With much uncertainty in requirements of data processors under the Personal Information Protection Act (PIPA), the Supreme Court of Korea held that the use of another person’s lawfully collected name and address in a civil complaint filed against that same person may constitute a justifiable act and therefore may not be punishable under the Personal Information Protection Act, provided that the use remains within the scope necessary to conduct litigation.

On May 14, 2026, the Second Criminal Division of the Korean Supreme Court reversed the lower court’s guilty judgment in Case No. 2026Do171 and remanded the matter to the Uijeongbu District Court.

See: Definition of Personal Informational Processor under PIPA for a recent update on Korea’s PIPA.

Facts

  1. The Defendant was the principal of a kindergarten. The Complainant was the parent of a child enrolled at the kindergarten.
  2. In March 2021, the Complainant’s child enrolled and signed a consent form for the collection and use of personal information.
  3. In June 2022, Defendant filed a civil damages action against the Complaintant, alleging that the Complaintant posted defamatory statements about the Defendant on an online forum. In the civil complaint, the Defendant listed the Complainant’s name and address, which had been obtained from the consent form.
  4. The Korean Prosecution indicted the Defendant for violating the Korean Personal Information Protection Act.
  5. The court of first instance found Defendant guilty and imposed a fine of KRW 1 million. The appellate court upheld the guilty verdict and reduced the fine to KRW 500,000.

Korean Supreme Court Decision

The Supreme Court of Korea reversed and remanded. The Court noted that Defendant lawfully collected the name and address with the Complainant’s consent and that there was no evidence of illegality in the process by which the information was obtained. Although the Complainant’s name and address constituted personal information, the Court emphasized that the information was not sensitive information that carried a particularly high risk of privacy infringement.

The Supreme Court, in short, held that lawfully collected personal information, if used only to the extent necessary for the filing and prosecution of a civil lawsuit, such use may fall within the scope of a justifiable act and may not give rise to criminal punishment under PIPA.

About IPG Legal

IPG Legal is a leading international law firm with an office in Korea advising multinational companies, tech platforms, foreign investors, and individuals on Korean data privacy, PIPA compliance, cross-border data governance, and regulatory investigations before the Personal Information Protection Commission (PIPC).

Sean Hayes, a former law professor and the first non-Korean to work for the Korean court system, has advised global corporations, startups, and executives on high-risk Korean compliance matters, including data privacy governance, internal data-sharing compliance, and breach-response strategy.

For a recent article on PIPA related to the sharing of data between divisions of a Korean company, please see: Internal Data Sharing Between Departments in Companies in Korea: PIPA Basics

You may schedule a call with Sean Hayes at: Schedule a Call.