페이스북의 데이터 수집(사용)과 남용에 대한 법적 쟁점 검토 -페이스북에 대한 2018년 미 상원의 청문회 내용을 중심으로-

초록

This paper aims to examine various legal issues and future directions of personal data regulation that were discussed during the U.S. Senate hearing held in April 2018, following the Facebook–Cambridge Analytica data breach. The hearing was convened to question Mark Zuckerberg, CEO of Facebook (now Meta Platforms Inc.), regarding the company’s handling of user data, the ensuing privacy violations, and broader systemic issues related to social networking platforms. First, the data breach and resulting infringements on personal information and privacy constituted a violation of the 2011 Consent Order issued by the Federal Trade Commission (FTC). Accordingly, this paper reviews the FTC’s legal sanctions and calls for stronger regulation, discussions on the potential applicability of the EU General Data Protection Regulation (GDPR) to U.S. entities, data breach notification requirements, the reinforcement of opt-in consent mechanisms as proposed in the “Consent Act” (Customer Online Notification for Stopping Edge-provider Network Transgressions Act), the “Honest Ads Act” aimed at enhancing transparency and accountability in online political advertisements, and the Children’s Online Privacy Protection Act (COPPA). Additionally, the paper explores issues surrounding tracking technologies used on social networking services (SNS), such as shadow profiles, API policies, the collection of call and SMS data from Android phones, and the technical limitations of preventing tracking in digital environments. It addresses related concerns such as the legal codification of data ownership, the enhancement of user control rights, procedures for contesting content moderation decisions, and Facebook’s content governance policies. Furthermore, the study discusses regulatory trends, demands for stricter controls, opposing arguments, and the use of artificial intelligence in protecting privacy and personal data. Although the harm caused by the data breach was substantial, the hearing played a crucial role in bringing public attention to the structural issues of global big tech industries leading SNS platforms. It also sparked a shift in awareness across Facebook, the broader tech sector, governments, private sectors, and civil society regarding data privacy, ultimately encouraging constructive technological innovation. South Korea is no exception. The growing public awareness of personal data protection, coupled with proactive enforcement by regulatory authorities that do not distinguish between domestic and foreign industries, is expected to contribute to more effective safeguards for personal information and the further development of relevant legal frameworks. However, many unresolved issues remain even after the hearing. These issues continue to pose challenges that demand attention, and the arguments raised during the hearing are still valid. This paper does not attempt to offer conclusive solutions to these challenges. Rather, due to limitations in research capacity, its primary aim is to present the methods and shortcomings of technological intrusions into privacy and personal data, rather than to propose in-depth alternatives. Looking ahead, the issues of personal data collection and use by SNS platform tech companies such as Facebook must be addressed through active discussions on how to simultaneously ensure both regulation and innovation. These efforts must consider the expanding role of AI, the legislative issues concerning whether data ownership and user control rights should be legally established, and the need for a balanced and forward-looking regulatory framework.

키워드