｢개인정보 보호법｣상 “가명처리”와 “개인정보 처리정지권” 해석의 합리화 방안 검토 - 서울고등법원 2023나2009236 판결의 내용을 중심으로

In order to facilitate the use of data while protecting the right to self-determination of personal information, the Personal Information Protection Act established Article 28-2 (Processing of Pseudonymized Information), which allows the pseudonymisation of personally identifiable information for limited purposes such as public record-keeping, scientific research, and statistical compilation, without the consent of data subjectst. However, despite the fact that pseudonymisation is an indispensable requirement for the creation of pseudonymized information, the court recently distinguished between ‘pseudonymisation’ and ‘processing of pseudonymized information’ and held that the pseudonymisation of identifiable information does not exclude the right of the information subject to suspend processing. Therefore, the pseudonymisation of personally identifiable information for the limited purposes of Article 28-2 may become impossible due to the exercise of the information subject’s right to suspend processing. This would undermine the effectiveness of Article 28-2, which provides that pseudonymized information may be processed for limited purposes regardless of the data subject’s will, and dilute the legislative intent. This article examines the legal nature of the data subject’s rights and the meaning of the right to suspend processing, and analyzes the issues and problems in court decisions on Article 28-2 and the right to suspension of processing of personal information. It also suggests the desirable interpretation direction of ‘pseudonymisation’ and ‘right to suspension of processing of personal information’ as a solution, and legislative tasks to prevent confusion in interpretation.