• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.637-651
• /
• 2017

In order for a financial company to collect personal information, it explicitly notifies consumers of the contents stipulated by law and gets consent beforehand. As a result, as financial products became more complicated and diverse, and the contents of 'Consent form for providing personal information' became more complicated and more. In particular, in the case of internet or mobile, the letter became smaller as the screen size limit, making it more difficult to understand. This is because almost all companies that collecting personal information are in a similar situation, In the position of consumers who use services are, contradictions arise that habitually agree without understanding the consent contents. In this research, in order to present a consent policy establishment decision-making model to rationally collect and use personal information through the Internet website of financial companies, consider the domestic and foreign legal system Then, derive a problem To present improvement measures. In addition, the evaluation factors selected through the research are verified by presenting decision making models and formulas using AHP (Analytic Hierarchy Process) method.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.2
• /
• pp.263-277
• /
• 2020

Children's use of the Internet is growing. Each company collects children's personal information. However, it is also difficult for children to recognize the concept of personal information. In this study, based on the analysis of newspaper children's personal information leakage, we investigated the occurrence of personal information leakage in children through ground theory, one of qualitative research methods used in the social science field. The ground theory is thought to be able to derive a causal relationship by identifying the leakage of children's personal information. As a result of the study, it was collected through the consent of the legal representative, but depending on the situation, the consent process was not performed. Even with the consent, it was found that due to insufficient measure to protect personal information, various situation(criminal damage, anxiety, embarrassment, anger, etc.) occurred the legal representative. As a result, children's personal information collection providers paid fines according to the situation.

• The Korean Society of Law and Medicine
• /
• v.13 no.1
• /
• pp.359-395
• /
• 2012

In a broad term, health and medical data means all patient information that has been generated or circulated in government health and medical policies, such as medical research and public health, and all sorts of health and medical fields as well as patients' personal data, referred as medical data (filled out as medical record forms) by medical institutions. The kinds of health and medical data in medical records are prescribed by Articles on required medical data and the terms of recordkeeping in the Enforcement Decree of the Medical Service Act. As EMR, OCS, LIS, telemedicine and u-health emerges, sharing and protecting digital health and medical data is at issue in these days. At medical institutions, health and medical data, such as medical records, is classified as "sensitive information" and thus is protected strictly. However, due to the circulative property of information, health and medical data can be public as well as being private. The legal grounds of health and medical data as such are based on the right to informational self-determination, which is one of the fundamental rights derived from the Constitution. In there, patients' rights to refuse the collection of information, to control recordkeeping (to demand access, correction or deletion) and to control using and sharing of information are rooted. In any processing of health and medical data, such as generating, recording, storing, using or disposing, privacy can be violated in many ways, including the leakage, forgery, falsification or abuse of information. That is why laws, such as the Medical Service Act and the Personal Data Protection Law, and the Guideline for Protection of Personal Data at Medical Institutions (by the Ministry of Health and Welfare) provide for technical, physical, administrative and legal safeguards on those who handle personal data (health and medical information-processing personnel and medical institutions). The Personal Data Protection Law provides for the collection, use and sharing of personal data, and the regulation thereon, the disposal of information, the means of receiving consent, and the regulation of processing of personal data. On the contrary, health and medical data can be inspected or delivered of the copies, based on the principle of restriction on fundamental rights prescribed by the Constitution. For instance, Article 21(Access to Record) of the Medical Service Act, and the Personal Data Protection Law prescribe self-disclosure, the release of information by family members or by laws, the exchange of medical data due to patient transfer, the secondary use of medical data, such as medical research, and the release of information and the release of information required by the Personal Data Protection Law.

• Journal of Digital Convergence
• /
• v.18 no.10
• /
• pp.23-31
• /
• 2020

As children's participation in online activities has recently increased, online services for children are also rapidly increasing, but children are not sufficiently guaranteed their rights. The purpose of this study is to classify and analyze issues related to the children's online privacy issues in Korea through the current status and case studies of application services mainly used by children. For this purpose, this research analyzed problems related to the children's online privacy protection according to the stage of using the application. As a result of the application content analysis, 1) issues of child identification, 2) effectiveness of notice and consent, and 3) issues of children's rights as subjects of information were derived. Based on the current status analysis, the policy implications were drawn based on the children's online privacy protection in the online environment, and suggestions were made for improvement.

• The Korean Society of Law and Medicine
• /
• v.23 no.4
• /
• pp.29-74
• /
• 2022

As social disasters occur under the Disaster Management Act, which can damage the people's "life, body, and property" due to the rapid spread and spread of unexpected COVID-19 infectious diseases in 2020, information collected through inspection and reporting of infectious disease pathogens (Article 11), epidemiological investigation (Article 18), epidemiological investigation for vaccination (Article 29), artificial technology, and prevention policy Decision), (3) It was used as an important basis for decision-making in the context of an infectious disease crisis, such as promoting vaccination and understanding the current status of damage. In addition, medical policy decisions using infectious disease data contribute to quarantine policy decisions, information provision, drug development, and research technology development, and interest in the legal scope and limitations of using infectious disease data has increased worldwide. The use of infectious disease data can be classified for the purpose of spreading and blocking infectious diseases, prevention, management, and treatment of infectious diseases, and the use of information will be more widely made in the context of an infectious disease crisis. In particular, as the serious stage of the Disaster Management Act continues, the processing of personal identification information and sensitive information becomes an important issue. Information on "medical records, vaccination drugs, vaccination, underlying diseases, health rankings, long-term care recognition grades, pregnancy, etc." needs to be interpreted. In the case of "prevention, management, and treatment of infectious diseases", it is difficult to clearly define the concept of medical practicesThe types of actions are judged based on "legislative purposes, academic principles, expertise, and social norms," but the balance of legal interests should be based on the need for data use in quarantine policies and urgent judgment in public health crises. Specifically, the speed and degree of transmission of infectious diseases in a crisis, whether the purpose can be achieved without processing sensitive information, whether it unfairly violates the interests of third parties or information subjects, and the effectiveness of introducing quarantine policies through processing sensitive information can be used as major evaluation factors. On the other hand, the collection, provision, and use of infectious disease data for research purposes will be used through pseudonym processing under the Personal Information Protection Act, consent under the Bioethics Act and deliberation by the Institutional Bioethics Committee, and data provision deliberation committee. Therefore, the use of research purposes is recognized as long as procedural validity is secured as it is reviewed by the pseudonym processing and data review committee, the consent of the information subject, and the institutional bioethics review committee. However, the burden on research managers should be reduced by clarifying the pseudonymization or anonymization procedures, the introduction or consent procedures of the comprehensive consent system and the opt-out system should be clearly prepared, and the procedure for re-identifying or securing security that may arise from technological development should be clearly defined.

• The Journal of the Korea Contents Association
• /
• v.21 no.9
• /
• pp.176-183
• /
• 2021

Digital medical technology is very effective and at the same time faces the challenge of protecting privacy. However, for contact tracking and exposure notification apps in COVID-19 environment, there is always a trade-off between privacy measures and the effectiveness of the app's use. Today, many countries have developed and used contact tracking and exposure notification apps in various forms to prevent the spread of COVID-19, but the suspicion of digital surveillance (digital panopticon) is unavoidable. Therefore, this study aims to identify the factors of personal information infringement and dissatisfaction through text mining analysis by extracting user reviews of "Self-Quarantine Safety Protection" in Korea. As a result of the text mining analysis, we derived four groups, 'Address recognition error', 'Exit warning error', 'Access error', and 'App. program error'. Since 'Address recognition error' and 'Exit warning error' can give the app users a strong perception that they are keeping under surveillanc by the app, transparent management of personal information protection and consent procedures related to personal information collection are required. In addition, if the other two groups are not corrected immediately due to an error in an app function or a program bug, the complaints of users can be maximized and a protest against the monitor can be raised.

• Asia pacific journal of information systems
• /
• v.22 no.4
• /
• pp.7-29
• /
• 2012

Smartphone and its applications (i.e. apps) are increasingly penetrating consumer markets. According to a recent report from Korea Communications Commission, nearly 50% of mobile subscribers in South Korea are smartphone users that accounts for over 25 million people. In particular, the importance of smartphone has risen as a geospatially-aware device that provides various location-based services (LBS) equipped with GPS capability. The popular LBS include map and navigation, traffic and transportation updates, shopping and coupon services, and location-sensitive social network services. Overall, the emerging location-based smartphone apps (LBA) offer significant value by providing greater connectivity, personalization, and information and entertainment in a location-specific context. Conversely, the rapid growth of LBA and their benefits have been accompanied by concerns over the collection and dissemination of individual users' personal information through ongoing tracking of their location, identity, preferences, and social behaviors. The majority of LBA users tend to agree and consent to the LBA provider's terms and privacy policy on use of location data to get the immediate services. This tendency further increases the potential risks of unprotected exposure of personal information and serious invasion and breaches of individual privacy. To address the complex issues surrounding LBA particularly from the user's behavioral perspective, this study applied the privacy calculus model (PCM) to explore the factors that influence the adoption of LBA. According to PCM, consumers are engaged in a dynamic adjustment process in which privacy risks are weighted against benefits of information disclosure. Consistent with the principal notion of PCM, we investigated how individual users make a risk-benefit assessment under which personalized service and locatability act as benefit-side factors and information privacy risks act as a risk-side factor accompanying LBA adoption. In addition, we consider the moderating role of trust on the service providers in the prohibiting effects of privacy risks on user intention to adopt LBA. Further we include perceived ease of use and usefulness as additional constructs to examine whether the technology acceptance model (TAM) can be applied in the context of LBA adoption. The research model with ten (10) hypotheses was tested using data gathered from 98 respondents through a quasi-experimental survey method. During the survey, each participant was asked to navigate the website where the experimental simulation of a LBA allows the participant to purchase time-and-location sensitive discounted tickets for nearby stores. Structural equations modeling using partial least square validated the instrument and the proposed model. The results showed that six (6) out of ten (10) hypotheses were supported. On the subject of the core PCM, H2 (locatability ${\rightarrow}$ intention to use LBA) and H3 (privacy risks ${\rightarrow}$ intention to use LBA) were supported, while H1 (personalization ${\rightarrow}$ intention to use LBA) was not supported. Further, we could not any interaction effects (personalization X privacy risks, H4 & locatability X privacy risks, H5) on the intention to use LBA. In terms of privacy risks and trust, as mentioned above we found the significant negative influence from privacy risks on intention to use (H3), but positive influence from trust, which supported H6 (trust ${\rightarrow}$ intention to use LBA). The moderating effect of trust on the negative relationship between privacy risks and intention to use LBA was tested and confirmed by supporting H7 (privacy risks X trust ${\rightarrow}$ intention to use LBA). The two hypotheses regarding to the TAM, including H8 (perceived ease of use ${\rightarrow}$ perceived usefulness) and H9 (perceived ease of use ${\rightarrow}$ intention to use LBA) were supported; however, H10 (perceived effectiveness ${\rightarrow}$ intention to use LBA) was not supported. Results of this study offer the following key findings and implications. First the application of PCM was found to be a good analysis framework in the context of LBA adoption. Many of the hypotheses in the model were confirmed and the high value of $R^2$ (i.,e., 51%) indicated a good fit of the model. In particular, locatability and privacy risks are found to be the appropriate PCM-based antecedent variables. Second, the existence of moderating effect of trust on service provider suggests that the same marginal change in the level of privacy risks may differentially influence the intention to use LBA. That is, while the privacy risks increasingly become important social issues and will negatively influence the intention to use LBA, it is critical for LBA providers to build consumer trust and confidence to successfully mitigate this negative impact. Lastly, we could not find sufficient evidence that the intention to use LBA is influenced by perceived usefulness, which has been very well supported in most previous TAM research. This may suggest that more future research should examine the validity of applying TAM and further extend or modify it in the context of LBA or other similar smartphone apps.

• Journal of Science and Technology Studies
• /
• v.17 no.1
• /
• pp.117-144
• /
• 2017

In Korea, currently, only the growth possibility of bioinformation industry has received the public attention, and social discussion on bioinformation management is meager. Based on this critical perspective, this study investigates the current status of public awareness of the bioinformation which can be a basis for the social discussion for bioinformation management. The most significant characteristics identified in the survey is that many citizens, while expressing their agreement on the use of biometric technology by purpose and taking an open stance on national fingerprint information collection, have considerable concern for the identity authentication system using the current biometric technology. In particular, the survey pointed out that it is hard to trust the institutions that collect the bioinformation. Also, the public expressed the particular concern for the health data including the body information and showed overwhelming consent for the necessity of more stringent regulation compared with other personal information. In regards to the medical information gathered from medical institutions, nearly 80% of the survey respondents did not agree on providing the information to commercial enterprises, and even 60% of them disagreed on using it for academic and statistical research. This result well demonstrates that thorough management of the bioinformation is required for its utilization.