The Personal Information Protection Act and The Act on the Protection of Personal Information Held by Administrative Organs were revised for the first time in ten years after the initial enforcement in 2005.

In order to decide whether or not it is necessary for libraries to comply with this amendment, each library has to confirm its decision about compliance.

The main amendment details are as follows: 1. the Clarification of the Definition of Personal Information; 2. the Provisions for Ensuring the Usefulness of Personal Information, etc. under the Appropriate Regulations; 3. the Provisions for Reinforcing the Protection of Personal Information; 4. the Establishing of the Personal Information Protection Commission and the Development of Provisions concerning Its Authority; 5. the Provisions for Dealing with the Globalisation of the Handling of Personal Information.

There are some requirements regarding the above amendments facing each library, particularly, the amendment concerning acquisition restrictions within the new definition of ‘sensitive, personal information’ which is a very crucial issue regarding data protection in libraries.

The first thing to do is to find “Personal Information” in the company. Personal Information is defined as “information which can be used to identify the specific individual” which will include “Individual Identification Code” under the amended Act on the Protection of Personal Information (APPI). Major rules under APPI are for (i) acquisition, (ii) storage and (iii) provision of Personal Data and (iv) requests from the data subject. Under the amended APPI, obligations related to traceability for provision of the data and the consent for providing the data to a third party in foreign countries are important. Anonymously Processed Information is expected to be used for Big Data business.

Technologies for personal data utility and protection are described. Privacy frameworks are introduced, definition of personal data is given, and technologies on “data collection”, “data procession”, and “data retention” are described. Frameworks are based on OECD’s one and ISO/IEC one and some important concepts including “purpose specification” and “data minimization” are explained. Data anonymization and encryption technologies are introduces as well.