Regrettable Court Ruling that Filing a Police Complaint Violates Personal Information Protection Act

On October 24, the Busan District Court in South Korea ruled that including personal information such as name, phone number, address, and social security number in a police report constitutes a violation of the Personal Information Protection Act. The defendant in this case had reported a colleague suspected of fraudulent overtime pay to the police, using a standard form that included the colleague’s personal details obtained from internal documents. As a result, the prosecutor imposed a fine of 1 million KRW for unauthorized use of personal information under Article 19 of the Act. The Open Net Korea argued that such an interpretation could discourage whistleblowers and media from reporting misconduct and provided free legal support for the defendant’s appeal.

The court of first instance also ruled that the accused’s actions in preparing and filing the complaint violated the Personal Information Protection Act. The court reasoned that the defendant’s provision of the accused’s personal information did not constitute an act of ‘use or provision for other purposes’ as it was not provided on the premise that it could be used to file a criminal complaint or a civil lawsuit and that it did not constitute a justifiable act under the criminal law, as it was not mandatory to provide personal information such as the social security number or address of the accused or the accuser when preparing a criminal complaint or accusation, and that it was sufficient to identify the accused during the subsequent investigation even if only his name and place of work were provided.

The police’s act of collecting the ‘National Identification Number’ by requesting it through a form is legal under Article 15(1)(3) of the Act, which states that it is “inevitable for public institutions to carry out their duties as prescribed by laws and regulations,” but it is a trivialization of the meaning of Article 15(1)(3) of the Act to treat the act of submitting the information, which is inextricably linked to the act of collecting it, as a violation of the Personal Information Protection Act.

This case underscores the risks of over-interpreting data privacy laws, potentially deterring citizens from exercising their legal rights to report crimes or misconduct. Open Net supports the defendant’s appeal and hopes the higher court will issue a ruling that allows a balanced interpretation of the law, protecting privacy without impeding public interest activities.

Korean version text