Earticle

초록

영어

Digital transformation and the development of generative artificial intelligence require significant changes in legislative drafting, review, and assessment. The legislative assessment of personal information infringement risks is a preventive legal mechanism for examining potential violations of fundamental rights arising from the processing of personal information at the drafting and amendment stages of legislation. It serves to protect the right to informational self-determination and to incorporate data protection principles into the legislative process. The existing AI-based assessment system primarily relies on natural language processing, named entity recognition, and machine-learning classification to identify personal information processing activities and relevant statutory provisions. Although this approach improves administrative efficiency, it remains insufficient for normative legal assessments concerning statutory authorization, legitimate purpose, necessity, proportionality, data-subject rights, and consistency with the broader legal system. This study analyzes the technological and institutional limitations of the existing classification-based system and proposes a hybrid framework combining large language models, retrieval-augmented generation, legal knowledge graphs, explainable AI, and function-specific agents. The proposed framework extends beyond identifying the data controller, processing purpose, data categories, scope, retention period, and disclosure relationships. It is designed to support legal review under the principles of statutory authorization, legal certainty, purpose limitation, data minimization, and proportionality. AI-generated outputs, however, should not constitute independent legal determinations or official assessments by the competent authority. They should be treated solely as internal advisory materials supporting human review. Statutory interpretation, the balancing of fundamental rights, and final decisions regarding legislative recommendations must remain with legally authorized human experts. Accordingly, the framework should adopt a Human-in-the-Loop structure in which AI analyzes relevant legislation, judicial decisions, administrative interpretations, and prior assessment cases, while human experts review, revise, supplement, or reject its outputs before reaching a final determination. The system should also preserve the sources used, model and knowledge-base versions, original AI outputs, human revisions, and final approvals to ensure explainability, traceability, verifiability, and accountability. Unpublished legislative drafts and internal review materials should be processed within a closed or controlled public-sector environment. The framework should further incorporate authoritative legal information, reliable retrieval and verification mechanisms, and lifecycle risk management addressing hallucination, bias, security vulnerabilities, data leakage, and outdated legal information. Ultimately, the purpose of reconstructing the assessment framework is not to replace human legal judgment but to identify more systematically the personal information processing structures and fundamental-rights risks embedded in proposed legislation. Its significance lies in establishing a reliable public-sector legislative assessment model that reconciles technological efficiency with fundamental-rights protection, procedural legitimacy, and institutional accountability.

한국어

개인정보 침해요인 평가는 법령의 제정·개정 단계에서 개인정보 처리로 인한 기본권 침해 가능성을 사전에 검토하여 개인정보자기결정권을 보호하는 예방적 제도이다. 그러나 현행 AI 기반 법령평가시스템은 개인정보 처리요소의 탐지·분류에 중점을 두고 있어, 개인정보 처리의 법적 근거와 필요성·비례성, 정보주체의 권리보장 및 법체계의 정합성 등 규범적 판단을 종합적으로 지원하는 데 한계가 있다. 이에 생성형 AI 시대에 적합한 개인정보 침해요인 법령평가체계의 재구성 방향을 제시하였다. 기존 시스템의 탐지·분류 기능에 거대언어모델(LLM), 검색증강생성(RAG), 법률지식그래프 및 설명가능한 AI(XAI) 등을 결합하고, 개인정보 처리의 적법성·필요성·비례성과 정보주체의 권리보장을 구조화된 기준에 따라 검토하는 혼합형 평가모형을 제안하였다. AI는 관련 법령·판례 및 평가사례를 토대로 법적 쟁점과 평가의견을 제시하되, 인간 전문가가 이를 검토·수정하여 최종 판단을 내리는 인간 참여형 의사결정(Human-in-the-Loop) 구조를 취한다. 이를 통해 AI의 분석능력과 인간의 규범적 판단을 결합하여 개인정보자기결정권의 사전적 보호와 법령평가의 효율성·신뢰성을 높이고자 한다.

목차

【국문초록】
Ⅰ. 서론
Ⅱ. AI 기반 개인정보 침해요인 법령평가체계의 법적·기술적 구조
Ⅲ. 현행 AI 기반 개인정보 침해요인 법령평가시스템의 구조와 한계
Ⅳ. 생성형 AI 기반 개인정보 침해요인 법령평가체계의 재구성
Ⅴ. 결론
참고문헌
Abstract

키워드

저자

• 고남현 [ Nam-Hyun Koh | 전 개인정보보호위원회 침해평가과장, 법학석사 ]
• 변용완 [ Yong-Wan Byun | 중앙대학교 다빈치 교양대학 교수, 법학박사 ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  아주법학 [Ajou Law Research]

• 간기

  계간

• pISSN

  1976-3115

• 수록기간

  2007~2026

• 등재여부

  KCI 등재

• 십진분류

  KDC 360 DDC 340