Ways to Improve the Personal Data Protection Act for Ensuring Freedom of the Press and Expression and the Right to Know

Background

In South Korea, the individuals criticizing the government, whistleblowers, reporters, and the citizen’s right to know are at risk because of a mechanical, overbroad interpretation and application of the Personal Information Protection Act(hereafter “the Act”). A human rights lawyer who leaked CCTV footage of a police raid to the media was charged by the police with the violation of the Act and only received a “not guilty” verdict a year and four months after the case was sent to the prosecutors. In October 2022, the President’s Office claimed the “violation of the Act” for a media report that disclosed the personal identities of employees through a military service announcement (military service of public officials) published in the Official Gazette. In April 2022, police raided the residence of an MBC reporter and the MBC newsroom on suspicion of violating the Act for leaking personal information during a personnel hearing of Justice Minister Han Dong-hoon. Recently, the Supreme Court even ruled that even providing personal information, such as CCTV, to an “investigative agency” when suing or accusing someone is a violation of the Act. This decision increases the possibility that even proving and accusing someone of an “illegal act” could be interpreted as a violation of the Act.

What’s at stake

1. The interpretation of the Article 2

Article 2(5) of the Act defines a “personal information processor” as “a person who operates a personal information file for business purposes,” and Article 4 defines a “personal information file” as “a collection of personal information that is systematically arranged or organized according to certain rules so that personal information can be easily retrieved.
Considering the original purpose of the Act, it should be interpreted strictly, but due to the overemphasis on the right to self-determination of personal information, it has been interpreted very broadly and comprehensively. The Personal Information Protection Commissioner has stated that any collection of information can become a personal information file if it can be read in a systematic arrangement, and ‘business’ is also interpreted rather broadly, meaning that individuals, not companies, can be personal information processors. For example, if you have CCTV footage that captures an important crime scene, you may be considered a personal information processor, making it difficult to share the facts of a crime related to public safety.

2. Collecting and using personal information

Article 15 stipulates when it is permissible to “collect and use” personal information, and Article 17 stipulates when it is permissible to “provide (third parties) with” personal information. However, like the GDPR, there is no provision allowing for “processing of information for public interest purposes,” so there is no immunity for citizens to collect, use, or provide personal information for public interest reporting.

3. Exemption from Application

The Act excludes certain applications in Article 58, Paragraph 1, Subparagraph 4, which states, “The collection and use of personal information by the media, religious organizations, and political parties for their respective unique purposes.” This provision distinguishes between “collection and use” and “provision,” which raises concerns regarding the extent of exemption in the interpretation of this exclusion clause (Article 58, Paragraph 1, Subparagraph 4) being limited to the media’s collection and use of personal information. Articles or reports aim to provide information to the public, but there are no established standards or accumulated precedents in the interpretation of whether articles that contain personal information fall under “publication” as an aspect of journalism, whether journalists “use” information acquired in the course of their work for article writing, or whether they are considered to “provide” it to third parties. Therefore, there is room for interpretation and debate in terms of potential violations of the Personal Information Protection Act due to the logic that including personal information in articles constitutes a “provision.” As a result, there is a high risk of being considered a violation of the Article 58 exemption clause, which could significantly undermine journalistic activities.

Article 58, Paragraph 1, Subparagraph 4 seems to be interpreted as applying only to “media institutions” and “media companies” in terms of the entities covered, potentially excluding cases where individuals provide information (tips) to media companies. Therefore, there appears to be a lack of explicit provisions exempting acts of public interest reporting by individuals.

The exemption in Article 58 does not apply to some parts of the Personal Information Protection Act, especially the broad criminal penalty provision stated in Article 59 that immediately follows it. This could potentially render Article 58 meaningless. To address this issue, it may be necessary to broaden the scope of exemption in Article 58 or narrow down the application of Article 59, as explained below.

4. Prohibited Activities

Article 59 prohibits the act of divulging personal information acquired in the course of performing his or her work, or providing it for any third party’s use without authority. This Article also prohibits the act of using, damaging, destroying, altering, forging, or divulging any other person’s personal information without legitimate authority or beyond proper authority.

The problem lies in the unclear meaning of the term “authorization,” causing uncertainty regarding whether various lawful bases and exemptions under Article 15, Article 17, and Article 58 of the law meet the authorization requirements demanded by Article 59. If not, a wide range of personal information processing activities such as “disclosure,” “provision,” “use,” “alteration,” and others, broadly defined, could be encompassed, rendering the processing authorities provided in Articles 15/17/58 meaningless.

Improvements and alternatives

As such, there are discussions that the Act should be revised to ensure freedom of speech and expression and the right to know, so as not to be used as a means of media control by political and economic powers, or to discourage individual public interest reporting, social reporting, and media reporting.

‘Personal information processor’, ‘personal information files’, etc. in Articles 2(4) and (5) need to be narrowed and interpreted per the original purpose of the Act. In other words, it is necessary to interpret or amend the Act to limit its application to those who use the aggregated information of numerous data subjects for business or profit purposes, where such information is easily accessible through searches.

The GDPR (General Data Protection Regulation), a European legislation, demands in Article 85 that legislation should be enacted to ensure the “freedom of expression and information,” explicitly stating that the processing of information for “journalistic, academic, artistic, and literary purposes” should be protected. The term ‘journalistic purposes’ can also be interpreted to include ‘whistleblowing,’ which is more favorably regulated for public interest disclosures. Furthermore, not only for journalism but also generally, Article 6(e) allows for the processing of information for “legitimate purposes of processing” without the consent of the data subject, and it employs a single concept, “processing,” without separating data collection, usage, and third-party disclosure, making these exemption clauses applicable comprehensively to all personal data processing activities.

Taking these legislative examples into consideration, there is a need to amend the Personal Information Protection Act in a direction that more clearly guarantees the freedom of the press and the right to know in accordance with the Constitution and international human rights standards. This includes:

1. Applying Article 58 to all cases of personal information ‘processing.’
2. Introducing provisions in Articles 15 and 17 to exempt ‘processing for public interest purposes.’
3. Ensuring that Article 59 is applied to the exemption clauses in Article 58, Article 15, and Article 17.

These amendments are necessary to provide a more robust protection of the freedom of the press and expression, in line with constitutional and international human rights standards.

Original Korean Text