ANNEX II

May 18, 2021

His Excellency Mr. Didier Reynders, Commissioner for Justice of the European Commission

Your Excellency,

I welcome the constructive discussions between Korea and the European Commission aiming at building the framework for transfer of personal data from EU to Korea.

Upon the request from the European Commission to the government of Korea, I am sending a document attached herewith providing an overview of the legal framework concerning access to information by the government of Korea.

This document concerns many ministries and agencies of the government of Korea, and regarding the contents of the document, the relevant ministries and agencies (Personal Information Protection Commission, Ministry of Justice, National Intelligence Service, National Human Rights Commission of Korea, National Counter Terrorism Center, Korea Financial Intelligence Unit) are responsible for the passages within the scope of their respective competences. Please find below the relevant ministries and agencies and respective signatures.

The Personal Information Protection Commission accepts all inquiries on this document and will coordinate the necessary responses among the relevant ministries and agencies.

I hope that this document would be helpful in making decisions at the European Commission.

I do appreciate your great contribution to date in this matter.

Sincerely yours,

Yoon Jong In

Chairperson of Personal Information Protection Commission

This Document was drawn up by Personal Information Protection Commission and the following ministries and agencies concerned.

Park Jie Won

President(Director), National Intelligence Service

Lee Jung Soo

Director General, Ministry of Justice

Choi Young Ae

Chairperson, National Human Rights Commission of Korea

Kim Hyuck Soo

Director, National Counter Terrorism Center

Kim, Jeong Kag

Commissioner, Korea Financial Intelligence Unit

Legal framework for the collection and use of personal data by Korean public authorities for law enforcement and national security purposes

The following document provides an overview of the legal framework for the collection and use of personal data by Korean public authorities for criminal law enforcement and national security purposes (hereinafter referred to as ‘ government access ’), in particular as regards the available legal bases, applicable conditions (limitations) and safeguards, as well as independent oversight and individual redress possibilities.

1. GENERAL LEGAL PRINCIPLES RELEVANT FOR GOVERNMENT ACCESS

1.1. Constitutional framework

The Constitution of the Republic of Korea lays down the right to privacy in general (Article 17) and the right to privacy of correspondence in particular (Article 18). It is the duty of the State to guarantee these fundamental rights. The Constitution furthermore stipulates that the rights and freedoms of citizens may only be restricted by law and when necessary for national security, or the maintenance of law and order for public welfare. Even when such restrictions are imposed, they may not affect the essence of the freedom or right. The Korean courts have applied these provisions in cases concerning government interference with privacy. For example, the Supreme Court found that the monitoring of civilians violated the fundamental right to privacy, stressing that citizens have " the right to self-determination of personal information." In another case, the Constitutional Court held that privacy is a fundamental right that provides protection from state intervention and observation in the private life of citizens.

The Korean Constitution furthermore guarantees that no person shall be arrested, detained, searched, interrogated, or items seized except as provided by law. Moreover, searches and seizures may only be conducted on the basis of a warrant issued by a judge, upon request of a prosecutor, and in respect of due process. In exceptional circumstances, i.e. where a criminal suspect is apprehended while committing a crime (flagrante delicto), or where there is a risk that a person suspected of committing a crime punishable by imprisonment of three years or more may escape or destroy evidence, investigative authorities may conduct a warrantless search or seizure, in which case they must request a warrant ex post. These general principles are further developed in specific laws dealing with criminal procedure and the protection of communications (see below for a detailed overview).

With respect to foreign nationals, the Constitution stipulates that their status is guaranteed as prescribed by international law and treaties. Several international agreements to which Korea is a party guarantee privacy rights, such as the International Covenant on Civil and Political Rights (Article 17), the Convention on the Rights of Persons with Disabilities (Article 22) and the Convention on the Rights of the Child (Article 16). In addition, while the Constitution in principle refers to the rights of " citizens ", the Constitutional Court has ruled that also foreign nationals hold basic rights. In particular, the Court held that the protection of dignity and a person’s value as a human being as well as the right to seek happiness are rights of any human being, and not just of citizens. The Court also clarified that the right to control one’s information is considered to be a basic right, grounded in the right to dignity and the pursuit of happiness and the right to private life. Although case law has so far not specifically dealt with the right to privacy of non-Korean nationals, it is therefore widely accepted among scholars that Articles 12-22 of the Constitution (which include the right to privacy as well as personal liberty) set out ‘ rights of human beings.’

Finally, the Constitution also provides for a right to claim just compensation from public authorities. Moreover, on the basis of the Constitutional Court Act, any person whose fundamental rights guaranteed by the Constitution are infringed by the exercise of governmental power (excluding judgments of the courts) may lodge a constitutional complaint with the Constitutional Court.

1.2. General data protection rules

The general data protection law in the Republic of Korea, the Personal Information Protection Act (hereafter ‘ PIPA ’), applies to both the private and public sector. With respect to public authorities, PIPA specifically refers to the obligation to formulate policies to prevent ‘ abuse and misuse of personal information, indiscrete surveillance and tracking, etc. and to enhance the dignity of human beings and individual privacy.’

The processing of personal data for law enforcement purposes is subject to the entirety of PIPA’s requirements. This means for instance that criminal law enforcement authorities must comply with the obligations for lawful processing, i.e. rely on one of the legal bases listed in PIPA for the collection, use or provision of personal information (Articles 15-18 PIPA), as well as the principles of purpose limitation (Article 3(1), (2) PIPA), proportionality/data minimisation (Article 3(1), (6) PIPA), limited data retention (Article 21 PIPA), data security, including data breach notification (Articles 3(4), 29 and 34 PIPA), and transparency (Articles 3(1), (5), 20, 30 and 32 PIPA). Specific safeguards apply with respect to sensitive information (Article 23 PIPA). Moreover, in accordance with Articles 3(5) and 4 PIPA, as well as Articles 35 to 39-2 PIPA, individuals can exercise their rights of access, correction, deletion and suspension vis-à-vis law enforcement authorities.

While PIPA therefore fully applies to the processing of personal data for criminal law enforcement purposes, it contains an exception when personal data is processed for national security purposes. According to Article 58(1) lit. 2 PIPA, Articles 15-50 PIPA do not apply to personal information collected or requested for the analysis of information related to national security. Conversely, Chapter I (General provisions), Chapter II (Establishment of personal information protection policies, etc.), Chapter VIII (Class-action lawsuit over data infringement), Chapter IX (Supplementary provisions) and Chapter X (Penalty provisions) of PIPA remain applicable. This includes the general data protection principles set out in Article 3 (Principles of protecting personal information) and the individual rights guaranteed by Article 4 PIPA (Rights of data subjects). This means that the main principles and rights are guaranteed also in this area. In addition, Article 58(4) PIPA provides that such information must be processed to the minimum extent necessary to attain the intended purpose and for the minimum period; it also requires the personal information controller to put in place the necessary measures to ensure safe data management and appropriate processing, such as technical, managerial and physical safeguards, as well as measures for the appropriate handling of individual grievances.

In Notification No. 2021-1 on Supplementary rules for the interpretation and application of the Personal Information Protection Act, the Personal Information Protection Commission (hereafter ‘ PIPC ’) has further clarified how PIPA applies to the processing of personal data for national security purposes, in light of this partial exemption. This includes in particular the rights of individuals (access, rectification, suspension and deletion) and the grounds as well as limitations for possible restrictions thereof. According to the Notification, the application of the core principles, rights and obligations of PIPA to the processing of personal data for national security purposes reflects the guarantees provided by the Constitution for the protection of the individual’s right to control his or her own personal information. Any restriction to that right, for example when necessary for the protection of national security, requires a balancing of the rights and interests of the individual against the relevant public interest and may not affect the essence of the right (Article 37(2) of the Constitution).

2. GOVERNMENT ACCESS FOR LAW ENFORCEMENT PURPOSES

2.1. Competent public authorities in the area of law enforcement

Based on the Criminal Procedure Act (hereafter ‘ CPA ’), the Communications Privacy Protection Act (hereafter ‘ CPPA ’) and the Telecommunications Business Act (hereafter ‘ TBA ’), the police, prosecutors and courts may collect personal data for criminal law enforcement purposes. To the extent the National Intelligence Service Act confers this power also onto the National Intelligence Service (hereafter ‘ NIS ’), it has to comply with the aforementioned Acts. Finally, the Act on Reporting and Using Specified Financial Transaction Information (hereafter ‘ARUSFTI’) provides a legal basis for financial institutions to disclose information to the Korea Financial Intelligence Unit (hereafter ‘KOFIU’) for the purpose of preventing money laundering and terrorism financing. This specialised agency may in turn provide such information to law enforcement authorities. However, these disclosure obligations only apply to data controllers that process personal credit information pursuant to the Credit Information Act and are subject to the oversight of the Financial Services Commission. Since the processing of personal credit information by such controllers is excluded from the scope of the adequacy decision, the limitations and safeguards that apply under the ARUSFTI are not described in further detail in this document.

2.2. Legal bases and limitations

The CPA (see 2.2.1), CPPA (see 2.2.2) and Telecommunications Business Act (see 2.2.3) provide legal bases for the collection of personal information for law enforcement purposes and set out the applicable limitations and safeguards.

2.2.1. Searches and seizures

2.2.1.1. Legal basis

Prosecutors and senior judicial police officers may only inspect articles, search persons or seize articles (1) if a person is suspected of having committed a crime (a criminal suspect), (2) it is necessary for the investigation and (3) the articles to be inspected, persons to be searched, and any articles seized are deemed to be connected with the case. Likewise, courts may conduct searches and seize any articles to be used as evidence or liable to confiscation, as long as such articles or persons are considered to be connected with a specific case.

2.2.1.2. Limitations and safeguards

As a general obligation, prosecutors and judicial police officers must respect the human rights of the criminal suspect as well as those of any other person concerned. In addition, compulsory measures to achieve the purpose of the investigation may only be taken where explicitly provided for in the CPA and to the least extent necessary.

Searches, inspections or seizures by police officers or prosecutors as part of a criminal investigation may only take place on the basis of a court-issued warrant. The authority requesting a warrant must submit materials demonstrating the grounds for suspecting an individual of having committed a crime, that the search, inspection or seizure is necessary, and that the relevant articles to be seized exist. As for the warrant, it must amongst other elements contain the names of the criminal suspect and the offence; the place, person or articles to be searched, or articles to be seized; the date of issuing; and the effective period of application. Similarly, when, as part of ongoing Court proceedings, searches and seizures are carried out other than in open court, a court-issued warrant must be obtained beforehand. The concerned individual and his/her defence council is notified in advance of the search or seizure and may be present when the warrant is being executed.

When conducting searches or seizures and where the article to be searched is a computer disc or other data storage medium, in principle only the data itself (copied or printed out) will be seized rather than the entire medium. The data storage medium itself may only be seized when it is considered substantially impossible to print out or copy the required data separately, or when it is considered substantially impracticable to otherwise accomplish the purpose of the search. The concerned individual must be notified of the seizure without delay. There are no exceptions to this notification requirement under the CPA.

Warrantless searches, inspections and seizures may only take place in limited situations. First, this is the case when it is impossible to obtain a warrant because of urgency at the scene of an offence. However, a warrant must subsequently be obtained without delay. Second, warrantless searches and inspections may take place in loco when a criminal suspect is arrested or detained. Finally, a prosecutor or senior judicial police officer may seize an article without a warrant when the article has been discarded by a criminal suspect or third person, or was voluntarily produced.

Evidence that has been obtained in violation of the CPA will be considered inadmissible. Moreover, the Criminal Act stipulates that illegal searches of persons or a person’s place of residence, guarded building, structure, automobile, ship, aircraft or occupied room, is punishable by imprisonment for a maximum of three years. This provision therefore also applies where objects, such as data storage devices, are seized during an illegal search.

2.2.2. Collection of communication information

2.2.2.1. Legal basis

The collection of communication information is governed by a specific Act, the CPPA. In particular, the CPPA stipulates a prohibition for anyone to censor any mail, wiretap any telecommunications, provide communication confirmation data, or record or listen to any conversation between others that are not made public, except on the basis of the CPA, the CPPA or the Military Court Act. The term ‘ communication ’ within the meaning of the CPPA covers both ordinary mail and telecommunications. In this respect, the CPPA distinguishes between ‘ communication-restricting measures ’ and the collection of ‘ communication confirmation data ’.

The notion of communication-restricting measures covers ‘ censorship ’, i.e. the collection of the content of traditional postal mail, as well as ‘ wire-tapping ’, i.e. the direct interception (acquiring or recording) of the content of telecommunications. The notion of communication confirmation data covers ‘ data on the records of telecommunications ’, which includes the date of telecommunications, their start- and end time, the number of outgoing and incoming calls as well as the subscriber number of the other party, the frequency of use, log files on the use of telecommunication services and location information (e.g. from transmission towers where signals are received).

The CPPA sets out the limitations and safeguards for the collection of both types of data, and non-compliance with several of these requirements is subject to criminal penalties.

2.2.2.2. Limitations and safeguards applicable to the collection of the content of communications (communication restricting measures)

The collection of the content of communications may only take place as a supplementary means of facilitating a criminal investigation (i.e. as a measure of last resort) and efforts must be made to minimise the interference with people's communication secrets. In line with this general principle, communication-restricting measures may only be deployed where it is difficult to otherwise prevent the commission of a crime, arrest the criminal, or collect the evidence. Law enforcement agencies collecting the content of communications must immediately cease to do so once continued access is no longer deemed to be necessary, thereby ensuring that the infringement of the privacy of communications is as limited as possible.

Moreover, communication-restricting measures may only be used when there is substantial reason to suspect that certain serious crimes specifically listed in the CPPA are being planned, are being committed, or have been committed. These include crimes such as insurrection, drug-related crimes or crimes involving explosives, as well as crimes related to national security, diplomatic relations, or military bases and installations. The target of a communication-restricting measure must be specific mail items or telecommunications sent or received by the suspect, or mail items or telecommunications sent or received by the suspect during a fixed period of time.

Even when these requirements are met, the collection of content data may only take place on the basis of a court-issued warrant. In particular, a prosecutor may ask the court to permit the collection of content data regarding the suspect or person under investigation. Similarly, a judicial police officer may apply for authorisation to a prosecutor, who in turn may request a warrant from the court. A request for a warrant must be made in writing and must contain specific elements. In particular, it must set out (1) the substantial reasons to suspect that one of the listed crimes is planned, being committed or has been committed as well as any materials establishing a prima facie case of suspicion; (2) the communication-restricting measures as well as their target, scope, objective and effective period; and (3) the place where the measures would be executed and how they would be carried out.

Where the legal requirements are satisfied, the court may grant written permission to carry out communication-restricting measures with respect to the suspect or person under investigation. This warrant specifies the kinds of measures as well as their target, scope, effective period, place of execution and how they shall be carried out.

Communication-restricting measures may only be carried out for a period of two months. If the objective of the measures is achieved earlier within that period, the measures must be discontinued immediately. Conversely, if the required conditions are still met, a request to extend the effective period of communication-restricting measures may be filed within the two months’ time limit. Such a request must include materials establishing a prima facie case for extending the measures. The extended period may not exceed a total of one year, or three years for certain particularly serious crimes (e.g. crimes related to insurrection, foreign aggression, national security, etc.).

Law enforcement authorities may compel the assistance of communication operators by providing them with the court’s written permission. Communication operators are required to cooperate and to keep the permission received in their files. They may refuse cooperation when information on the targeted individual as indicated in the court’s written permission (for example the individual’s telephone number) is incorrect. Moreover, they are prohibited under all circumstances from disclosing passwords used for telecommunications.

Anyone executing communication-restricting measures or requested to cooperate must keep records specifying the objectives of the measures, their execution, the date on which cooperation was provided and the target. Records must also be kept by law enforcement authorities implementing communication-restricting measures, setting out the details and obtained outcomes. Judicial police officers must provide this information by means of a report to the prosecutor when they close an investigation.

When a prosecutor issues an indictment with respect to a case in which communication-restricting measures were used, or issues a disposition not to indict or arrest the relevant individual (i.e. not just a stay of prosecution), the prosecutor must notify the individual subject to the communication-restricting measures of the fact that communication-restricting measures were executed, the executing agency and the execution period. Such notice must be provided in writing within 30 days from the disposition. Notice may be deferred when it is likely to seriously endanger national security or disrupt the public safety and order, or when it is likely to result in material harm to the lives and bodies of others. When intending to defer notice, the prosecutor or judicial police officer must obtain approval from the head of the District Public Prosecutor’s Office. Once the grounds for referral cease to exist, notice must be provided within 30 days from that moment in time.

The CPPA also sets out a specific procedure for the collection of the content of communications in emergency situations. In particular, law enforcement agencies may collect the content of communications in the event that the planning or execution of organised crime or another serious crime that may directly cause death or serious injury is imminent, and an emergency exists that makes it impossible to go through the regular procedure (as set out above). In such an emergency, a police officer or prosecutor may take communication-restricting measures without prior court permission but must file for court permission immediately after execution. If the law enforcement agency fails to obtain court permission within 36 hours from the moment the emergency measures were carried out, the collection must be discontinued immediately, typically followed by the destruction of the collected information. Police officers carrying out emergency surveillance do so under the control of a prosecutor, or, in case receiving the prosecutor’s instructions in advance is impossible due to the necessity of acting urgently, the police must obtain the approval of a prosecutor immediately upon commencing execution. The rules on the notification of the individual as described above also apply to the collection of the content of communications in emergency situations.

Collection of information in emergency situations must always take place in accordance with an ‘ emergency censorship/wiretapping statement ’ and the authority carrying out the collection must keep a register of any emergency measure. The request to a court to grant permission for emergency measures must be accompanied by a written document indicating the necessary communication-restricting measures, the target, subject, scope, period, place of execution, method, and an explanation as to how the relevant communication-restricting measures meet Article 5(1) CPPA, along with supporting documents.

In cases when emergency measures are completed within a short time, thus ruling out court permission (e.g. if the suspect is arrested immediately after initiating the interception, which therefore stops), the head of the competent Public Prosecutor's Office serves an emergency measure notice to the competent court. The notice must set out the objective, target, scope, period, place of execution and method of collection as well as the grounds for not filing a request for court permission. This notice allows the receiving court to examine the legality of the collection and must be entered into a registry of emergency measure notices.

As a general requirement, the content of communications acquired through the execution of communication-restricting measures on the basis of the CPPA may only be used to investigate, prosecute or prevent the specific crimes listed above, in disciplinary proceedings for the same crimes, a claim for damages raised by a party to the communications or where this is allowed by other laws.

Specific safeguards apply where telecommunications transmitted over the internet are collected. Such information may only be used to investigate the serious crimes listed in Article 5(1) CPPA. To retain the information, approval must be obtained from the court that authorised the communication-restricting measures. A request for retention must contain information on the communication-restricting measures, a summary of the results of the measures, the reasons for retention (together with supporting materials) and the telecommunications to be retained. In the absence of such a request, the acquired telecommunications must be deleted within 14 days after the communication-restricting measures have ended. If a request is rejected, the telecommunications must be destroyed within seven days. Where telecommunications are deleted, a report must be filed within seven days with the court that authorised the communication-restricting measures, setting out the reasons for the deletion, as well as the details and timing thereof.

More generally, if information was illegally obtained by means of communication-restricting measures, it will not be admitted as evidence in judicial or disciplinary proceedings. Also, the CPPA prohibits any person taking communication-restricting measures from disclosing confidential information obtained in the course of implementing such measures, and from using the information obtained to damage the reputation of those who are subject to the measures.

2.2.2.3. Limitations and safeguards applicable to the collection of communication confirmation information

On the basis of the CPPA, law enforcement authorities may request telecommunication operators to provide communication confirmation data when necessary to conduct an investigation or execute a sentence. Unlike for the collection of content data, the possibility to collect communication confirmation data is not limited to certain specific crimes. However, as is the case for content data, the collection of communication confirmation data requires prior written permission from a court, subject to the same conditions as described earlier. When grounds of urgency make it impossible to obtain court permission, communication confirmation data may be collected without a warrant, in which case the permission must be obtained immediately after requesting the data and must be communicated to the telecommunication provider. If no subsequent permission is obtained, the collected information must be destroyed.

Prosecutors, judicial police officers and courts must keep records of requests for communication confirmation data. In addition, telecommunication providers must twice per year report on the disclosure of communication confirmation data to the Minister of Science and ICT, and must keep records thereof for seven years from the date on which data has been disclosed.

Individuals are in principle notified of the fact that communication confirmation data has been collected. The timing for such notification depends on the circumstances of the investigation. Once a decision is taken (not) to prosecute, notification must be provided within 30 days. Conversely, if indictment is suspended, notification must be provided within 30 days following one year after such decision is taken. In any event, notification must be provided within 30 days following one year after the information has been collected.

The notification may be deferred if it is likely to (1) endanger national security, public security and order, (2) cause death or bodily injury, (3) impede fair judicial proceedings (e.g. leading to the destruction of evidence or threatening of witnesses), or (4) defame the suspect, victims or other persons related to the case, or invade their privacy. Notification on one of the aforementioned grounds requires authorisation from the director of a competent district public prosecutors’ office. When the grounds for deferral cease to exist, notice must be provided within 30 days from that moment in time.

Notified individuals may submit a written request to the prosecutor or judicial police officer concerning the reasons for the collection of the communication confirmation data. In that case, the prosecutor or judicial police officer must provide the reasons in writing within 30 days after receiving the request, unless one of the abovementioned grounds (exceptions for deferral of notification) applies.

2.2.3. Voluntary disclosure by telecommunications business operators

Article 83(3) of the TBA allows telecommunications business operators to voluntarily comply with a request (made in support of a criminal trial, investigation or the execution of a sentence) from a court, prosecutor or the head of an investigative agency, to disclose ‘ communications data ’. In the context of the TBA, " communications data " cover the name, resident registration number, address and phone number of users, the dates on which users subscribe or terminate their subscription as well as user identification codes (i.e. codes used to identify the rightful user of computer systems or communication networks). For the purpose of the TBA, only individuals that directly contract services from a Korean telecommunications provider are considered users. As a consequence, situations where EU individuals whose data has been transferred to the Republic of Korea would be considered users under the TBA are likely to be very limited, as those individuals would normally not conclude a direct contract with a Korean telecommunications operator.

Requests to obtain communications data on the basis of the TBA must be made in writing and state the reasons for the request, the link to the relevant user and the scope of the requested data. Where it is impossible to provide a written request due to urgency, the written request must be provided as soon as the reason for the urgency disappears. Telecommunications business operators that comply with requests to disclose communications data must retain ledgers which contain records indicating that communications data have been provided, as well as the related materials, such as the written request. Moreover, telecommunications business operators must report on the provision of communications data to the Minister of Science and ICT twice per year.

There is no obligation for telecommunications business operators to comply with requests to disclose communications data on the basis of the TBA. Each request must therefore be assessed by the operator in light of the applicable data protection requirements under PIPA. In particular, a telecommunications business operator must take into account the interests of the data subject and may not disclose the information if it would be likely to infringe unfairly on the interest of the individual or a third party. In addition, in accordance with Notification No. 2021-1 on Supplementary rules for the interpretation and application of the Personal Information Protection Act, the concerned individual must be notified of the disclosure. In exceptional situations, such notification may be delayed, in particular if and for as long as the notification would jeopardise an ongoing criminal investigation or is likely to harm the life or body of another person, where those rights or interests are manifestly superior to the rights of the data subject.

In 2016, the Supreme Court confirmed that the voluntary provision of communications data by telecommunications business operators without a warrant on the basis of the TBA does not as such violate the right to informational self-determination of the user of the telecommunication service. At the same time, the Court clarified that there would be such a violation if it is manifestly apparent that the requesting agency abused its authority to request the disclosure of communications data, thereby violating the interests of the individual concerned or a third party. More generally, any request for voluntary disclosure by a law enforcement authority must comply with the principles of lawfulness, necessity and proportionality following from the Korean Constitution (Articles 12(1) and 37(2)).

2.3. Oversight

Oversight of criminal law enforcement authorities is carried out through different mechanisms, both internally and by external bodies.

2.3.1. Self-auditing

In accordance with the Act on Public Sector Audits, public authorities are encouraged to establish an internal body for self-auditing, with the task, amongst others, to carry out legality control. The heads of such audit bodies must be guaranteed independence to the largest extent possible. More specifically, they are appointed from outside the relevant authority (e.g. former judges, professors) for a period of two to five years and can only be dismissed for justified reasons (e.g. when unable to perform duties due to a mental or physical disorder, when subject to disciplinary action). Likewise, auditors are appointed on the basis of specific conditions laid down in the Act. Audit reports may include recommendations or requests for compensation or correction, as well as reprimands and recommendations or requests for disciplinary action. They are notified to the head of the public authority subject to the audit, as well as to the Board of Audit and Inspection (see section 2.3.2) within 60 days from completion of the audit. The authority concerned must implement the required measures and report the results to the Board of Audit and Inspection. In addition, audit results are generally made available to the public. The refusal or obstruction of a self-audit is subject to administrative fines. In the area of criminal law enforcement, to comply with the aforementioned legislation, the National Police Agency operates an Inspector-General system to handle internal audits, including with respect to possible human rights violations.

2.3.2. The Board of Audit and Inspection

The Board of Audit and Inspection (hereafter ‘ BAI ’) may inspect the activities of public authorities and, on the basis of such inspections, issue recommendations, request disciplinary actions, or file a criminal complaint. The BAI is established under the President of the Republic of Korea, but retains an independent status with respect to its duties. In addition, the Act establishing the BAI requires that the BAI shall be granted independence to the maximum extent with respect to the appointment, dismissal and organisation of its staff, as well as the compilation of its budget. The Chairperson of the BAI is appointed by the President, with the consent of the National Assembly. The six remaining Commissioners are appointed by the President, upon recommendation of the Chairperson, for a four-year term. Commissioners (including the Chairperson) must meet specific qualifications laid down by law and may only be dismissed in case of impeachment, sentencing to imprisonment or inability to perform their duties due to long-term mental or physical weakness. Moreover, Commissioners are prohibited from participating in political activities, and from concurrently holding offices in the National Assembly, administrative agencies, organisations subject to audit and inspection by the BAI or any other office or position that is remunerated.

The BAI conducts a general audit on an annual basis, but may also conduct specific audits on matters of special interest. The BAI may request the submission of documents in the course of an inspection and request the attendance of individuals. As part of an audit, the BAI examines the revenue and expenditure of the State, but also oversees general compliance with the duties of public authorities and public officials with a view to improving the operation of public administration. Its oversight therefore extends beyond budgetary aspects and also includes a legality control.

2.3.3. The National Assembly

The National Assembly may investigate and inspect public authorities. During an investigation or inspection, the National Assembly may request the disclosure of documents and compel the appearance of witnesses. Anyone committing perjury during an investigation of the National Assembly is subject to criminal sanctions (imprisonment for up to ten years). The process and results of inspections may be made public. If the National Assembly finds unlawful or improper activity, it may request that the relevant public authority takes corrective measures, including awarding compensation, taking disciplinary action, and improving its internal procedures. Following such a request, the authority must act without delay and report the outcome to the National Assembly.

2.3.4. The Personal Information Protection Commission

The Personal Information Protection Commission (hereafter ‘ PIPC ’) exercises oversight over the processing of personal information by criminal law enforcement authorities in line with PIPA. In addition, according to Article 7-8(3), (4) and Article 7-9(5) PIPA, the oversight of the PIPC also covers possible infringements of the rules setting out the limitations and safeguards with respect to the collection of personal information, including those contained in the specific laws regulating the collection of (electronic) evidence for the purposes of criminal law enforcement (see section 2.2). Given the requirements in Article 3(1) PIPA for the lawful and fair collection of personal information, any such infringement also constitutes a violation of PIPA, allowing the PIPC to carry out an investigation and to take corrective measures.

In exercising its oversight function, the PIPC has access to all relevant information. The PIPC may provide advice to law enforcement authorities to improve the level of personal information protection of their processing activities, impose corrective measures (e.g. to suspend data processing or take necessary measures to protect personal information) or advise the authority to take disciplinary action. Finally, criminal sanctions are foreseen for certain PIPA violations, such as unlawfully using or disclosing personal information to third parties or the unlawful processing of sensitive information. In this respect, the PIPC may refer the matter to the competent investigative agency (including a prosecutor).

2.3.5. The National Human Rights Commission

The National Human Rights Commission (hereafter ‘ NHRC ’) – an independent body tasked with protecting and promoting fundamental rights – has the power to investigate and remedy violations of Articles 10–22 of the Constitution, which include the rights to privacy and privacy of correspondence. The NHRC is comprised of 11 Commissioners, appointed upon nomination by the National Assembly (four), the President (four) and the Chief Justice of the Supreme Court (three). To be appointed, a Commissioner must (1) have served for at least ten years at a university or an authorized research institute, at least as an associate professor; (2) have served as a judge, prosecutor, or attorney-at-law for at least ten years; (3) have been engaged in human rights activities for at least ten years (e.g. for a non-profit, non-governmental organisation or international organisation); or (4) have been recommended by civil society groups. The Chairperson is appointed by the President from among the Commissioners and must be confirmed by the National Assembly. Commissioners (including the Chairperson) are appointed for a renewable term of three years and may only be dismissed in case they are sentenced to imprisonment or are no longer capable of performing their duties due to prolonged physical or mental weakness (in which case two thirds of the Commissioners must agree to the dismissal). NHRC Commissioners are prohibited from holding a concurrent office in the National Assembly, local councils, or any State or local government (as a public official).

The NHRC may initiate an investigation on its own initiative or on the basis of a petition from an individual. As part of its investigation, the NHRC may request the submission of relevant materials, conduct inspections and summon individuals to testify. Following an investigation, the NHRC may issue recommendations to improve or correct specific policies and practices, and may make them public. Public authorities must notify the NHRC of a plan to implement such recommendations within 90 days upon receiving them. Moreover, in case of a failure to implement recommendations, the concerned authority must inform the Commission thereof. The NHRC may in turn disclose such failure to the National Assembly, and/or make it public. Public authorities generally comply with NHRC recommendations and have a strong incentive to do so as their implementation has been assessed as part of the general evaluation conducted by the Office for Government Policy Coordination, under the authority of the Prime Minister’s Office.

2.4. Individual redress

2.4.1. Redress mechanisms available under PIPA

Individuals may exercise their rights of access, correction, deletion and suspension under PIPA with respect to personal information processed by criminal law enforcement authorities. Access may be requested directly from the relevant authority, or indirectly via the PIPC. The competent authority may limit or deny access only where this is provided for by law, where it would likely cause damage to the life or body of a third party, or would likely lead to or unjustified infringement of property and other interests of another person (i.e. where the interests of the other person would outweigh the interests of the individual making the request). If an access request is denied, the individual must be informed of the reasons therefor and how to appeal. Similarly, a request for correction or erasure may be denied where this is provided for in other laws, in which case the individual must be informed of the underlying reasons and the possibility to appeal.

As regards redress, individuals may lodge a complaint with the PIPC, including through the Privacy Call Centre operated by the Korea Internet and Security Agency. In addition, an individual may obtain mediation through the Personal Information Dispute Mediation Committee. These redress avenues are available both in case of possible infringements of the rules contained in specific laws setting out the limitations and safeguards with respect to the collection of personal information (section 2.2) and of PIPA. In addition, individuals may challenge the decisions or inaction of the PIPC under the Administrative Litigation Act (see section 2.4.3).

2.4.2. Redress before the National Human Rights Commission

The NHRC handles complaints from individuals (both Korean and foreign nationals) concerning human rights violations committed by public authorities. There is no standing requirement for individuals to lodge a complaint with the NHRC. As a consequence, a complaint will be handled by the NHRC even if the concerned individual cannot demonstrate an injury in fact at the admissibility stage. In the context of the collection of personal data for criminal law enforcement purposes, an individual would therefore not be required to demonstrate that his/her personal information has in fact been accessed by Korean public authorities for the complaint to be admissible before the NHRC. An individual may also request to resolve the complaint through mediation.

To investigate a complaint, the NHRC can make use of its investigatory powers, including by requesting the submission of relevant materials, conducting inspections and summoning individuals to testify. If the investigation reveals that a violation of relevant laws has occurred, the NHRC may recommend the implementation of remedies or the rectification or improvement of any relevant statute, institution, policy or practice. Proposed remedies may include mediation, cessation of the human rights violation, compensation for damages and measures to prevent recurrence of the same or similar violations. In the case of unlawful collection of personal information under applicable rules, remedial measures may include the deletion of the personal information collected. If it is deemed highly likely that the infringement is ongoing and it is deemed likely that, if left unattended, damage difficult to remedy would be caused, the NHRC may adopt urgent relief measures.

While the NHRC has no power to compel, its decisions (e.g. a decision not to continue the investigation of a complaint) and recommendations can be challenged before the Korean courts under the Administrative Litigation Act (see section 2.4.3 below). In addition, if the findings of the NHRC reveal that personal data was unlawfully collected by a public authority, an individual could seek further redress before the Korean courts against that public authority, e.g. by challenging the collection under the Administrative Litigation Act, filing a constitutional complaint under the Constitutional Court Act, or applying for compensation of damages under the State Compensation Act (see section 2.4.3 below).

2.4.3. Judicial redress

Individuals may invoke the limitations and safeguards described in the previous sections to obtain redress before the Korean courts through different avenues.

First, in accordance with the CPA, the concerned individual and his/her counsel may be present when a warrant for a search or seizure is being executed, and may therefore raise an objection at the time the warrant is being executed. In addition, the CPA provides for a so-called ‘quasi-complaint’ mechanism, which allows individuals to petition the competent court with a request to cancel or alter a disposition made by a prosecutor or police officer concerning a seizure. This allows individuals to challenge the measures taken to execute a seizure warrant.

Moreover, individuals may obtain compensation for damages before the Korean courts. On the basis of the State Compensation Act, individuals may apply for compensation for damages inflicted by public officials in performing their official duties in violation of the law. A claim under the State Compensation Act may be filed with a specialised ‘Compensation Council’, or directly with the Korean courts. If the victim is a foreign national, the State Compensation Act applies as long as that national’s country of origin equally ensures state compensation for Korean nationals. According to case law, this condition is fulfilled if the requirements to request compensation in the other country ‘ are not significantly off-balanced between Korea and the other country ’ and ‘ are not generally stricter than those determined by Korea, having no material and substantive difference. ’" The Civil Act governs the state’s liability for compensation and, as a consequence, state liability also covers non-property damages (e.g. mental suffering).

For violations of the data protection rules, an additional legal remedy is provided under PIPA. According to Article 39 PIPA, any individual suffering harm as a result of a violation of PIPA or of a loss, theft, divulgence, forgery, alteration of, or damage to his/her personal information may obtain compensation for damages before the courts. There is no similar requirement of reciprocity as under the State Compensation Act.

In addition to compensation for damages, administrative redress may be obtained against actions or omissions of administrative agencies under the Administrative Litigation Act. Any individual may challenge a disposition (i.e. the exercise of, or refusal to exercise, public power in a specific case) or omission (the prolonged failure of an administrative agency to take a certain disposition contrary to a legal obligation to do so), which may lead to the revocation/alteration of an illegal disposition, a finding of nullity (i.e. a finding that the disposition does not have legal effect or its non-existence in the legal order) or a finding that an omission is illegal. In order to be able to challenge an administrative disposition, it must directly impact on civil rights and duties. This includes measures to collect personal data, be it directly (e.g. intercepting communications) or by way of a disclosure request (e.g. to a service provider).

The aforementioned claims may first be brought before administrative appeals commissions established under certain public authorities (e.g. the NIS, the NHRC) or before the Central Administrative Appeals Commission established under the Anti-Corruption and Civil Rights Commission. Such an administrative appeal provides an alternative, more informal avenue to challenge a disposition or omission of a public authority. However, a claim may also be brought directly before the Korean courts, under the Administrative Litigation Act.

A request for revocation/alteration of a disposition under the Administrative Litigation Act may be filed by any person having a legal interest to seek the revocation/alteration, or to be restored in his/her rights by the revocation/alteration in case the disposition no longer has effect. Similarly, litigation to affirm nullity may be brought by a person having a legal interest in such affirmation, while a litigation to affirm the illegality of an omission may be initiated by any person who has made a request for a disposition and has a legal interest to seek that the illegality of the omission be affirmed. According to case law of the Supreme Court, ‘legal interest’ is interpreted as a ‘legally protected interest’, i.e. a direct and specific interest protected by laws and regulations on which administrative dispositions are based (i.e. not general, indirect and abstract interests of the public). Individuals therefore have a legal interest in case of any violation of the limitations and safeguards with respect to the collection of their personal data for criminal law enforcement purposes (under specific laws or PIPA). A final judgment under the Administrative Litigation Act is binding on the parties.

A request for revocation/alteration of a disposition and a request to affirm the illegality of an omission must be filed within 90 days from the date the individual becomes aware of the disposition/omission and in principle no later than one year from the date the disposition is issued/omission occurred, unless there are justifiable reasons. According to the case law of the Supreme Court, the notion of ‘justifiable reasons’ is to be interpreted broadly and requires assessing whether it is socially acceptable to allow a delayed complaint, in light of all the circumstances of the case. For example, this includes (but is not limited to) reasons for delay for which the concerned party cannot be held responsible (i.e. situations that are outside the control of the complainant, for instance where (s)he has not been notified of the collection of his/her personal information) or force majeure (e.g. natural disaster, war).

Finally, individuals may also file a constitutional complaint with the Constitutional Court. On the basis of the Constitutional Court Act, any person whose fundamental rights guaranteed by the Constitution are infringed due to the exercise or non-exercise of governmental power (excluding judgments of the courts), may request adjudication of a constitutional complaint. If other remedies are available, these must be exhausted first. According to the case law of the Constitutional Court, foreign nationals may file a constitutional complaint to the extent their basic rights are recognised under the Korean Constitution (see the explanations in section 1.1). Constitutional complaints must be filed within 90 days after the individual has become aware of the infringement, and within one year after its occurrence. Given that the procedure of the Administrative Litigation Act is applied to litigation under the Constitutional Court Act, a complaint will still be admissible if there are ‘justifiable reasons’, as interpreted in accordance with the Supreme Court case law described above.

If other remedies need to be exhausted first, a constitutional complaint must be filed within 30 days after the final decision on such a remedy. The Constitutional Court may invalidate the exercise of governmental power that caused the infringement or confirm that a certain failure to act is unconstitutional. In that case, the relevant authority is required to take measures to comply with the decision of the Court.

3. GOVERNMENT ACCESS FOR NATIONAL SECURITY PURPOSES

3.1. Competent public authorities in the area of national security

The Republic of Korea has two dedicated intelligence agencies: the NIS and the Defense Security Support Command. Beyond that, the police and prosecution may also collect personal information for national security purposes.

The NIS is established by the National Intelligence Service Act (hereafter ‘ NIS Act ’) and operates directly under the jurisdiction and supervision of the President. In particular, the NIS collects, compiles and distributes information on foreign countries (and North Korea), intelligence related to the task of countering espionage (including military and industrial espionage), terrorism and the activities of international crime syndicates, intelligence on certain types of crime directed against public and national security (e.g. domestic insurrection, foreign aggression) and intelligence related to the task of ensuring cyber security and preventing or countering cyberattacks and threats. The NIS Act, which establishes the NIS and sets out its tasks, also provides general principles that frame all of its activities. As a general principle, the NIS must maintain political neutrality and protect the freedom and rights of individuals. The President of the NIS is charged with developing general guidelines that set out the principles, scope and procedures for the performance of the NIS’ duties in relation to the collection and use of information, and has to report them to the National Assembly. The National Assembly (through its Intelligence Committee) may require the guidelines to be corrected or supplemented if it considers that they are illegal or unjust. More generally, when carrying out their duties, the Director and NIS personnel may not force any institution, organisation or individual to do anything they are not obligated to do, nor obstruct any person’s exercise of rights, by abusing their official authority. In addition, any censorship of mail, interception of telecommunications, collection of location information, collection of communication confirmation data or the recording of or listening in on private communications by the NIS must comply with the CPPA, Location Information Act or CPA. Any abuse of power or the collection of information in violation of these laws is subject to criminal sanctions.

The Defense Security Support Command is a military intelligence agency, established under the Ministry of Defense. It is responsible for security matters within the military, military criminal investigations (subject to the Military Court Act) and military intelligence. In general, the Defense Security Support Command does not carry out surveillance of civilians, unless this is necessary to conduct its military functions. Persons that may be investigated are military personnel, civilian employees of the military, persons in military training, persons in military reserve or recruit service and prisoners of war. When collecting communication information for national security purposes, the Defense Security Support Command is subject to the limitations and safeguards laid down by the CPPA and its Enforcement Decree.

3.2. Legal bases and limitations

The CPPA, the Act on Anti-Terrorism for the Protection of Citizens and Public Security (hereafter ‘ Anti-Terrorism Act ’) and the TBA provide legal bases for the collection of personal information for national security purposes and set out the applicable limitations and safeguards. These limitations and safeguards, as described in the next sections, ensure that the collection and processing of information is limited to what is strictly necessary to achieve a legitimate objective. This excludes any mass and indiscriminate collection of personal information for national security purposes.

3.2.1. Collection of communication information

3.2.1.1. Collection of communication information by intelligence agencies

3.2.1.1.1. Legal basis

The CPPA empowers intelligence agencies to collect communication data and requires communication providers to cooperate with requests from those agencies. As described in section 2.2.2.1, the CPPA distinguishes between the collection of the content of communications (i.e. ‘ communication-restricting measures ’ such as ‘ wire-tapping ’ or ‘ censorship ’ measures), and the collection of ‘ communication confirmation data ’.

The threshold for collecting these two types of information differs, but the applicable procedures and safeguards are to a large extent identical. The collection of communication confirmation data (or meta-data) may take place for the purpose of preventing threats to national security. A higher threshold applies for the execution of communication-restricting measures (i.e. to collect the content of communications), which may only be taken when national security is expected to be put in grave danger and the collection of intelligence is necessary to prevent such danger (i.e. if there is a grave risk to national security and the collection is necessary to prevent it). Moreover, access to the content of communications may only be carried out as a measure of last resort to ensure national security, and efforts must be made to minimize the violation of the privacy of communications. Even when the appropriate approval/permission has been obtained, such measures must be stopped immediately once they are no longer necessary, thereby ensuring that any infringement of the individual’s communication secrets is limited to the minimum.

3.2.1.1.2. Limitations and safeguards applying to the collection of communication information involving at least one Korean national

The collection of communication information (both content and meta-data) where either one or both individuals involved in the communication are Korean nationals may only take place with the permission from a senior Chief Justice of the High Court. The request from the intelligence agency must be made in writing to a prosecutor or a High Prosecutors’ Office. It must indicate the reasons for the collection (i.e. that the national security is expected to be put in grave danger, or that the collection is necessary for preventing threats to national security), together with the materials supporting those reasons and establishing a prima facie case, as well as the details of the request (i.e. the objectives, targeted individual(s), scope, effective period of collection, as well as how and where the collection will take place). The prosecutor/High Prosecutors’ Office in turn requests permission from a senior Chief Justice of the High Court. The Chief Justice may only grant written permission when (s)he deems the application justified and will dismiss the request when (s)he considers it groundless. The warrant specifies the type, objective, target, scope and effective period of collection, as well as where and how it may take place.

Specific rules apply in the event that the measure aims at the investigation of an act of conspiracy that threatens national security and an emergency exists that makes it impossible to go through the aforementioned procedures. When these conditions are fulfilled, intelligence agencies may carry out surveillance measures without prior court approval. However, immediately after the execution of the emergency measures, the intelligence agency must request the permission of the court. If permission is not obtained within 36 hours from the time the measures are taken, they must be discontinued immediately. The collection of information in emergency situations must always take place in accordance with an ‘emergency censorship/wiretapping statement’ and the intelligence agency carrying out the collection must keep a register of any emergency measure.

In cases where the surveillance is completed within a short time, ruling out court permission, the head of the competent High Prosecutors’ Office must send an emergency measure notice prepared by the intelligence agency to the head of the competent court, which retains the emergency measure registry. This allows the court to examine the legality of the collection.

3.2.1.1.3. Limitations and safeguards applying to the collection of communication information involving only non-Korean nationals

To collect information on communications exclusively between non-Korean nationals, intelligence agencies must obtain prior written approval from the President. Such communications will only be collected for national security purposes if they fall within one of several listed categories, i.e. communications between government officials or other individuals of countries hostile to the Republic of Korea, foreign agencies, groups or nationals suspected of engaging in anti-Korean activities, or members of groups within the Korean Peninsula effectively beyond the sovereignty of the Republic of Korea and their umbrella groups based in foreign countries. Conversely, if one party to a communication is a Korean national and the other a non-Korean national, court approval will be required in accordance with the procedure described in section 3.2.1.1.2.

The head of an intelligence agency must submit a plan for the measures intended to be taken to the Director of the NIS. The Director of the NIS reviews whether the plan is appropriate and, if this is the case, submits it for approval to the President. The information that must be included in the plan is the same as the information required for an application for court permission to collect information of Korean nationals (as described above). In particular, it must indicate the reasons for the collection (i.e. that the national security is expected to be put in grave danger, or that the collection is necessary for preventing threats to national security), the main grounds for suspicion, together with the materials supporting those reasons and establishing a prima facie case, as well as the details of the request (i.e. the objectives, targeted individual(s), scope, effective period of collection, as well as how and where the collection will take place). Where several permits are requested at the same time, the purport and grounds thereof.

In emergency situations, prior approval from the Minister to whom the relevant intelligence agency belongs must be obtained. However, in this case the intelligence agency must request the approval of the President immediately after the emergency measures have been taken. If an intelligence agency fails to obtain approval within 36 hours from the time the application is made, the collection must be discontinued immediately. In such cases, the collected information will always be destroyed.

3.2.1.1.4. General limitations and safeguards

When requesting the cooperation of private entities, intelligence agencies have to provide them with the court warrant/presidential permission or a copy of the cover of an emergency censorship statement, which the compelled entity must keep in its files. Entities requested to disclose information to intelligence agencies on the basis of the CPPA may refuse to do so when the authorisation or emergency censorship statement refers to the wrong identifier (e.g. a telephone number belonging to a different individual than the one identified). Moreover, in all cases, passwords used for communications may not be disclosed.

Intelligence agencies may entrust the implementation of communication-restricting measures or the collection of communication confirmation information to a post office or a telecommunications service provider (as defined by the Telecommunications Business Act). Both the relevant intelligence agency and the provider receiving a request to cooperate must keep registries indicating the purpose of requesting the measures, the date of execution or cooperation, and the object of the measures (e.g. mail, telephone, email) for three years. Telecommunications service providers providing communication confirmation data have to keep information on the frequency of collection in their files for seven years and report twice per year to the Minister of Science and ICT.

Intelligence agencies have to report on the information they have gathered and the outcome of the surveillance activity to the Director of the NIS. With respect to the collection of communication confirmation data, records must be kept of the fact that a request for such data was made, as well as the written request itself and the institution that relied on it.

The collection of both the content of communications and communication confirmation data may only last for a maximum period of four months and, if the pursued objective is achieved in the meantime, must be discontinued immediately. If the conditions for permission persist, the period may be extended for up to four months, with the court’s permission or President’s approval. The application to obtain approval to extend the surveillance measures must be made in writing, stating the reasons why extension is sought and providing supporting materials.

Depending on the legal basis for collection, individuals are generally notified when their communications are collected. In particular, regardless of whether the information collected concerns the content of communications or communication confirmation data and regardless of whether the information was obtained through the ordinary procedure or in an emergency situation, the head of the intelligence agency must notify the individual concerned of the surveillance measure in writing within 30 days from the date on which the surveillance ended. The notification must include (1) the fact that the information has been collected, (2) the executing agency and (3) the execution period. However, if it is likely that the notice would put national security at risk or would harm people’s life and physical safety, the notice may be deferred. Notice must be given within 30 days once the grounds for deferral cease to exist.

This notification requirement however only applies to the collection of information where at least one of the parties is a Korean national. As a consequence, non-Korean nationals will only be notified when their communications with Korean nationals are collected. There is therefore no notification requirement when communications exclusively between non-Korean nationals are collected.

The content of any communications as well as communication confirmation data acquired through surveillance on the basis of the CPPA may only be used (1) for the investigation, prosecution or prevention of certain crimes, (2) for disciplinary proceedings, (3) for judicial proceedings where a party relating to the communication relies on them in a claim for damages or (4) on the basis of other laws.

3.2.1.2. Collection of communication information by the police/prosecutors for national security purposes

The police/prosecutor may collect communication information (both the content of communications and communication confirmation data) for national security purposes under the same conditions as described in section 3.2.1.1. When acting in emergency situations, the applicable procedure is the one that was described earlier with respect to the collection of the content of communications for law enforcement purposes in emergency situations (i.e. Article 8 CPPA).

3.2.2. Collection of information on terrorist suspects

3.2.2.1. Legal basis

The Anti-Terrorism Act empowers the Director of the NIS to collect information on terrorist suspects. ‘ Terrorist suspect ’ is defined as a member of a terrorist group, a person who has propagated a terrorist group (by promoting and disseminating ideas or tactics of a terrorist group), raised or contributed funds for terrorism, or engaged in other activities of preparing, conspiring, propagandizing, or instigating terrorism, or a person for whom there are good grounds to be suspected of having performed such activities. As a general rule, any public official enforcing the Anti-Terrorism Act must respect the basic rights enshrined in the Korean Constitution.

The Anti-Terrorism Act does not by itself set out specific powers, limitations and safeguards for the collection of information on terrorist suspects, but rather refers to the procedures in other statutes. First, on the basis of the Anti-Terrorism Act, the Director of the NIS may collect (1) information on the entry into and departure from the Republic of Korea, (2) information on financial transactions and (3) information on communications. Depending on the type of information sought, the relevant procedural requirements are provided in the Immigration Act and Customs Act, the ARUSFTI or the CPPA, respectively. For the collection of information on the entry into and departure from Korea, the Anti-Terrorism Act refers to the procedures set out in the Immigration Act and the Customs Act. However, these acts at present do not provide for such powers. For the collection of communication information and financial transaction information, the Anti-Terrorism Act refers to the limitations and safeguards in the CPPA (which are further detailed below) and the ARUSFTI (which, as explained in section 2.1, is not relevant for the purpose of the assessment for the adequacy decision).

In addition, Article 9(3) of the Anti-Terrorism Act specifies that the Director of the NIS may request personal information or location information of a terrorist suspect from a personal information controller or a location information provider. This possibility is limited to requests for voluntary disclosure, to which personal information controllers and location information providers are not required to respond, and in any event may only do so in accordance with PIPA and the Location Information Act (see section 3.2.2.2 below).

3.2.2.2. Limitations and safeguards applying to voluntary disclosure under PIPA and the Location Information Act

Requests for voluntary cooperation under the Anti-Terrorism Act must be limited to information on terrorist suspects (see above section 3.2.2.1). Any such request from the NIS must comply with the principles of lawfulness, necessity and proportionality following from the Korean Constitution (Articles 12(1) and 37(2)) as well as the PIPA requirements for the collection of personal information (Article 3(1) PIPA, see above section 1.2). The NIS Act furthermore specifies that the NIS may not force any institution, organisation or individual to do anything they are not obligated to do, nor obstruct any person’s exercise of rights, by abusing its official authority. A violation of this prohibition may be subject to criminal sanctions.

Personal information controllers and location information providers receiving requests from the NIS on the basis of the Anti-Terrorism Act are not required to comply. They may comply on a voluntary basis, but are only allowed to do so in accordance with PIPA and the Location Information Act.. As regards compliance with PIPA, the controller must in particular take into account the interests of the data subject and may not disclose the information if it would be likely to infringe unfairly on the interest of the individual or a third party. In addition, in accordance with Notification No. 2021-1 on Supplementary rules for the interpretation and application of the Personal Information Protection Act, the concerned individual must be notified of the disclosure. In exceptional situations, such notification may be delayed, in particular if and for as long as the notification would jeopardise an ongoing criminal investigation or is likely to harm the life or body of another person, where those rights or interests are manifestly superior to the rights of the data subject.

3.2.2.3. Limitations and safeguards under the CPPA

On the basis of the Anti-Terrorism Act, intelligence agencies may only collect communication information (both the content of communications and communication confirmation data) when necessary for counterterrorism activities, i.e. activities related to the prevention of and countermeasures against terrorism. The procedures of the CPPA described in section 3.2.1 apply to the collection of communication information for anti-terrorism purposes.

3.2.3. Voluntary disclosure by telecommunications business operators

On the basis of the TBA, telecommunications business operators may comply with a request to disclose ‘communications data’ from an intelligence agency that intends to collect the information to prevent a threat to national security. Any such request must comply with the principles of lawfulness, necessity and proportionality following from the Korean Constitution (Articles 12(1) and 37(2)) as well as the PIPA requirements for the collection of personal information (Article 3(1) PIPA, see above section 1.2). Moreover, the same limitations and safeguards as with respect to voluntary disclosures for law enforcement purposes apply (see section 2.2.3).

A telecommunication business operators is not required to comply, but may do so on a voluntary basis and only in accordance with PIPA. In this respect, the same obligations, including as regards notification of the individual, apply to telecommunication business operators as when they receive requests from criminal law enforcement authorities, as explained in more detail in section 2.2.3.

3.3. Oversight

Different bodies oversee the activities of Korean intelligence agencies. The oversight of the Defense Security Support Command is carried out by the Ministry of National Defense, pursuant to the Ministry’s Directive on Implementation of Internal Audit. The NIS is subject to oversight by the executive, the National Assembly and other independent bodies, as explained in more detail below.

3.3.1. The Human Rights Protection Officer

When intelligence agencies collect information on terrorist suspects, the Anti-Terrorism Act provides for oversight by the Counterterrorism Commission and the Human Rights Protection Officer (hereafter ‘HRPO’).

The Counterterrorism Commission inter alia develops policies concerning counterterrorism activities and oversees the implementation of counterterrorism measures as well as the activities of different competent authorities in the area of counterterrorism. The Commission is chaired by the Prime Minister and comprised of several ministers and heads of governmental agencies, including the Minister of Foreign Affairs, the Minister of Justice, the Minister of National Defense, the Minister of Interior and Safety, the Director of the NIS, the Commissioner General of the National Police Agency and the Chairman of the Financial Services Commission. When conducting counterterrorism investigations and tracing terrorist suspects to collect information or materials necessary for counterterrorism activities, the Director of the NIS must report to the Chairperson of the Counterterrorism Commission (i.e. the Prime Minister).

The Anti-Terrorism Act furthermore establishes the HRPO in order to protect the basic rights of individuals against infringements caused by counterterrorism activities. The HRPO is appointed by the Chairperson of the Counterterrorism Commission among individuals that meet the qualifications listed in the Enforcement Decree of the Anti-Terrorism Act (i.e. anyone qualified as an attorney-at-law with at least ten years working experience, or with expert knowledge in the field of human rights and serving or having served (at least) as an associate professor for at least ten years, or having served as a higher public official in State agencies or local governments, or with at least ten years working experience in the field of human rights, e.g. in a non-governmental organisation). The HRPO is appointed for two years (with the possibility for a renewed term) and may only be removed from office on specific, limited grounds and for good cause, e.g. when indicted in a criminal case related to his/her duties, when divulging confidential information, or because of long-term mental or physical incapacity.

In terms of powers, the HRPO may issue recommendations for improving the protection of human rights by agencies involved in counterterrorism activities, and process civil petitions (see section 3.4.3). Where the existence of an infringement of human rights in the performance of official duties can reasonably be established, the HRPO may recommend the head of the responsible agency to correct such violation. In turn, the responsible agency must notify the HRPO of the action undertaken to implement such recommendation. If an agency would fail to implement a recommendation of the HRPO, the matter would be elevated to the Commission, including its Chairperson, the Prime Minister. So far, there have been no cases where HRPO recommendations have not been implemented.

3.3.2. The National Assembly

As described in section 2.3.2, the National Assembly may investigate and inspect public authorities and in that context request the disclosure of documents and compel the appearance of witnesses. With respect to matters falling under the jurisdiction of the NIS, this parliamentary oversight is carried out by the Intelligence Committee of the National Assembly. The Director of the NIS, who oversees the performance of duties by the agency, reports to the Intelligence Committee (as well as the President). The Intelligence Committee itself may also request a report on a specific matter, to which the Director of the NIS is required to respond without delay. (S)he may only refuse to reply to or testify before the Intelligence Committee with respect to state secrets concerning military, diplomatic or North Korea-related issues where public knowledge may have a serious impact on the national destiny. In this case, the Intelligence Committee may request an explanation from the Prime Minister. If such an explanation is not submitted within seven days of making the request, the reply or testimony may no longer be refused.

If the National Assembly finds that there has been unlawful or improper activity, it may request that the relevant public authority takes corrective measures, including awarding compensation, taking disciplinary action, and improving its internal procedures. Following such a request, the authority must act without delay and report the outcome to the National Assembly. Specific rules regarding parliamentary oversight exist with respect to the use of communication-restricting measures (i.e. the collection of the content of communications) under the CCPA. As regards the latter, the National Assembly may ask the heads of intelligence agencies for a report on any specific communication-restricting measure. In addition, it may conduct on-the-spot inspections of wire-tapping equipment. Finally, intelligence agencies that have collected and operators that have disclosed content information for national security purposes have to report on such disclosure upon request from the National Assembly.

3.3.3. The Board of Audit and Inspection

The BAI carries out the same oversight functions with respect to intelligence agencies as in the area of criminal law enforcement (see section 2.3.2).

3.3.4. The Personal Information Protection Commission

As regards data processing for national security purposes, including the collection stage, additional oversight is carried out by the PIPC. As explained in more detail in section 1.2, this includes the general principles and obligations set out in Articles 3, 58(4) PIPA as well as the exercise of individual rights guaranteed by Article 4 PIPA. Moreover, according to Article 7-8(3), (4) and Article 7-9(5) PIPA, the oversight of the PIPC also covers possible infringements of the rules contained in specific laws setting out the limitations and safeguards with respect to the collection of personal information, such as the CPPA, the Anti-Terrorism Act and the TBA. Given the requirements in Article 3(1) PIPA for the lawful and fair collection of personal information, any infringement of those Acts constitutes a violation of PIPA. The PIPC thus has the power to investigate violations of the laws governing access to data for national security purposes as well as the processing rules in PIPA, and issue advice for improvement, impose corrective measures, recommend disciplinary action and refer potential offences to the relevant investigative authorities.

3.3.5. The National Human Rights Commission

Oversight by the NRHC applies in the same way to intelligence agencies as to other government authorities (see section 2.3.2).

3.4. Individual redress

3.4.1. Redress before the Human Rights Protection Officer

With respect to the collection of personal information in the context of counterterrorism activities, a specific redress avenue is provided by the HRPO, established under the Counterterrorism Commission. The HRPO handles civil petitions related to the infringement of human rights as a consequence of counterterrorism activities. (S)he may recommend corrective action and the relevant agency must report to the Officer any measures taken to implement such recommendation. There is no standing requirement for individuals to lodge a complaint with the HRPO. As a consequence, a complaint will be processed by the HRPO even if the concerned individual cannot demonstrate an injury in fact at the admissibility stage.

3.4.2. Redress mechanisms available under PIPA

Individuals may exercise their rights of access, correction, deletion and suspension under PIPA with respect to personal information processed for national security purposes. Requests to exercise these rights can be filed directly with the intelligence agency, or indirectly via the PIPC. The intelligence agency may delay, limit or deny the exercise of the right to the extent and for as long as necessary and proportionate to protect an important objective of public interest (e.g. to the extent that and for as long as granting the right would jeopardise an ongoing investigation or threaten national security), or where granting the right may cause damage to the life or body of a third party. Where the request is denied or restricted, the individual must be notified of the reasons without delay.

Moreover, in accordance with Article 58(4) PIPA (requirement to ensure the appropriate handling of individual grievances) and Article 4(5) PIPA (right to appropriate redress for any damage arising out of the processing of personal information, through a prompt and fair procedure), individuals have the right to obtain redress. This includes the right to report an alleged violation to the Privacy Call Centre operated by the Korea Internet and Security Agency and file a complaint with the PIPC. These redress avenues are available both in case of possible infringements of the rules contained in specific laws setting out the limitations and safeguards with respect to the collection of personal information for national security purposes and of PIPA. As explained in Notification No. 2021-1, an EU individual may submit a complaint to the PIPC through his/her national data protection authority. In this case, the PIPC will notify the individual via the national data protection authority once the investigation is concluded (including, where applicable, with information about the corrective measures imposed). Decisions or inaction by the PIPC can be further appealed before the Korean courts under the Administrative Litigation Act.

3.4.3. Redress before the National Human Rights Commission

The possibility to obtain individual redress before the NHRC applies in the same way to intelligence agencies as to other government authorities (see section 2.4.2).

3.4.4. Judicial redress

As is the case with respect to the activities of criminal law enforcement authorities, individuals may obtain judicial redress against intelligences agencies with respect to violations of the abovementioned limitations and safeguards through different avenues.

First, individuals may obtain compensation for damages under the State Compensation Act. For instance, in one case, compensation was granted with respect to unlawful surveillance by the Defense Support Command (the predecessor of the Defense Security Support Command).

Second, the Administrative Litigation Act allows individuals to challenge dispositions and omissions by administrative agencies, including intelligence agencies.

Finally, individuals may lodge a constitutional complaint with the Constitutional Court against measures taken by intelligence agencies on the basis of the Constitutional Court Act.