being higher than the per capita disposable income of their province. It also utilizes the DID model to analyze the impact of minimum wage increases on individuals' annual incomes. Results: The analysis reveals that an overall increase in the minimum wage raises the probability of an individual's annual income exceeding the per capita disposable income by 3%. Among them, the probability increased by 2.2% for males and by 3.2% for females. Furthermore, the impact of the minimum wage on annual income varies depending on the individual's income level. Notably, the most positive and significant impact is observed for individuals whose income level is close to the minimum wage standard. Conclusions: This provides evidence that the increase in the minimum wage has effectively improved the quality of life for the population.

• The Korean Journal of Air & Space Law and Policy
• /
• v.35 no.2
• /
• pp.75-111
• /
• 2020

The civilian drone world has evolved in recent years from one dominated by hobbyists to growing involvement by companies seeking to profit from unmanned flight in everything from infrastructure inspections to drone deliveries that are already subject to regulations. Drone flight under the property right relation with the land owner would be deemed legal on the condition that expeditious and innocent passage of drone flight over the land be assured. The United Nations Convention on the Law of the Sea (UNCLOS) enshrines the concept of innocent passage through a coastal state's territorial sea. Passage is innocent so long as it is not prejudicial to the peace, good order or security of the coastal state. A vessel in innocent passage may traverse the coastal state's territorial sea continuously and expeditiously, not stopping or anchoring except in force majeure situations. However, the disturbances caused by drone flight may be removed, which is defined as infringement against the constitutional interest of personal rights. For example, aggressive infringement against privacy and personal freedom may be committed by drone more easily than ever before, and than other means. The cost-benefit analysis, however, has been recognjzed as effective criteria regarding the removal of disturbances or injunction decision. Applying that analysis, the civil action against such infringement may not find suitable basis for making a good case. Because the removal of such infringement through civil actions may result in only the deletion of journal article. The injunction of drone flight before taking the information would not be obtainable through civil action, Therefore, more detailed and meticulous regulation and criteria in public law domain may be preferable than civil action, at present time. It may be suitable for legal stability and drone industry to set up the detailed public regulations restricting the free flight of drone capable of acquiring visual information amounting to the infrigement against the right of personal information security.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.4
• /
• pp.973-983
• /
• 2016

It's been almost 6 years since PIA was implemented based on legislation. So I analyzed problems of PIA from the perspective of ITSM 3 elements. I mainly took account of quality improvement of the report when I assessed systems processing personal informations. So, I propose in terms of logical validity improvement of assessment report. The improvements on 4 different outputs for each phase are many cases that I assessed systems processing personal informations. And I propose improvements on qualified assessors having capability of GRC and on process for managing the assessment system. To settle down PIA system as the reasonable and effective assessment system even after 2016, the statutory deadline for completion of PIA, assessors and appointed assessment firms and authorities should cooperate to complete the assessment system.

• The Journal of Information Systems
• /
• v.28 no.4
• /
• pp.65-103
• /
• 2019

Purpose The purpose of this study is to find out in extent to which the companies in Korea and oversea, which has been subjected by different laws of their country, have guaranteed the personal information rights and have provided proper 'right to access' to the information subjects. Design/methodology/approach This study compared Korean laws with 'General Data Protection Regulation (GDPR)' of EU and 'California Consumer Privacy Act (CCPA)' to check each of the level of 'right to access' guarantee. In terms of the difference in guaranteeing the right, this study compared Korean IT leading companies with US global leading IT companies to find out how much 'right to access' are properly implemented in their policies and functions they provide. Findings The result of the study shows that 'right to access' has not been well guaranteed by Korean law, as it does not provide the right to choose method and medium by information subjects and does not clarify the types of diverse information. This was clearly opposite with the other laws providing the right to choose what method and medium that subjects want with clarifying every types of personal information possible to be more. In addition, 'right to access' has not been well guaranteed by Korean companies in comparison with by the oversea companies which proactively guarantee the right by setting the function enabling subjects to browse their information through their websites or applications.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.14 no.3
• /
• pp.45-53
• /
• 2018

The Personal Information Protection Act has been revised continuously since its establishment, and as a way to secure stability properly, the guidelines as well as enforcement ordinances and regulations have been changed, too. It seems that people's recognition and awareness of private information have already evolved to a certain level that is regarded to be fairly high. However, no one can exactly imagine how much ripple effect scrapping discarded paper regarded simply as waste material which is often and easily practiced in our everyday lives exerts and how many socially significant events it may arouse in our lives. Private information is produced, operated, preserved, utilized, distributed within the frame of law unidentified, and then discarded with a particular purpose. While going through a series of processes, each piece of that private information comes to be reproduced melting a lot of information. It is used and also changed beneficially sometimes to richen our lives or as basic material for welfare. Meanwhile, its importance is decided by its weight or mass and then often gets discarded after all. It means that the process of disuse is being done in a way to arouse the possibility of invasion of personal rights and also the second and third and also more exposure of private information. Therefore, approaching the meaning of automation politically, this study aims to suggest how to secure stability in the process of discarding private information in terms of logical automation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.6
• /
• pp.981-997
• /
• 2020

Blockchain technology can provide a high level security based on a decentralized distributed ledger and consensus-based structure. In order to increase the utilization of blockchain technology, it is necessary to find a way to use it in fields that require personal data processing such as health care and e-commerce. To achieve this goal, the blockchain based system should be able to comply with data privacy regulations represented by European Union(EU)'s GDPR(General Data Protection Regulation). However, because of the properties of the blockchain like the immutability and decentralized recorded data, it is difficult to technically implement the requirements of the existing privacy regulations on the blockchain. In this paper, we propose a multi-chain based access control system that can guarantee the rights of the personal data subject required by GDPR by utilizing Chameleon Hash and Attribute Based Encryption (ABE). Finally, we will show through security analysis that our system can handle personal data while maintaining confidentiality and integrity.