Definition of privacy-related terms [3,5,25,26].

As the Internet becomes increasingly widespread, various cybercrimes involving privacy, such as misuse, abuse, and leakage of privacy in integrated information systems that contain privacy data, are increasing worldwide. To address such intrusions, privacy impact assessments (PIAs) of information systems have been performed. Various studies, including PIAs, have been conducted to establish PIA frameworks (PIAF), surveys, and analyses to investigate intrusion cases. Impact assessments based on assessment items and low-level PIAs that analyze intrusion factors differ among countries. The PIAF in the Netherlands comprises three stages, that in Canada comprises four stages, and that in Korea comprises three stages, each of which defines subprocesses. In this study, the PIAFs of these countries were investigated and compared. We also compared the assessment items of ISO/IEC 27701 and Korea’s PIAF. We analyzed PIAs conducted on information systems operated by public institutions in Korea. Through the analysis of these PIAs, we derived the factors causing intrusions in Korea and proposed improvement points for each intrusion factor. We expect that these analysis results can be effectively applied to other countries.

随着互联网普及程度持续提升，全球范围内涉及隐私的各类网络犯罪呈增长态势，其中包括存储隐私数据的集成信息系统中出现的隐私误用、滥用与泄露问题。为应对此类网络入侵行为，业界已针对信息系统开展隐私影响评估（Privacy Impact Assessment，PIA）相关工作。学界已开展多项研究以构建隐私影响评估框架（Privacy Impact Assessment Framework，PIAF）、开展相关调研并分析入侵案例，其中亦涵盖PIA相关实践。不同国家所采用的基于评估条目的影响评估，以及用于分析入侵因素的底层PIA，存在显著差异。荷兰的隐私影响评估框架包含三个阶段，加拿大的包含四个阶段，韩国的则包含三个阶段，且各阶段均明确了子流程。本研究对上述三国的隐私影响评估框架进行了调研与对比，同时还比对了ISO/IEC 27701标准与韩国隐私影响评估框架的评估条目。本研究还分析了韩国公共机构运营的信息系统所开展的PIA工作。通过对这些PIA工作的分析，本研究梳理出韩国境内引发网络入侵的各类影响因素，并针对每类因素提出了优化改进方向。本研究预期上述分析结果可有效推广应用至其他国家。