1.

Background

The defendant filed a criminal complaint with the police alleging that his colleague was engaging in criminal conduct. As part of the complaint, the defendant submitted materials containing the colleague’s personal data, such as CCTV footage, bank statements, financial transfer records, remittance slips, and payment records. The defendant had access to and retained these materials while performing his duties at work.
 
The defendant was subsequently indicted on charges of leaking personal data. The lower court found the defendant guilty on the grounds that submitting personal data to an investigative authority in connection with a criminal complaint cannot be excluded from the scope of “leakage” prohibited under the Personal Information Protection Act (“PIPA”). The lower court further held that such action did not constitute a “justifiable act” under Article 20 of the Criminal Code, which provides that “an act that is performed in accordance with statutes, or in the course of business, or does not contravene social norms, shall not be punishable.”
 

2.

Supreme Court Decision

In reversing the lower court’s ruling, the Court held that “if evidentiary materials containing personal data are submitted to an investigative agency in connection with a complaint, allegation, or investigation for the purpose of substantiating a criminal charge or exercising the right of defense, such submission may be considered not to violate social norms and, under Article 20 of the Criminal Code, may be deemed not unlawful.”
 
In reaching this conclusion, the Court considered the following criteria: (i) the circumstances and purpose under which the personal data was collected, retained, and submitted to an investigative authority; (ii) the party to whom the personal data was submitted; (iii) whether only the minimum data necessary to achieve the purpose of the submission was provided; (iv) whether it was possible to take measures to protect the personal data (such as anonymization) and, if so, the nature and extent of the measures taken; (v) the content, nature, and volume of the personal data submitted (including whether it was sensitive); (vi) whether there were alternative means or methods available that did not involve submitting the personal data; and (vii) whether there were unavoidable circumstances that led to the submission of personal data instead of relying on such alternative means or methods.
 
Applying the above standard to the facts of the case, the Supreme Court held that the defendant’s disclosure of personal data qualified as a “justifiable act.” The Court emphasized the following points:
 

3.

Implications

In the course of filing a criminal complaint or accusation with investigative authorities, it is often unavoidable to provide or submit materials containing personal data in order to substantiate the alleged offense. However, there have been frequent cases in which such conduct is treated as an unlawful “leakage” of personal information under the PIPA, exposing whistleblowers and complainants to criminal liability. To avoid this risk, some choose either not to submit materials containing personal data at all, or to redact all personal identifiers before submission. This, in turn, can make it difficult for investigative authorities to identify the alleged offender or key facts, resulting in investigations that are incomplete or ineffective.
 
This recent Supreme Court decision is significant in that it sets out concrete criteria for when the submission of evidence containing personal data to investigative authorities, without the data subject’s consent, may nonetheless be regarded as a “justifiable act.” Notably, while the Court had previously held that providing personal data to investigative authorities in connection with a complaint or accusation could not be excluded from the scope of “leakage” under the PIPA (Supreme Court Decision No. 2020Do6172, dated November 10, 2022), in this new case, the Court recognized the possibility that such leakage may be justifiable and thus avoid criminal liability. Through this decision, the Court appears to seek a better balance between protecting the rights and interests of complainants/whistleblowers and safeguarding personal information.
 
Going forward, when submitting materials containing personal data as part of a criminal complaint, it will be necessary to carefully review the criteria established by the Supreme Court. In particular, the following factors should be considered comprehensively: (i) the legitimacy of the purpose and the public interest aspect of the criminal complaint; (ii) the necessity of the personal data submitted and whether only the minimum amount was provided; (iii) the degree of sensitivity of the personal data; and (iv) the feasibility of safeguard measures such as anonymization or redaction. It is therefore advisable to assess in advance whether the relevant submission can constitute a justifiable act.