SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
mate consent from users for processing their personal information for personalised advertising purposes. The two online platforms have filed a lawsuit seeking revocation of the disposition imposed by the PIPC. In January 2025, the Seoul Administrative Court dis - missed the claims of the two online platforms, though they have appealed to the Seoul High Court. As regu - lations on the collection of behavioural data and the use of personalised advertising are being tightened in other jurisdictions such as the EU, this case is the first decision in Korea regarding the collection and use of behavioural data on personalised online advertising platforms, drawing keen attention to the outcome of the court’s further decision. In 2025, the Supreme Court held that, depending on the circumstances, submitting litigation documents or evidence containing personal information to a court to substantiate claims or to defend against criminal charges, and submitting evidentiary materials contain - ing personal information to law enforcement authori - ties in connection with criminal complaints or investi - gations to substantiate allegations or to exercise the right of defence, may constitute “justifiable acts” under the Criminal Code – and therefore would not be pun - ishable as violations of the PIPA. Previously, because the PIPA contained no explicit provision authorising the submission of documents containing personal information to courts or law enforcement authorities without a warrant or court order, such conduct had been regarded as potentially constituting a violation of the PIPA. However, following the Supreme Court’s ruling, the legal risk associated with such submissions has been reduced. In 2025, the Supreme Court held that a data subject’s right under the PIPA to request the suspension of personal information processing does not extend to pseudonymisation of personal information. The case arose when mobile subscribers sought to suspend the pseudonymisation of their personal information, which was being carried out for purposes of scientific research, statistical analysis, and the preservation of records in the public interest. Mobile service provid - ers refused the request, and the dispute proceeded to litigation. In reaching this conclusion, the Supreme Court emphasised that the PIPA clearly distinguish - es between “processing” and “pseudonymisation”,
and reasoned that pseudonymisation is a method designed to reduce the risk of individual identifica - tion and is, therefore, different in nature from ordinary processing of personal information. The Court further noted that the legislative intent underlying the PIPA provision on pseudonymisation was to promote data utilisation and foster new industries. In 2025, the Supreme Court issued a decision adopt - ing a broader interpretation of the scope of “use” of personal information under the PIPA. The case involved a daycare centre director, the defendant, who reviewed CCTV footage recorded at the daycare centre to check whether teachers were using their mobile phones during working hours, and then orally communicated information about such mobile phone use based on what was observed from the footage. The key issue in this case was whether conveying information obtained from the CCTV footage, rather than providing the footage itself, constituted a “use” of personal information beyond the original purpose for which the information was collected. The Supreme Court held that the “use” of personal information is not limited to using the data in its originally collected form, but also includes processing, editing or extracting information from the collected personal information and the subsequent use of the resulting information. On this basis, the Supreme Court concluded that the defendant had used the personal information beyond the scope of the original purpose for which it was col - lected, in violation of the PIPA. 2.3 Collective Redress Mechanisms The PIPA includes a mechanism for collective redress through a dispute mediation system. This allows national and local governments, personal informa - tion protection organisations, data subjects and data controllers to request or apply for collective dispute mediation via the Dispute Mediation Committee. This process is applicable in situations where multiple data subjects experience similar damage or rights infringe - ments, provided the following criteria are met. • At least 50 data subjects must have suffered harm, excluding: (a) data subjects who have already reached an agreement with the data controller regarding dispute resolution or compensation;
440 CHAMBERS.COM
Powered by FlippingBook