A Study on Cybersecurity Governance from the Perspective of Digital Constitutionalism: Focusing on the Legislative Enactment Tasks of the Cybersecurity Framework Act

Abstract

In the modern digital environment where data functions as a core asset, large-scale personal data breaches and soph119isticated cyber incidents pose a severe threat to the fundamental rights of citizens and national security. However, the current Personal Information Protection Act framework remains trapped in a regulation-centric paradigm that primarily imposes ex post facto punishments, such as punitive fines on enterprises after a breach occurs. This approach exposes clear limitations in preventing and defending against increasingly intelligent global hacking and AI-based autonomous attacks. In particular, the legal and institutional vacuum regarding the state's proactive and preventive defense role—such as ‘Cyber Patrol’—has led to the neglect of cybersecurity as a fundamental state duty. Therefore, from the perspective of ‘Digital Constitutionalism,’ which implements constitutional guarantees of fundamental rights and the rule of law in cyberspace, this study proposes a paradigm shift. It argues for moving away from the traditional state-centric and military ‘National Security frame toward a ‘Cyber Safety & Resilience’ system centered on the trust and recovery capabilities of the civil ecosystem. In particular, by comparatively analyzing the cybersecurity legal frameworks of major jurisdictions—including the European Union, which leads the constitutionalization of the digital realm through the GDPR, Artificial Intelligence Act (AIA), and Cyber Resilience Act (CRA), as well as the United States and Japan—this paper derives policy and legal implications for establishing a Korean-style cybersecurity governance framework. In conclusion, this study materializes a legislative proposal for the Framework Act on Cybersecurity to fulfill the state's responsibility as a 'defender and facilitator' of the private digital territory. First, it proposes building a matrix-type public-private cooperative governance by legally establishing the presidential ‘Cybersecurity Commission,’ alongside the standing ‘Cyber Crisis Response Headquarters’ and the ‘National Cyber Crisis Management Agency.’ Second, it suggests introducing a risk-based differentiated management approach, Privacy by Design, and a Safe Harbor (exemption and mitigation) mechanism for enterprises that voluntarily enhance their security investments. Third, by stipulating independent judicial and administrative control mechanisms and parliamentary oversight to prevent the infringement of the secrecy of communications and the right to informational self-determination, this study aims to lay the legal foundation for a digital new governance where freedom and safety are harmonized.