• Journal of Internet Computing and Services
• /
• v.16 no.4
• /
• pp.149-156
• /
• 2015

The Personal Information Protection Commission shall be established under the direct jurisdiction of the President and shall independently perform affairs under its authority. It shall be comprised of total 15 members (5 members designated by the President, 5 members elected at the National Assembly and 5 members designated by the Chief Justice of the Supreme Court), including one minister-level Chairperson and one vice-minister-level standing member. Main functions of the Personal Information Protection Commission include deliberation and resolution of major policies and improvement of ordinances and systems related to personal information protection, coordination of opinions among public institutions in regards to the management of personal information, recommendation of improvement such as suspension of infringement by a central administrative agency, a local government and a constitutional institution, and submission of annual reports on personal information protection to the National Assembly. The function and role of the Personal Information Protection Commission regulated by the current law are insufficient in terms of independence and authorities of protection agencies compared to the international standard or level of discussion. The Commission thus cannot play a sufficient role as an independent agency for efficient protection of personal information. Therefore, there is a need for law revision that revives the purpose of the establishment of the Personal Information Protection Commission.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.1
• /
• pp.215-227
• /
• 2018

As Korea is rapidly becoming an IT powerhouse in the short term, various side effects such as cyber violence, personal information leakage and cyber terrorism are emerging as new social problems. Especially, the seriousness of leakage of personal information, which is the basis of safe cyber life, has been highlighted all over the world. In this regard, it is necessary to estimate the amount of the damage cost due to the leakage of personal information. In this study, we propose four evaluation methods to calculate the cost of damages due to personal information leakage according to average real transactions value, personally recognized value, compensation amount basis, and comparison to similar countries. We analyzed data from 2007 to 2016 to collect personal information leakage cases for 10 years and estimated the cost of damages. The number of cases used in the estimation is 65, and the total number of personal information leakage is about 430 million. The estimated cost of personal information leakage in 2016 was estimated to be at least KRW 7.4 billion, up to KRW 220 billion, and the 10 year average was estimated at from KRW 10.7 billion to KRW 307 billion per year. Also, we could find out the singularity that the estimated damage due to personal information leakage increases every three years. In the future, this study will be able to provide an index that can measure the damage cost caused by the leakage of personal information more accurately, and it can be used as an index of measures to reduce the damage cost due to personal information leakage.

• Korean Journal of Child Studies
• /
• v.37 no.6
• /
• pp.119-132
• /
• 2016

Objective: The purpose of this study was to analyze the operation and personal information management of public and private kindergarten homepages. Methods: A total of 2,846 kindergartens were selected from the I-Sarang portal service for analyzing operation, and 217 self-operating homepages were selected for evaluating management. Seven evaluation items from three domains (information gathering procedures and scope, information security, and management of file exposure protection) were used. Wireshark and Google were used for analyzing some evaluation items. Results: The operating ratio of kindergarten homepages was low and most of the kindergartens self-operated their homepages. The evaluation of the information gathering procedures and scope showed that the rule of consent process was not rigidly followed but that the rule of legality for information gathering was followed. Items related to information security were followed at very low levels. As for the management of file exposure protection, the evaluation of items related to the prevention of attachment disclosure showed that the rule of protecting personal information included in an attached file was followed but that the notice regarding information protection was not. Across all evaluation items, the level of personal information management was higher in public (vs. private) kindergartens. Conclusion: These results indicate methods to more securely and effectively manage personal information on kindergarten homepages.

• Journal of Digital Convergence
• /
• v.12 no.7
• /
• pp.1-10
• /
• 2014

In February 2014 Korean Bar Association has amended Professional Ethics Code as to stipulate attorney's duty to protect personal information. While existing Korean law and Professional Ethics Code has made attorney to keep client's confidential information, attorney's newly promulgated obligation has its meaning in that personal information of subject other than client is not protected through confidentiality rules, given that confidentiality obligation is interpreted to protect only client's information relating to representation. Moreover, duty to protect personal information deals with not only disclosure and use of information, which confidentiality rules is about, but also collection and retention process, access to and correction and care of information and even destruction of information. Amid unprecedented theft of personal data in several national banks and other serious leakage reported recently, this paper is going to contemplate the scope and application of the duty to protect personal information with hope to contribute to starting discussion on it.

• Informatization Policy
• /
• v.28 no.4
• /
• pp.76-92
• /
• 2021

The value of personal information is increasing with the digital transformation of the 4th Industrial Revolution. The purpose of this study is to analyze the efficiency of personal information protection efforts of 2,000 private companies. It uses a stochastic frontier approach (SFA), a parametric estimation method that measures the absolute efficiency of protective activities. In particular, the personal information activity index is used as an output variable for efficiency analysis, with the personal information protection budget and number of personnel utilized as input variables. As a result of the analysis, efficiency is found to range from a minimum of 0.466 to a maximum of 0.949, and overall average efficiency is 0.818 (81.8%). The main causes of inefficiency include non-fulfillment of personal information management measures, lack of system for promoting personal information protection education, and non-fulfillment of obligations related to CCTV. Policy support is needed to implement safety measures and perform personal information encryption, especially customized support for small and medium-sized enterprises.

• Journal of Korean Society for Quality Management
• /
• v.39 no.3
• /
• pp.432-443
• /
• 2011

The purpose of this research is to understand users' information protection behavior on personal information security from health psychology theory perspectives. Empirical results indicate that users' information protection behavior on personal information is predicted by perceived threat and perceived responsiveness. Perceived threat is determined by perceived susceptibility and perceived severity. Perceived responsiveness is determined by response efficacy and self-efficacy, but response cost is not significant. These findings provide an enriched understanding about users' information protection behavior on personal information security.

• The Journal of Korean Institute of Information Technology
• /
• v.17 no.5
• /
• pp.129-136
• /
• 2019

Many IoT devices like sensors lack screen and input devices, thus making them hard to meet the consent conditions that GDPR requires. This is acting as a legal barrier for further advancement in the business field. In this paper, we designed the process for consent of personal information collection that meets the legal conditions. In this design, user's personal data is received in an encrypted form by data collecting server first. The encrypted personal data can be decrypted after associating with user agent based on the consent procedure of the collection of personal information. During the consent procedure, user agent understands the privacy policy about personal information collection and offers the key to decrypt the data. This kind of personal information collection agreement procedure will satisfy the transparent and freely given consent requirements of GDPR. Thus, we can speculate from here that the proposed procedure will contribute to the evolution of IoT business area dealing with personal information.

• Journal of Information Technology Services
• /
• v.22 no.6
• /
• pp.1-15
• /
• 2023

This study compares and analyzes the legal systems of Korea, the European Union, China, and the United States based on the disclosure principles and processing policies for personal data processing and provides references for seeking improvements in our legal system. Furthermore, this research aims to suggest institutional implications to overcome data transfer limitations in the upcoming digital economy. Findings on a comparative analysis of the relevant legal systems for disclosing privacy policies in four countries showed that Korea's privacy policy is under the eight principles of privacy proposed by the OECD. However, there are limitations in the current situation where personal information is increasingly transferred overseas due to direct international trade e-commerce. On the other hand, the European Union enacted the General Data Protection Regulation (GDPR) in 2016 and emphasized the transfer of personal information under the Privacy Policy. China also showed differences in the inclusion of required items in its privacy policy based on its values and principles regarding transferring personal information and handling sensitive information. The U.S. CPRA amended §1798.135 of the CCPA to add a section on the processing of sensitive information, requiring companies to disclose how they limit the use of sensitive information and limit the use of such data, thereby strengthening the protection of data providers' rights to sensitive information. Thus, we should review our privacy policies to specify detailed standards for the privacy policy items required by data providers in the era of digital economy and digital commerce. In addition, privacy-related organizations and stakeholders should analyze the legal systems and items related to the principles of personal data disclosure and privacy policies in major countries so that personal data providers can be more conveniently and accurately informed about processing their personal information.

• Journal of The Korean Association of Information Education
• /
• v.19 no.3
• /
• pp.299-310
• /
• 2015

This study was conducted with the goal to identify the degree to which elementary school students' knowledge about personal information protection practices impacted their actual behavior with regard to privacy protection. To fulfill this goal, knowledge about personal information protection was set as (1) knowledge about concepts of personal information, (2) knowledge of the rights of information holders, (3) knowledge about the code of conduct for information protection, and (4) awareness of the value of personal information. As for students' behaviors to ensure their personal information protection those were set as their habits to comply with the personal in-formation protection code of conduct and their efforts to respond and recover from any personal information violation. This study was conducted targeting 510 elementary students. The degree of the students' knowledge and their behaviors was measured by first distributing a self-report survey to the students and then analyzing their responses. The results of the analysis revealed the following: First, it was found that there are no differences among the four factors of knowledge and behavior according to the status of their education. Second, the two factors that primarily affected their personal information protection behavior were found to be their awareness of the information protection code of conduct and awareness of the value of personal information. This study holds significance in that it makes suggestions as to how personal protection practices should be taught to public school students.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.2
• /
• pp.463-474
• /
• 2016

As IT environment has changed, paths of information security in financial environment which is based on IT have become more diverse and damage caused by information leakage has been more serious. Among security incidents, personal information leakage incident is liable to give the greatest damage. Personal information leakage incident is more serious than any other types of information leakage incidents in that it may lead to secondary damage. The purpose of this study is to find how much personal information leakage incident influences corporate value by analyzing 21 cases of personal information leakage incident for the last 15 years 1,899 listing firm through case research method and inferring investors' response of to personal information leakage incident surveying a change in transaction before and after personal information leakage incident. This study made a quantitative analysis of what influence personal information leakage incident has on outcome of investment by types of investors by classifying types of investors into foreign investors, private investors and institutional investors. This study is significant in that it helps improve awareness of importance of personal information security by providing data that personal information leakage incident can have a significant influence on outcome of investment as well as corporate value in Korea stock market.