TRENDS IN THE RELIEF GIVEN FOR PERSONAL INFORMATION INJURIES IN KOREA AND THE EU

Transcription

1 International Journal of Civil Engineering and Technology (IJCIET) Volume 9, Issue 11, November 2018, pp , Article ID: IJCIET_09_11_183 Available online at ISSN Print: and ISSN Online: IAEME Publication Scopus Indexed TRENDS IN THE RELIEF GIVEN FOR PERSONAL INFORMATION INJURIES IN KOREA AND THE EU Sung-jun Kim* Dept. of Bigdata Industrial Security, Namseoul University, Seoul, Korea Joo-suk Park Dept. of Law, Korea National Open University, Seoul, Korea Jee-hyung Lee Legal Science Institute, Ewha Womans University, Seoul, Korea Doo-su Kim Dept. of Law, Hankuk University of Foreign Studies, Seoul, Korea, *Corresponding Author ABSTRACT In the age of the Internet and the search engine, from hacking to illegal sales of personal information, personal information breaches have long been a serious problem in Korea and the EU. The number of such breaches in Korea over the past six years was more than three times the Korean population, which means that, on average, everyone in the whole nation experienced information breach three times in the last six years. Sanctions for those responsible, however, were disproportionately light compared to the injuries sustained by those whose personal information was collected and/or used without their consent. In the EU as well, the distribution of personal information across the borders of its 28 member states is an important issue that must conform to its principle of free movement. Thus, it is an urgent matter to establish measures to impose stricter liability for the breach of personal information, by reinforcing the compensation and fine for data breach injuries for both parties. Therefore, there should be an in-depth discussions of measures to provide relief for injuries in Korea and the EU from breaches of personal information, in particular through alternative dispute resolution systems and the balance between the free distribution of information and the protection thereof. Key words: Relief for personal information, Data breach, Dispute settlement, Stronger regulations, Korea, European Union Cite this Article: Sung-jun Kim, Joo-suk Park, Jee-hyung Lee and Doo-su Kim, Trends in the Relief Given for Personal Information Injuries in Korea and the EU, International Journal of Civil Engineering and Technology (IJCIET) 9(11), 2018, pp editor@iaeme.com

2 Sung-jun Kim, Joo-suk Park, Jee-hyung Lee and Doo-su Kim 1. INTRODUCTION Before the advent of the Internet, the verification and discovery of information took a long time. Even if one was swept up in a scandal it was forgotten over time. However, with the development of search engines, all types of information can be easily found [1]. There are a dizzying array of personal data breaches including unauthorized collection and use, provision to third parties, and collection of excessive amounts of personal information. Despite such injuries due to data breaches, however, relief remains far from adequate. The importance of personal information security is coming to increasing prominence with the proliferation of personal information injuries. Under these circumstances, the enactment of the Personal Information Protection Act for the purpose of protecting personal information in all circumstances is an encouraging sign. However, the relief given for personal information breaches is still inadequate and requires improvement. The protection provided in the European Union for the cross-border movement of personal information may provide some guidance for Korea [2]. 2. STATISTICS ON PERSONAL INFORMATION BREACHES AND TYPES OF BREACH Of the 4,883 cases processed by the Personal Information Dispute Mediation Committee ( the Committee ) in the past 15 years, the Committee ruled in favor of the applicants in 145 cases since the Personal Information Protection Act ( the Act ) came into effect in Through comparative analysis of the type of breach according to the provisions of the Act, the cases were categorized according to the stage at which they occurred by Collection and Use, Provision to Third Parties, Destruction, Rights of Data Subjects, and Safeguard Measures. The results are as in Table 1 below. By type of breach, the statistics are as Table 2 below [3]. Table 1 Decisions for the Plaintiff Since the Entry into Effect of the Act Outcome Total Mediation Successful Mediation Unsuccessf ul Total Table 2 Mediation Cases by Year (by Type of Breach) Type Total Proportio n Collection and Use % Provision to Third Parties % Destruction % Data Subject s Rights % Safeguard Measures % Total editor@iaeme.com

3 Trends in the Relief Given for Personal Information Injuries in Korea and the EU 3. PERSONAL INFORMATION DISPUTE RESOLUTION AND RELIEF 3.1. The Expansion of Relief for Personal Information Grievances Relief for injuries in the broad sense includes civil, criminal, and administrative relief [4]. However, if disputes are to be resolved only through litigation in the courts, the courts would be overburdened with the case load and the delay would mean the effectiveness of relief would be decreased. Therefore, alternative dispute resolution systems (ADR) are taking on a new prominence Alternative Dispute Resolution Definition Alternative dispute resolution refers to a range of methods for resolving disputes, including arbitration, mediation, settlement, and good offices. ADR can involve not only judges participating as arbitrators but also other parties such as administrative agencies, public bodies, or even private organizations taking the lead in litigation to resolve disputes easily and conveniently. These alternative dispute resolution methods are becoming increasingly favored due to their potential for improving on the shortfalls of traditional adjudication, including the excessive formality of the proceedings, the cost burden, and the time it takes to complete the proceedings. Adjudication, in particular, may prompt repetitive and continuous appeals by the parties, and the drawn-out dispute may exacerbate emotional conflict between the parties and cause the conflict to go to extreme lengths. By contrast, ADR is fundamentally focused on finding a point of agreement where all the parties may be satisfied, making it a viable alternative to litigation [5]. On the other hand, alternative dispute resolution is a poor fit for situations where strong and extreme emotional conflicts are involved, and the lack of compulsory enforcement may make it difficult to give effect to the results Types of Alternative Dispute Resolution There are various forms and methods of alternative dispute resolution by binding effect, the involvement or lack thereof of third parties, and the roles of the parties to the dispute. There is therefore an entire constellation of taxonomies. First, the National Alternative Dispute Resolution Advisory Council (NADRAC) in Australia categorizes ADR types by how much authority is given to the third party that intervenes between the parties to the dispute, as seen in Table 3. The Center for Democracy and Governance (CDG) in the United States, similar to the taxonomy by NADRAC, categorizes ADR methods by the role of third parties in the process of reaching an outcome [6]. Facilitative process Advisory process Determinative process Table 3 Types of Alternative Dispute Resolution Methods (NADRAC) Type Explanation Example Process to aid the parties to the dispute in identifying the issues and developing new choices and alternatives, thereby reaching an agreement A process in which a third party advises the parties to the dispute on the relevant facts or law and presents possible or advisable outcomes Process in which a third party evaluates and makes a decision on the dispute through procedures such as formal evidence collection facilitated negotiation, facilitation, mediation expert appraisal, mini-trial arbitration, expert determination, private judging editor@iaeme.com

4 Sung-jun Kim, Joo-suk Park, Jee-hyung Lee and Doo-su Kim Combined or hybrid process and opinion hearing At the beginning of the process, the third party might facilitate discussions between the parties to the process or provide consultations or mediation. Later on the third party may also use other methods such as arbitration. Med-arb 3.3. Alternative Dispute Resolution and Relief for Personal Information Injuries Injuries due to personal information breaches differ from those due to physical injury or violation of property rights. Personal data breaches and the resulting injuries are closely related to personal dignity and privacy; in most cases there are only small amounts at stake, as only mental or emotional injury is recognized rather than economic injury; breaches can cause injury without regard to geography or national borders, due to the development of online spaces and Internet commerce; and the large-scale processing of digitized, online, and databased personal information means that the injury spreads at a precipitous pace. Relief for personal information injuries must correspond to the above characteristics of the injuries: The relief must be swift, convenient, easy to avail one s self of, unlimited by region and geography, and varied in type. Litigation through the courts, however, is limited by jurisdiction in cross-border cases, and relief takes a disproportionate amount of time in a chronically overburdened court system. Furthermore, litigation requires the aid of a legal professional and the cost can be very high. The unsuitability of conventional relief mechanisms such as litigation for providing relief for personal information breaches means that it is all the more important to establish relief systems tailored to these situations. This is where ADR as an alternative to litigation becomes all the more salient. In fact, private dispute resolution bodies and personal information protection agencies within and outside Korea have been proactive in using ADR methods such as settlement or mediation in resolving disputes due to personal information breaches and providing relief for the injuries therefrom [7, 18,19]. 4. IMPROVEMENTS TO RELIEF FOR PERSONAL INFORMATION BREACHES 4.1. The Burden of Proof under Article 32 of the Network Act Under the current law in Korea, persons who were injured by personal information breaches may seek damages under Article 32 of the Act on the Promotion of Information and Communications Network Utilization and Information Protection, Etc. ( Network Act ) through civil litigation or personal information dispute mediation. Article 32(1) of the Network Act, in particular, provides that said provider of information and communications services or similar shall not be exonerated from liability if failing to prove that there is neither intention nor gross negligence on the part of the said provider, thus shifting the burden of proof for negligence to the defendant [8]. This shift in the burden of proof is an exception to give effective relief, as it is difficult for technical reasons for the plaintiff to prove the defendant s liability in personal information breach cases. The problem is that the damages awarded in court judgments and mediation decisions are comparatively small and do little to incentivize these providers to take adequate safeguard measures to protect personal information. Therefore, in order to incentivize providers to protect personal information and effectively prevent personal information breaches, plaintiffs injured by data breaches must be awarded higher damages [9] editor@iaeme.com

5 Trends in the Relief Given for Personal Information Injuries in Korea and the EU 4.2. Amendment of Article 39-2 of the Personal Information Protection Act While the rights violation is clear in personal information breaches, proving or calculating the amount of damages can be a challenge. Adequate relief must nevertheless be given so that providers are incentivized to prevent or deter breaches. However, the award of adequate relief is impeded by the fact that the amount of damages may fall short of the cost of litigation. Therefore, a limited adoption of pre-established statutory damages may give effect to relief for plaintiffs and increase the advance deterrence effect for violations [8]. Following the model of pre-established damages incorporated into the Copyright Act and Trademark Act to implement the Korea-U.S. Free Trade Agreement [10], amending the damage ceiling from compensation not exceeding three million won to compensation not exceeding five million won may be a change worth considering Reforms to Dispute Resolution The first suggestion for improvements to the dispute resolution system is to adopt online dispute resolution (ODR). The protection of personal information has a strong component of personal dignity, and protection through prevention is far more effective than relief for breaches. Once a breach has occurred, relief must be both speedy and adequate. Alternative dispute resolution may therefore be more effective than conventional litigation. However, currently the personal information dispute mediation procedure is held offline, and is identical in operation to litigation and offline dispute resolution. As a result, it is not particularly tailored to the characteristics of the online world and the speediness of relief leaves much to be desired. In the case of data breaches on information and communications networks, in particular, the process of dispute resolution from the application for dispute mediation to the mediated settlement should be improved so that the entire process can be completed in a timely manner online [11]. Second is the efficient operation of mediation panels. The Personal Information Protection Act provides that In order to conduct dispute settlement efficiently, the Dispute Mediation Committee may, if necessary, establish a mediation panel that is comprised of not more than five Committee members in each sector of mediation cases (Article 40(6) of the Personal Information Protection Act). The decisions of a mediation panel on matters delegated to it by the Committee are deemed to be decisions of the Committee. The Enforcement Decree of the Personal Information Protection Act, accordingly, specifies that a mediation panel shall be comprised of not more than five members appointed by the chairperson of the Dispute Mediation Committee, and one of whom shall be a commissioner with an attorney-in-law license (Article 49(1) of the Enforcement Decree of the Personal Information Protection Act). The chairperson of the Dispute Mediation Committee shall convene the meetings of the mediation panel (Article 49(2)), for which the chairperson shall notify each member of the mediation panel of the date, time, venue, and agenda no later than seven days prior to the meeting: Provided, That this shall not apply in case of emergency (Article 49(3)). The presider of the mediation panel shall be elected by and from among its members (Article 49(4)). Otherwise, matters necessary for the composition and operation of the mediation panel, and other necessary matters, shall be determined by the chairperson of the Dispute Mediation Committee subject to the resolution of the Dispute Mediation Committee (Article 49(5)). However, in order to speedily resolve a broad range of personal information breaches, rather than convene and operate the mediation panel in exceptional cases as necessary, the dispute mediation process should be simplified and speeded up so that mediation panels handle mediations as a routine matter and the full Dispute Mediation Committee is only convened on an exceptional basis for matters of grave importance [12] editor@iaeme.com

6 Sung-jun Kim, Joo-suk Park, Jee-hyung Lee and Doo-su Kim 4.4. The Protection of Personal Information in the EU The Charter of Fundamental Rights of the European Union provides for the protection of personal information in Article 7, which states: Everyone has the right to respect for his or her private and family life, home and communications. Article 8(1) provides, Everyone has the right to the protection of personal data concerning him or her; Article 8(2), Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law; and Article 8(3), Compliance with these rules shall be subject to control by an independent authority [13]. In the same context, under EU law, personal data can only be gathered legally under strict conditions, for a legitimate purpose. Furthermore, persons or organizations which collect and manage the personal information must protect it from misuse and must respect certain rights of the data owners which are guaranteed by EU law. Furthermore, the EU allows citizens to better control their personal data. It also modernizes and unifies rules allowing businesses to reduce red tape and to benefit from greater consumer trust in the Digital Single Market. Therefore, several regulations including the general data protection regulation are the important part of the EU data protection reform package. One purpose of this reform package was to enhance legal uniformity between member states by changing the form of the measures from directives to regulations [14]. As a result, individuals gain more control over their personal data, while businesses and public agencies gain legal and operational certainty [15]. Meanwhile, personal information has the dual characteristic of information, which is subject to free distribution, and an object of protection due to the implication on basic personal rights and freedoms. In this context, the EU s view is that the free movement of personal data in the EU should not be limited or prohibited for the reason that it implicates the protection of persons relating to the processing of personal data [15]. In contrast, Article 1 of the Information Protection Act in Korea states that The purpose of this Act is to provide for the processing and protection of personal information for the purposes of protecting the freedom and rights of individuals, and further realizing the dignity and value of the individuals. In the Korean Personal Information Protection Act, therefore, personal information is only a subject of protection; the perspective that it should also be distributed freely is missing from the legislation [16]. The stance of the EU has implications for Korea in that the regulation on personal information must combine both free movement and protection [17]. 5. CONCLUSIONS Korea is seeing a string of class actions by citizens due to personal data breaches, but damages awarded through litigation are wildly out proportion to the scale and scope of the breach, and also compared to awards given in other jurisdictions. Even in the event of litigation, therefore, the threat of damages does not affect governmental and corporate perceptions on the importance of information protection, nor does it inform their investment choices. An upward adjustment in damages is urgently needed. Furthermore, in personal data breaches there has been a clear violation of rights yet proving and calculating damages remains a challenge, and the prevention or deterrence of such breaches should be incentivized. The damages may also be smaller than the cost of litigation, necessitating more effective relief for rights holders. Furthermore, in the case of data breaches on information and communication networks, procedural improvements should be made so that the entire process from applying for dispute mediation to mediated settlement can be concluded speedily online. Lastly, in order for a broad range of data breach cases to be resolved in a timely fashion, mediation panels should not only be composed and operated in exceptional cases as editor@iaeme.com

7 Trends in the Relief Given for Personal Information Injuries in Korea and the EU necessary; rather the dispute mediation system should be simplified and sped up so that mediation panels handle mediations as a rule, and the full Dispute Mediation Committee only convened in matters of exceptional importance. REFERENCES [1] Edwards, Lilian and Waelde, Charlotte, Law and the Internet, Hart Publishing, 2009, [2] Lee, Sang-Hyuk and Kim, In-Seok, A Study on Transborder Data Flow of Personal Information: Policy Suggestion based on EU s Approach, Journal of The Korea Institute of Information Security & Cryptology, 26(4) (2016), [3] KISA, Privacy Dispute Resolution Case Study in-depth analysis by type, Korea Internet & Security Agency, 7 (2016), [4] Lee, Sung-dae, A Study on Problems of Current Sentencing System for Personal Information Protection, Korean Criminological Review, 26(1) (2015), [5] Park, Joo-suk, Moon, Seung-il and Song, Ki-min, The Improvement of Dispute Resolution of Information Protection Industry in Information Protection Industry Act, Journal of Security Engineering, 14(4) (2017), [6] Center for Democracy and Governance, Alternative Dispute Resolution Practitioner's Guide, Appendix A, Technical Publication Series, (1998). [7] Lee, Chang-bum and Yoon, Ju-yeon A Comparative Study on Remedies for Personal Information Infringements, Personal Information Dispute Mediation Committee, 2003, [8] Choi, Kyoung-Jin, A Study of Introduction to Statutory Damages - Focusing on Harmonization between KORUS FTA and Civil Law, Chung-Ang Law Revelew, 13(3) (2011), [9] Ko, Hyoung-suk, Invasion of Personal Information and Principle of Liability for Damages, Justice, 145 (2014), [10] Kwon, Young-joon, Theoretical Foundation of Tort Law and its Implication - On the Prevention and Recovery Paradigm, Justice, 109 (2009), [11] Yoon, Hyun-seok and Chang, Gyu-won, A Study on Punishment about Infringement of th Personal Information and Stategies for Victim s relief, Korean Journal of Victimology, 22(1) (2014), [12] Yun, Ju-hee, Legal Issues and Current Situation of Personal Information Dispute Mediation System, Law & Policy, 20(2) (2014), [13] Kluwer, European Basic Treaties, 2010, [14] Kim, Doo-su, European Union Law, Korean Studies Information, 2014, [15] Ham, In-seon, The Enactment of 2016 General Data Protection Regulation(GDPR) in the EU and its Implications, Chonnam Law Review, 36(3) (2016), [16] Ham, In-seon, EU personal data protection law, Maronie, 2016, [17] Hert, Paul De, The Right to Protection of Personal Data. Incapable of Autonomous Standing in the Basic EU Constituting Documents?, Utrecht Journal of International and European Law, 31(80) (2015), 1-4. [18] Ituen, U. J., Johnson, I., & Nyah, N. (2014). Flood Hazard Assessment and Decisions Support Using Geographic Information System: A Case Study of Uyo Capital City, Akwa Ibom State, Nigeria. International Journal of Geography and Geology, 3(4), [19] Okon, M. E., & Ogbodo, C. I. (2014). Information and Communication Technology (Ict) As a Necessity for Libraries and Librarians of Nigerian Universities in the 21st Century. Review of Information Engineering and Applications, 1(1), editor@iaeme.com