Violation of the Personal Information Protection Act | Non-Referral of a Suspected Violation of the Personal Information Protection Act Arising From the Installation of CCTV

This is the story of a client who requested a consultation with our firm's attorney specializing in criminal matters, stating that he was under suspicion of violating the Personal Information Protection Act.

The client was the representative of an agricultural corporation and the general manager in charge of farm operations, and he managed the control room that controlled the main facilities.

The control room was connected to automatic control systems for the farm's water supply, temperature, and humidity, and if the machine settings were incorrect, the entire farm could come to a halt or the harvest could be entirely suspended.

Accordingly, out of concern that employees might accidentally touch the control room computer, the client installed CCTV for security purposes.

The problem was that the CCTV in the control room also recorded employees arriving and leaving and the desks at which they worked.

One employee reported the client for violation of the Personal Information Protection Act, stating that the filming had taken place without prior consent, and the client became subject to an investigation by the investigative authorities.

Although the audio recording function of the CCTV was disabled, because video in which an employee's face could be identified had been recorded, whether the law had been violated became the issue.

The client requested a consultation with an attorney specializing in criminal matters to seek legal assistance, stating that he had merely installed CCTV for crime prevention in the space of the company of which he was the representative and had had no unlawful intent whatsoever.

A violation of the Personal Information Protection Act refers to an act that violates the law intended to protect information concerning an individual's personal details and to restrict the processing, use, and provision of such information.

Personal information includes not only a name or contact details, but also all forms of information by which a specific individual can be identified (video, audio, location information, and the like).

This law applies not only to public institutions but also where any business operator or organization handles personal information. In particular, when installing a video information processing device (CCTV), the purpose of filming, the location, the scope of filming, and the retention period must be made clear, and unnecessary collection of video is prohibited.

In other words, if a specific individual can be identified in CCTV footage, that footage constitutes personal information, and installing or using CCTV without authorization may give rise to a suspected violation of the Personal Information Protection Act.

If the charge is established, the offender is subject to imprisonment for not more than three years or a fine not exceeding 30 million won under the Personal Information Protection Act.

🔗Violation of the Personal Information Protection Act In order for the charge to be established, the following requirements must be satisfied.

① Where there was collection or use of personal information
② Where it was collected without the consent of the data subject or without a legal basis
③ Where there was ‘intent’ in the act

In other words, the mere fact that CCTV was installed does not establish the crime, and the key issue becomes whether there was an ‘intention or purpose to unlawfully collect personal information.’

In this case, the issues were the following two.

① Did the control room constitute an ‘open place’?
An operator of a video information processing device may not use the recording function of CCTV installed in an open place (a place to which an unspecified number of people can freely enter).

However, the client's control room was an internal work space with restricted access by outsiders, to which the general public could not gain access.

② Did recording take place?
The client's CCTV operated only with a video recording function, and the audio recording function was disabled.

Accordingly, it could not be considered that the ‘prohibition on the collection of audio information’ under the Personal Information Protection Act had been violated.

Through the assistance of the attorney specializing in criminal matters, the client received the following step-by-step response.

① Proving the Absence of Intent
The attorney specializing in criminal matters explained in detail that, at the time of installing the CCTV, the client had no awareness whatsoever of violating the Personal Information Protection Act and had operated the CCTV solely for security and operational efficiency.

② Refuting the Open-Place Requirement
As a matter of legal principle, an ‘open place’ for the operator of a video information processing device means a space to which the general public can freely gain access.

However, the attorney clearly argued that the control room was a work space accessible only to employees and therefore did not constitute an ‘open place.’

③ Submitting Evidence That the Recording Function Was Not Used
By submitting the technical specifications of the CCTV the client had installed and the actual recording files, the attorney proved that no audio recording had taken place.

④ Arguing for Recognition of a Justifiable Act
On the basis of the Supreme Court precedent, the attorney emphasized that installing CCTV to secure the control room constituted a justifiable act tolerated under generally accepted social norms, and that the illegality of the client's act was therefore precluded.

This case was a violation of the Personal Information Protection Act that arose from a lack of familiarity with the law.

The attorney specializing in criminal matters systematically proved the absence of intent, the non-public nature of the place, and the requirements of a justifiable act, thereby assisting the client in obtaining a decision of no suspicion.

The Personal Information Protection Act is a law that can readily apply even in everyday work environments such as workplaces, hospitals, and academies.

In particular, CCTV, customer information, and attendance management systems can lead to criminal punishment if mismanaged, so a clear understanding of the legal standards and a prior review are essential.

If you come to be investigated for a suspected violation of the Personal Information Protection Act in a similar situation, we strongly recommend that you obtain the assistance of an attorney specializing in criminal matters who can establish a response strategy based on legal grounds and precedents.

Our firm provides not only responses to criminal proceedings but also, in collaboration with corporate attorneys, advisory services to prevent corporate risks.