Internet identity verification rule struck down in 2012 gives birth to Open Net next year

On August 24, 2012, the Korean Constitutional Court struck down the country’s infamous internet identity verification rule (“IVR”, hereinafter) which had for 5 years required all major Korea-based website operators to obtain from all the posters their identity information and store the data so that it can be made available to investigative authorities upon request.   

After IVR was instituted in 2007, Youtube, a division of Google that has a Korea office and therefore is “based in” Korea, made a splash in 2009 when it snubbed the rule for the pretext that it had turned off the uploading feature on the “Korea” country setting.  Since then, Korea’s domestic portals have for years complained of reverse discrimination and the resulting loss of competitiveness as Korean users began to flock to foreign portals not subject to the IVR. At the same time, the current regime, uniquely oppressive on free speech, earned wider scorn and horror as its investigative authorities have acquired the online authors’ identity data thus stored through IVR on several millions of web pages every year, without warrant and without notice to the authors. Then, in 2011-12, several web operators suffered shocking data breaches on the identity data of millions of users, the sum of which has long ago surpassed the total population of South Korea, throwing questions on the practicality of verifying online identities when so much identity data have been leaked and probably made available for identity theft.

In January 2010, PSPD Public Interest Law Center and Jinbo Net filed constitutional challenges against the verification rule. (I testified as expert at the oral hearing on July of that year.) Much of the petitioner’s arguments was on the right to anonymous speech, privacy, personal data protection, etc., and on the practical problems of the IVR (the last of which I had recently written on here http://blog.naver.com/kyungsinpark/110141294860). Yesterday’s decision comes after 2 years of a briefing war since then, whereby domestic portals and civil society submitted amicuses and academics their papers. Now, almost incorporating all of the petitioners’ arguments plus more, the Constitutional Court ended the country’s 5 year experiment which only had dwarfed Koreans’ internet experience into that of “intranet” and allowed the government’s surveillance on people through their on-line writings.

My personal assessment: The unanimous decision, very orthodox in world-wide free speech jurisprudence and very aware of reality and technology, will be one of the landmarks in the country’s internet law, especially with such rare strong language as “[the rule] treating all people as potential criminals”, “the rule’s aimed public interest is merely a glossy pretext”, etc.

The litigation required key information from businesses, insights from academics, and public support of civil society and it is through this litigation that the core multi-stakeholder group of businesses, civil society, and academics was formed to give rise to the formation of Open Net in early 2013.

Here are 13 highlights, word-by-word. Also, the full decision is attached below.

Standard of review 

“Freedom of speech, an important constitutional value forming the basis of democracy, can be subjected to previous restraint onlywhen the impact on public interest achieved by such restraint is clear.” 

So is the public interest clearly achieved? 

“The perpetrator can always evade identity verification by using another’s name and resident registration number. Also, that the perpetrator will undermine identification efforts is a universal fact endemic to all types of crimes.” 

“Even the data submitted by the KoreanCommunication Commission fails to show any significant decrease in the defamatory, insulting posting after the IVR was instituted, which would otherwise have justified such prior restraint on freedom of speech.”

“The law was made notwithstanding the fact that there exists a communication network, de jure and de facto outside our law’s reach, and thereby caused domestic users to flee to foreign sites, discriminate between domestic operators and foreign ones or at least leave the law open to the questions of arbitrary enforcement. . . Internet is an huge aggregate of computer networks covering the whole world and is by nature open. Therefore, our law out of joint with laws common to other countries can always be evaded, and as a result, our law’s aimed public interest can merely become a glossy pretext.” 

Then, how about the private interest undermined by the verification rule?

“Anonymous speech in the Internet, rapidly spreading and reciprocal, allows people to overcome the economic or political hierarchy off-line and therefore to form public opinions free from class, social status, age, and gender distinctions, which make governance more reflective of the opinions of people from diverse classes and thereby further promotes democracy. Therefore, anonymous speech in the Internet, though fraught with harmful side-effects, should be strongly protected in view of its constitutional values.”

“The rule here mandates identity verification regardless of the content of the posting from almost all users on all major websites. Many prospective posters, not completely sure of what is a prohibited posting, are likely to give up on posting at all in fear of discipline or prosecution, the risk of which flows from the exposure of the names and resident registration numbers. Such result of suppressing a great majority’s legal postings on the account of the existence of a minority of people abusing the Internet is an excessive restriction on freedom of anonymous speech.” 

Also undermines privacy

“The IVR requires the web operators to collect all the users’ identity verification information and store that for long periods, and thereby exposes the data to the risks of breach or diversion to other purposes, and thereby treats all people as potential criminals in favor of investigative expediency.”

“The mandatory storage of identity information, given that the stored data is later subject to diversion for non-consented-to purposes when the investigative authorities requests such data (under Article83 (3) of the Telecommunication Act), causes a serious restriction on one’s personal data protection right.” 

Even discriminates against foreign potential users and discriminates against domestic service providers

“The current version of IVR, relying on credit check companies, prohibits foreigners and overseas Koreans not issued resident registration numbers from posting at all and thereby effectively deprives them of freedom of speech.” 

“The IVR poses a disadvantage to website operators in competition with mobile web operators or social networking services not subject to the rule and thereby grievously restricts the website operators’ freedom of press, the freedom to create public opinions through theInternet.” 

Less Restrictive Alternatives?

“The U.S. and the U.K. in principle leave regulation of harmful content on the Internet to the industry and self-regulation. Germany and many European countries also, on the basis of civilian-led self-regulation, have oriented the relevant laws toward setting the conditions of limiting or exempting the liability of ISPs. Japan has adopted a joint government-civilian system of responses to illegal or harmful postings, which also intervene after publication. None of the major countries adopted a regulation as pro-active as the IVR.”