Supreme Court Confirms: Submitting Personal Information in Complaints Does Not Breach PIPA

The Korean Supreme Court, in its decision on August 28, 2025 (2025Do6239), ruled that including another person’s personal information in a criminal complaint submitted to investigative authorities does not constitute a violation of the Personal Information Protection Act (PIPA). The case arose when the defendant, Mr. Kim, filed a complaint with the police accusing a colleague of fraudulently claiming overtime pay. In doing so, he filled out the standard complaint form and provided the colleague’s name, resident registration number, address, and phone number, which he had lawfully obtained from internal company documents. Both the trial court and the appellate court convicted Kim, holding that his actions amounted to an unlawful use of personal data under PIPA.

The Supreme Court overturned these rulings, finding that Kim’s conduct was not unlawful. It emphasized that when personal information is included in documents submitted during legal proceedings, such as lawsuits, complaints, or defenses, this can be justified under Article 20 of the Criminal Act as a “socially acceptable act.” The Court clarified that determining whether the act is legitimate requires a comprehensive and objective assessment, taking into account how the information was obtained, the purpose of its use, whether only the minimum necessary information was submitted, the possibility of anonymization, the type and sensitivity of the data, the degree of potential harm, and whether alternative methods existed. In this case, the Court concluded that Kim had obtained the data legally, provided only essential information needed for the police to identify and investigate the suspect, and that there was no realistic risk of the information being misused.

The ruling carries significant implications for the balance between data protection and civic rights. It prevents the overly broad and mechanical application of PIPA that could otherwise criminalize ordinary and legitimate activities, such as filing complaints, lawsuits, or reporting misconduct. This outcome alleviates the chilling effect that the threat of criminal liability has had on whistleblowers, journalists, and citizens seeking to expose wrongdoing.

This case illustrates the costs of such overreach, as Kim was forced to endure years of trials and significant psychological distress before being acquitted. The decision underscores the need for legislative reform of PIPA to provide clearer protections. This should include explicitly recognizing the processing of personal data for public interest as lawful, following the example of the EU’s General Data Protection Regulation (GDPR), and ensuring broader allowances for data use in journalism and whistleblowing. Such measures would help protect well-intentioned citizens from facing criminal prosecution simply for exercising their civic duties in reporting misconduct.

Korean version text