Open Net applauds the revision of the Telecommunications Business Act following the decision that the provision of telecommunication data is inconsistent with the Constitution

Open Net welcomes the establishment of a post-notification procedure.
The system also needs to be improved to require prior court permission.

On December 19, 2023, the amendment to the Telecommunications Business Act was approved during the plenary session of the National Assembly and subsequently became enforcement. As a result, when an investigative agency requests and obtains a user’s personal information from a telecommunications service provider, it is obligated to inform the user of that fact. 

Open Net Korea applauds the revision of the Telecommunications Business Act and anticipates further amendments that align with the core principles of warrants and international human rights standards. 

Key provisions and objectives of the amended legislation

The amended legislation updates the terminology from ‘communication data’ to ‘communication user information’ (Article 83, Paragraph 3, etc.), and requires that investigative agencies or others who request and obtain communication user information from telecommunication service providers must do so within 30 days from the date of receipt. Additionally, it mandates the establishment of a post-notification procedure to inform concerned parties of the recipient’s identity, date, purpose, etc. within one day. 

Under the previous law, even if an investigative agency directly requested and obtained communication data (user information such as user name, address, resident registration number, registration data, ID, etc.) without court permission, there was no obligation to notify the user. In practice, millions of sets of communication data were provided annually (based on the number of phone numbers/IDs), yet the majority of users remained unaware of their information being disclosed as they did not receive any notification.

On July 21, 2022, The Constitutional Court declared the ‘communication data provision’ system (Article 83, Paragraph 3 of the Telecommunications Business Act), which allowed investigative agencies to directly request and receive users’ personal information from telecommunication service providers without court permission, unconstitutional (Constitutional Court Decision 2016Heonma388, etc.).  

The Constitutional Court confirmed that the provision and acquisition of communication user information constitute a restriction on basic rights. It also emphasized the significance of notifying individuals when their fundamental rights are restricted, as this allows affected parties to confirm the restriction of their basic rights and dispute the legitimacy of such restrictions. Furthermore, the court deemed the absence of a post-notification procedure for the acquisition of communication data to be a violation of the principle of due process and the right to self-determination of personal information, thus constituting a breach of the Constitution. Consequently, the revised law introduces a post-notification procedure concerning the acquisition of ‘communication user information.’

Following the amendment, investigative agencies are mandated to inform users regarding the acquisition of communication user information. This measure enhances the transparency of state surveillance and ensures procedural safeguards for privacy. Despite the Court’s ruling that the law was unconstitutional, it deemed the inconsistency with the Constitution to be provisional until improvement legislation was enacted. However, the National Assembly promptly fulfilled its obligation to enact improvement legislation, leading to the enhancement of the telecommunication user information provision system. 

To be further improved 

However, this enhancement to the law merely introduces a minimum basic rights protection mechanism, known as a post-notification procedure for users, as mandated by the Constitutional Court. It falls short of fully guaranteeing the freedom of anonymous communication.

In the same ruling, the Constitutional Court clarified that an investigative agency’s request for and acquisition of communication data (communication user information) does not constitute a compulsory disposition, such as search and seizure. Therefore, the warrant principle, which necessitates a judge’s specific judgment for compulsory disposition, does not apply. When communication user information is provided, it not only involves the acquisition of identity information but also reveals specific individual’s relevant communication facts to investigative agencies. In this regard, the degree of privacy infringement is no different from that of acquiring communication evidence. Moreover, as personal information is obtained without the consent of the data subject, it is tantamount to coercive investigation and should not be overlooked. From the perspective of investigative agencies, it’s feasible to gather information without court authorization by simply offering payments to prosecutors or police chiefs. Investigative agencies, even without court authorization, can collect users’ information simply by obtaining approval from police chiefs, etc., and are utilizing communication user information in preliminary investigations. As a result, it’s a reality that investigative agencies are acquiring a wide range of information, including from individuals unrelated to any criminal activity.

Currently, following the Protection Of Communications Secrets Act, court authorization is necessary to access ‘communication confirmation data’ (information such as communication date and time, start/end time, subscriber number of the other party, transmitting base station location tracking data, etc.) under Article 13 (3). It is imperative to institute a comparable procedure for communication user information, which divulges the identity details of communication users. Failing to do so and treating communication users’ identity information less seriously than the content or format of communication would essentially undermine the freedom of anonymous communication. We hope that the National Assembly will not only address the tasks entrusted by the Constitutional Court but also amend the legislation to mandate prior court authorization for the provision and acquisition of telecommunication user information. This step would enhance procedures in accordance with the core principle of warrantism and international human rights standards.

February 1, 2024 
Open Net Korea

Korean version text here