Public interest reporting and Personal Information Protection Act 

By Jiwon Son 

*This is a presentation of “Consumer data rights from Japan to the world” Session in the 2023 IGF 

Emphasizing the right to self-determination of personal information and strengthening personal information protection regulations without detailed consideration of freedom of expression can undermine freedom of expression, the right to know, and democracy.

We can say all expressions are processing of information. If an expression is about a person, it inevitably involves the processing of personal information.

If all expression in principle requires the permission of the data subject, this will severely curtail freedom of expression and information.

The purpose of the Right to Self-Determination of Personal Information and the Personal Information Protection Act is to protect individuals, whose power is unbalanced with the government or large corporations, from ‘data surveillance’ by those powerful.

However, the mechanistic application of the Personal Information Protection Act may discourage powerless individuals from reporting on social injustice or public interest issues. And consumer reporting campaigns may also fall into this category.

In relation to this, I will briefly explain the issues with Korea’s personal information protection law.

Firstly, a person subject to Korea’s Personal Information Protection Act is a ‘personal information controller,’ which is defined as ‘a person who operates the personal information files as part of its business;.’ This should be interpreted strictly considering the original purpose of the Personal Information Protection Act, but the right to self-determination of personal information has been overemphasized and is being interpreted very comprehensively and broadly.

The Korea Personal Information Protection Commission states that any collection of information can be a personal information file if its systematic arrangement can be read, and ‘business’ is interpreted comprehensively. Therefore, even individuals other than companies can be considered personal information controllers. For example, it is believed that even if you have video recordings of a criminal activity captured by a black box or CCTV, you may be considered a personal information controller and have difficulty in sharing information vital to others’ safety.

Personal information controller needs to be interpreted narrowly as a person who uses an easily searchable collection of information from numerous data subjects for business purposes, considering the original purpose of the law.

Secondly, Korea’s Personal Information Protection Act provides exceptions for ‘media activities’. However, in context, this provision is interpreted to apply only when ‘media organizations’ or ‘media companies’ report, and does not apply when an individual ‘reports’ to a media company.

The GDPR has Article 85(Processing and freedom of expression and information) “1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.”

‘Reporting to the media’ can also be interpreted as ‘journalistic purposes’ and is therefore more favorable to reporting in the public interest.

Against this poor legal background, the police once tried to criminally indict a whistle blower about police’s oppressive investigation tactics, the Presidential Office also threatened to file a criminal complaint against a media organization divulging critical information about the Office’s hiring practices, and the Justice Ministry also threatened to file a criminal complaint against the sources of media articles covering the justice minister’s confirmation hearings, all under Korea’s data protection law. 

In this way, it should be noted that the GDPR allows the collection of information and provision of information to third parties without the consent of the data subject for public and legitimate interests, and allows exceptions for information processing for journalistic ‘purposes’.

Personal information protection legislation should be improved to ensure that the rights of powerless individuals to protest and report public interest through freedom of expression or the right to know are not diminished.