• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.2
• /
• pp.587-608
• /
• 2022

The European Union recently established the General Data Protection Regulation (GDPR) for secure data use and personal information protection. Inspired by this, South Korea revised their Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and the Credit Information Use and Protection Act, collectively known as the "Three Data Bills," which prescribe safe personal information use based on pseudonymous data processing. Based on these bills, the personal data store (PDS) has received attention because it utilizes the MyData service, which actively manages and controls personal information based on the approval of individuals, and it practically ensures their rights to informational self-determination. Various types of PDS models have been developed by several countries (e.g., the US, Europe, and Japan) and global platform firms. The South Korean government has now initiated MyData service projects for personal information use in the financial field, focusing on personal credit information management. There is also a need to verify the efficacy of this service in diverse fields (e.g., medical). However, despite the increased attention, existing MyData models and frameworks do not satisfy security requirements of ensured traceability, transparency, and distributed authentication for personal information use. This study analyzes primary PDS models and compares them to an internationally standardized framework for personal information security with guidelines on MyData so that a proper PDS model can be proposed for South Korea.

• The Korean Society of Law and Medicine
• /
• v.13 no.1
• /
• pp.359-395
• /
• 2012

In a broad term, health and medical data means all patient information that has been generated or circulated in government health and medical policies, such as medical research and public health, and all sorts of health and medical fields as well as patients' personal data, referred as medical data (filled out as medical record forms) by medical institutions. The kinds of health and medical data in medical records are prescribed by Articles on required medical data and the terms of recordkeeping in the Enforcement Decree of the Medical Service Act. As EMR, OCS, LIS, telemedicine and u-health emerges, sharing and protecting digital health and medical data is at issue in these days. At medical institutions, health and medical data, such as medical records, is classified as "sensitive information" and thus is protected strictly. However, due to the circulative property of information, health and medical data can be public as well as being private. The legal grounds of health and medical data as such are based on the right to informational self-determination, which is one of the fundamental rights derived from the Constitution. In there, patients' rights to refuse the collection of information, to control recordkeeping (to demand access, correction or deletion) and to control using and sharing of information are rooted. In any processing of health and medical data, such as generating, recording, storing, using or disposing, privacy can be violated in many ways, including the leakage, forgery, falsification or abuse of information. That is why laws, such as the Medical Service Act and the Personal Data Protection Law, and the Guideline for Protection of Personal Data at Medical Institutions (by the Ministry of Health and Welfare) provide for technical, physical, administrative and legal safeguards on those who handle personal data (health and medical information-processing personnel and medical institutions). The Personal Data Protection Law provides for the collection, use and sharing of personal data, and the regulation thereon, the disposal of information, the means of receiving consent, and the regulation of processing of personal data. On the contrary, health and medical data can be inspected or delivered of the copies, based on the principle of restriction on fundamental rights prescribed by the Constitution. For instance, Article 21(Access to Record) of the Medical Service Act, and the Personal Data Protection Law prescribe self-disclosure, the release of information by family members or by laws, the exchange of medical data due to patient transfer, the secondary use of medical data, such as medical research, and the release of information and the release of information required by the Personal Data Protection Law.

• Journal of Information Technology Applications and Management
• /
• v.16 no.4
• /
• pp.79-92
• /
• 2009

With the rising reliance on market estimation through customer analysis in customer-centered marketing, there is a rapid increase in the amount of personal data owned by corporations. There has been a corresponding rise in the customers' interest in personal information protection, and the problem of personal information leakage has risen as a serious issue. The purpose of this research is to develop a diagnosis model for personal information protection that is suited to our country's corporate environment, and on this basis, to present diagnostic instruments that can be applied to domestic corporations. This diagnosis model is a structural equation model that schematizes the degree of synthetic effect that administration factors and estimation items have on the protection of personal information owned by corporations. We develop the model- consisting of the administration factors for personal information protection and the measurement items of each factor- using the development method of standardized structural equation model. We then present a tool through which the administration factors and estimation items verified through this model can be used in the diagnosis for personal information protection in corporations. This diagnostic tool can be utilized as a useful instrument to prevent in advance the leakage of personal information in corporations.

• Journal of Information Technology Services
• /
• v.19 no.1
• /
• pp.37-53
• /
• 2020

Today, our society is exposed to cyber threats, such as the leakage of personal information, as various systems are connected and operated organically with the development of information and communication technology. With the impact of these cyber risks, we are experiencing damage from the virtual world to the physical world. As the number of cases of damage caused by cyber attacks has continued to rise, social voices have risen that the government needs to manage cyber risks. Thus, information and telecommunication service providers are now mandatory to have insurance against personal information protection due to amendment of "the Act on Promotion of Information and Communication Network Utilization and Information Protection". However, the insurance management system has not been properly prepared, with information and communication service providers selecting the service operators based on sales volume rather than selecting them based on the type and amount of personal information they store and manage. In order for the personal information protection liability insurance system to be used more effectively in line with the legislative purpose, effective countermeasures such as cooperation with the government and related organizations and provision of benefits for insured companies should be prepared. Thus, the author of this study discuss the current status of personal information protection liability insurance system and the issues raised in the operation of the system. Based on the results of this analysis, the authors propsoe tasks and plans to establish an effective personal information protection liability insurance system.

• Journal of the Korea Society of Computer and Information
• /
• v.23 no.11
• /
• pp.185-191
• /
• 2018

The purpose of this study is to present effective basic data for business management through analysis of importance and performance of personal information protection of the elderly welfare center workers. For this purpose, the questionnaire on the protection of personal information was reconstructed based on the diagnostic level of the personal information security management level of the public institution and the questionnaire was conducted on 105 employees of the elderly welfare center in Chungbuk area. Based on the responses to the importance and the degree of performance of the personal information protection of the elderly welfare center employees, technical statistics and corresponding sample T-tests were conducted and the importance-performance analysis (IPA) was used. Followings are the results of this study: First, there is a statistically significant difference between the importance and the implementation of the management system for the protection of personal information of the workers in the elderly welfare center, establishment and implementation of protection measures, establishment and implementation of infringement measures. Second, IPA analysis on the protection of personal information of the workers in the elderly welfare center shows that the establishment and implementation of protection measures are the areas to maintain good performance. Third, in IPA analysis of the sub-factors of the personal information protection of the workers in the welfare center of the elderly, in the construction and management of the management system, in performing the role of the personal information protection officer and establishing and implementing protection measures, The factors of prevention of information disclosure and exposure and the safe use and management of personal information processing system were analyzed as areas requiring intensive improvement. This study is meaningful as a basic research that can raise the awareness of the personal information protection of the workers in the elderly welfare center and induce the improvement of the related work.

• International Commerce and Information Review
• /
• v.1 no.2
• /
• pp.249-271
• /
• 1999

This article deals with concept and theory of privacy and personal data on the basis of understanding of this matter, Especially concerns the infringement and protection of privacy and personal data that is violated by new media and electronic commercial transaction through case study and research of literature. The article seek to find out the resolution of legal problems on the protection of privacy and personal data. The resolution is in other words, that privacy and personal data protection law shall be established as a part of efforts to protect personal data and to activate electronic commercial transactions.

• Journal of Information Technology Services
• /
• v.22 no.6
• /
• pp.1-15
• /
• 2023

This study compares and analyzes the legal systems of Korea, the European Union, China, and the United States based on the disclosure principles and processing policies for personal data processing and provides references for seeking improvements in our legal system. Furthermore, this research aims to suggest institutional implications to overcome data transfer limitations in the upcoming digital economy. Findings on a comparative analysis of the relevant legal systems for disclosing privacy policies in four countries showed that Korea's privacy policy is under the eight principles of privacy proposed by the OECD. However, there are limitations in the current situation where personal information is increasingly transferred overseas due to direct international trade e-commerce. On the other hand, the European Union enacted the General Data Protection Regulation (GDPR) in 2016 and emphasized the transfer of personal information under the Privacy Policy. China also showed differences in the inclusion of required items in its privacy policy based on its values and principles regarding transferring personal information and handling sensitive information. The U.S. CPRA amended §1798.135 of the CCPA to add a section on the processing of sensitive information, requiring companies to disclose how they limit the use of sensitive information and limit the use of such data, thereby strengthening the protection of data providers' rights to sensitive information. Thus, we should review our privacy policies to specify detailed standards for the privacy policy items required by data providers in the era of digital economy and digital commerce. In addition, privacy-related organizations and stakeholders should analyze the legal systems and items related to the principles of personal data disclosure and privacy policies in major countries so that personal data providers can be more conveniently and accurately informed about processing their personal information.

• Informatization Policy
• /
• v.28 no.1
• /
• pp.64-76
• /
• 2021

The purposes of this study are to identify factors that affect personal information protection activities from the perspective of personal information managers and explore ways of promoting such activities. The main factors examined by threat and response assessments were selected based on the protection motivation theory, and the effects of each factor were analyzed using a multinomial logit model. The analysis results show that small-scale personal information managers need to be provided with both educational support to enhance their awareness and technical support, such as protection inspection tools, to help them carry out their own personal information protection activities. Personal information managers larger than a certain size also require tax support, including tax cuts, to support their budgets for and investments in personal information protection activities. In addition, they need professional education that emphasizes practice.

• Journal of Korean Clinical Nursing Research
• /
• v.29 no.3
• /
• pp.261-270
• /
• 2023

Purpose: This study aimed to identify the influence of knowledge of personal information protection law and nursing patient advocacy on practice of personal information protection among nurses. Methods: The subjects were 130 nurses who have worked for six months or more in the ward of the tertiary or general hospitals. Data were collected from February 20 to March 3, 2023. Results: Factors influencing practice of personal information protection were acting as an advocate (β=.32, p=.004), environmental and educational influences (β=.21, p=.040), knowledge of personal information protection law (β=.19, p=.013) and clinical experience for five years or more but less than ten years (β=.17, p=.036). The regression model showed an explanatory power of 34.0%. Conclusion: Acting as an advocate has the most effect on practice of personal information protection. To promote practice of personal information protection for nurses, it is necessary to provide education related to privacy protection and encourage nursing patient advocacy.

• Journal of Convergence for Information Technology
• /
• v.8 no.1
• /
• pp.179-185
• /
• 2018

Big Data is strictly positioning one of method to deal with problems faced with mankind, not an icon of revolution in future anymore. Application of Big Data and protection of personal information have contradictoriness. When we weight more to usage of Big Data, someone's privacy is necessarily invaded. otherwise, we care more about keeping safe of individual information, only low-level of research using Big Data can be used to accomplish public purpose. In this study, we propose a method to anonymize Big Data collected in order to investigate the problems of personal information infringement and utilize Big Data and protect personal. This will solve the problem of personal information infringement as well as utilizing Big Data.