SOUTH KOREA Trends and Developments Contributed by: Hwan Kyoung Ko, Sunghee Chae, Kyung Min Son and Matt Younghoon Mok, Lee & Ko
Where personal data is processed pursuant to PIPC deliberation and resolution, the data controller would be required to disclose relevant information in its privacy policy. The PIPC would retain supervisory authority and may restrict all or part of the processing where statutory conditions are not satisfied. As the bill remains subject to the legislative process, its final content may be amended. Recent Judicial Decisions Recent court decisions have clarified key interpreta - tive issues under the PIPA, including the availability of statutory damages following data breaches and the applicability of the right to request suspension of pro - cessing in the context of pseudonymisation. Supreme Court decision on statutory damages (decided 4 December 2025) The Supreme Court recently clarified that Article 39-2 of the PIPA, which permits statutory damages of up to KRW3 million (approximately USD2,100) without detailed proof of actual loss in cases of personal data breach, does not automatically require compensation solely because a breach has occurred and that at least the occurrence of compensable mental harm (not so much of the volume or severity of such harm) must be proved by the plaintiffs. The case concerned a hacking incident affecting approximately 400,000 users of an online knowledge- sharing platform and involving encrypted passwords and email addresses. The plaintiffs asserted that the external leakage of their encrypted passwords and email addresses caused mental harm and sought compensation under Article 39-2 against the platform operator. The Court held that Article 39-2 does not mandate compensation in all personal data breach cases and clarified that the provision is not intended to impose liability where it is clear that no compensable damage has arisen. Accordingly, where a data controller dem - onstrates that no mental or other legally compensable harm warranting damages has occurred, liability for statutory damages may be denied.
In reaching this conclusion, the Court considered (among other factors) that: • the leaked passwords were encrypted, significantly reducing the likelihood that third parties could identify or misuse them; • the email addresses were not leaked in combina - tion with other identifying personal data and were not readily sufficient, by themselves, to identify specific individuals; and • given the nature of the knowledge-sharing plat - form, the leaked email addresses alone were unlikely to reveal users’ characteristics or prefer - ences. On that basis, the Court concluded that the risk of infringement of privacy, reputation or property inter - ests was low and that it was difficult to recognise the occurrence of compensable mental harm. Supreme Court decision on pseudonymisation and the right to request suspension (decided 18 July 2025) The Supreme Court addressed whether a pseu - donymisation process conducted pursuant to Article 28-2 of the PIPA for purposes such as statistical com - pilation, scientific research or archiving in the public interest constitutes “processing” subject to the right to request suspension under Article 37, paragraph 1. Article 28-7 expressly excludes the application of Article 37 to “pseudonymised data” prepared in accordance with Article 28-2. The dispute in this case concerned an earlier stage: whether the pseudonymi - sation process itself falls within the meaning of “pro - cessing of personal data” under Article 37, paragraph 1. If the plaintiffs’ interpretation was accepted, data subjects could request suspension of pseudonymisa - tion at the processing stage, potentially affecting the practical operation of the statutory pseudonymisa - tion framework introduced to facilitate data utilisation, including for AI development. Lower courts had concluded that the pseudonymi - sation process fell within the statutory definition of “processing”, which includes collection, use, provi - sion and other handling of personal data, and there -
451 CHAMBERS.COM
Powered by FlippingBook