May Publicly Available Personal Information Be Reused Without Consent? The Unlawfulness of Commercial Re-provision and Refusal to Produce Documents on Grounds of Personal Information or Professional Secrets

Question

In an environment where information accumulates and is searched, civil disputes over personal information frequently arise in two settings. One is the setting where another business operator collects already-disclosed information and provides it again, and the other is the setting where documents held by the opposing party in a lawsuit contain personal information of officers and employees or business secrets, and the dispute concerns their production.

In the former setting, the questions are whether the consent of the data subject is required anew even for disclosed information, and whether the existence of a commercial purpose renders the conduct unlawful at once. In the latter setting, the questions are whether the Personal Information Protection Act can serve as grounds for barring the duty to produce documents under the Civil Procedure Act, and how far occupational secrets and self-use documents justify refusal to produce.

This white paper places the two settings side by side and compares what interests the courts placed on the scales in each setting and what circumstances they cited as factors for consideration. Supreme Court Decision 2014Da235080 adjudicated on the basis of the Personal Information Protection Act, which took effect on September 30, 2011, and the current provisions have been amended several times since; accordingly, the legal principle of the judgment must be read on the basis of the statutes in force at the time of the conduct.

This article does not determine the lawfulness of any particular information processing or whether any particular document is to be produced. It merely organizes the materials to check and the points at which interpretation diverges, within the scope stated in the provisions and in the Summary of Decision of the two determinations.

Material to check

First, the constitutional provisions. Judgment 2014Da235080 described the right to informational self-determination as a right guaranteed by two sources: the general right of personality derived from the first sentence of Article 10 of the Constitution, which provides for human dignity and worth and the right to pursue happiness, and the privacy and freedom of private life under Article 17 of the Constitution. On the other side of the scale is freedom of expression. On that point, Article 21(1) of the Constitution provides that all citizens enjoy freedom of speech and the press and freedom of assembly and association.

Second, the provisions of the Personal Information Protection Act on collection, use and provision. Current Article 15(1) permits personal information to be collected, and used within the scope of the purpose of collection, in the cases listed in its subparagraphs, including where the consent of the data subject has been obtained. Current Article 17(1) permits personal information to be provided to a third party in cases including where the consent of the data subject has been obtained. Current subparagraph 6 of Article 15(1) lists the case where processing is necessary to attain the legitimate interests of the personal information controller and those interests clearly override the rights of the data subject. Article 15(3) and Article 17(4) (inserted on 4 February 2020) permit use or provision without consent, as prescribed by Presidential Decree, within a scope reasonably related to the original purpose of collection. The summary of the judgment explained that the Act as originally enacted did not distinguish between public and non-public personal information or regulate them differently.

Third, the provisions on ex post control. The summary of the judgment relied on Article 20, which requires a controller that collects and processes publicly available personal information, among other information, to inform the data subject without delay, at the data subject's request, of the source of collection, the purpose of processing and the right under Article 37 to demand suspension of processing. On that basis, it held that the right to informational self-determination in respect of publicly available personal information is protected by ex post control. The title of current Article 20 has been changed to Notification of Source, etc. of Personal Information Collected from Persons Other than the Data Subject (title amended on 14 March 2023). Subparagraph 3 of Article 20(1) requires notification of the fact that the data subject has the right to demand suspension of processing or to withdraw consent. Current Article 37(1) provides that a data subject may demand suspension of the processing of his or her personal information or withdraw consent to the processing.

Fourth, the provisions on use and provision for purposes other than the original purpose. Current subparagraph 2 of Article 18(2) lists, as a ground for such use and provision, the case where another Act contains special provisions. It excludes, however, cases where there is a risk of unfairly infringing the interests of the data subject or a third party. Subparagraph 8 of the same paragraph lists the case where use or provision is necessary for a court to perform its adjudicative functions. Under the proviso to the same paragraph, however, subparagraphs 5 through 9 apply only to public institutions. Order 2014Ma2239 read subparagraph 2 of Article 18(2) together with Article 344(2) of the Civil Procedure Act.

Fifth, the provisions of the Civil Procedure Act on document production. Article 344(1) bars a holder from refusing to produce four kinds of document: documents cited by a party in the litigation; documents that the applicant has a private-law right to have delivered or to inspect; documents prepared for the benefit of the applicant; and documents prepared concerning the legal relationship between the applicant and the holder. The proviso to subparagraph 3, however, excludes documents that contain matters falling under any subparagraph of Article 315(1) and in respect of which the duty of confidentiality has not been waived, among others. Article 344(2) covers other documents, excluding those that a public official or former public official keeps or possesses in connection with his or her duties. It provides that the holder may not refuse to produce such documents unless they fall under items (b) and (c) of subparagraph 3 of paragraph (1) or are documents intended solely for the use of their holder. Subparagraph 2 of Article 315(1) lists matters belonging to technical or professional secrets as a ground for refusing to testify.

Sixth, the court's decision-making mechanisms and the record. Article 290 permits the court not to examine evidence it considers unnecessary. Article 347(1) permits the court to order production where it finds that an application for document production is justified. Paragraph (2) of the same Article requires the court to order production of only the relevant part where only part of the application is justified. Paragraph (4) permits the court to have the document presented to it, without disclosing it to others, in order to determine whether Article 344 applies. Article 349 permits the court, where a party fails to comply with the order, to treat the opposing party's allegations about the contents of the document as true. The record can show the circumstances and scope of the disclosure of the information, the form of re-provision, the purpose for which the document was prepared and how it was approved, the types of information it contains, and whether alternative evidence is available.

Possible readings

As to the processing of disclosed personal information, one reading holds that, because the statute does not distinguish by whether information has been disclosed, consent must be obtained anew for collection and third-party provision even for disclosed information. The consideration that the data subject can block re-provision beyond the scope and purpose of the original disclosure is placed in a direction supporting this reading.

Supreme Court Decision 2014Da235080 adopted a different reading. It regarded personal information already disclosed by the data subject as having been consented to processing within a certain scope at the time of disclosure, and held that, if the processing is objectively within the scope of that consent, no separate consent is required and there is no violation of Article 15 or Article 17. It held that the scope of consent is determined objectively by examining the nature of the disclosed personal information, the form of the disclosure and the scope of its targets, the intention or purpose of the data subject's disclosure, the form of the processing, whether the scope of the targets of disclosure has changed from the original, whether it bears substantial relevance to the original purpose of disclosure, and the like.

In the assessment of unlawfulness, the weight of the commercial purpose divides views. There may be a reading that collection and sale for commercial purposes infringe personality interests in themselves, but the judgment held that the mere existence of a commercial purpose cannot render the conduct unlawful at once. Whether the data subject is a public figure, the public character and public interest of the personal information, the original scope of the targets of disclosure, the appropriateness and necessity of the purpose, procedures, and form of use of the processing, and the nature and content of the interests that may be infringed are to be comprehensively examined, and the interest in the protection of personality rights is to be weighed against the right to know, freedom of expression, freedom of business, and the economic efficiency of society as a whole.

The relationship with the current law can be read in two branches. One branch holds that the judgment's legal principle on the scope of consent remains intact under the current law and that the newly introduced provisions on legitimate interests and the like supplement it. The other holds that, insofar as the current law has prescribed by provision the grounds for processing without consent, a case today must first be decided under the requirements of those provisions. Whichever is taken, the starting point must be that what the judgment addressed was the statute at the time of its enactment.

As to document production, views diverge on whether the Personal Information Protection Act can be regarded as an independent ground for refusal to produce. Supreme Court Decision 2014Ma2239 held that, since a personal information controller may use personal information beyond its purpose or provide it to a third party where there are special provisions in other statutes, and Article 344 (2) of the Civil Procedure Act imposes the duty to produce documents, even if the details of the salaries and bonuses of officers and employees, etc. fall under personal information, production cannot be refused on that ground. The same Decision, however, held that, in determining the necessity of production and a justifiable reason under Articles 290 and 347 (1), the court must weigh infringements of an individual's privacy, the free formation of opinions within a corporation, and trade secrets and the like; accordingly, it can be read that the protection of personal information is dealt with not as a ground for refusal but on the scales of the necessity assessment.

In occupational secrets and self-use documents as well, weighing comes before category. The same Decision held that occupational secrets refer to cases where, if the matter is disclosed, it would seriously affect the occupation and make the subsequent pursuit of the occupation difficult, but that refusal to produce is permitted only where the secret is one deserving protection; and it held that whether a document is a self-use document must be determined objectively by comprehensively considering not the title or designation of the document but its purpose of preparation, the information recorded, the general character of the document, the circumstances of possession, and the like. Reading the two determinations together, one may understand that, where the protection and use of information collide, the court chose concrete balancing of interests in place of categorical prohibition; yet the conclusion in an individual case is left to the reader to decide after matching the Records.

What the decisions held

Supreme Court Decision 2014Da235080 rendered on August 17, 2016 held that the personal information subject to the protection of the right to self-determination with respect to personal information "is not necessarily limited to information belonging to the intimate sphere of the individual, and includes information formed in public life or personal information already disclosed," yet where personal information already disclosed is collected and provided for commercial purposes, unlawfulness must be determined by weighing various circumstances, and "the mere fact that the information processor had a commercial purpose cannot render the information processing act unlawful." It further stated that "where personal information already disclosed is processed, such as by collection, use, or provision, within a scope in which the consent of the data subject can objectively be recognized, no separate consent of the data subject is necessary, and the failure to obtain separate consent cannot be regarded as a violation of Article 15 or 17 of the Personal Information Protection Act." In a case where a company operating a legal information provision website collected the photograph, name, educational background, career, etc. of a professor of the law department of a public university from the department's website and provided them for a fee, the Court reversed and remanded the portion of the judgment of the court below finding against the company, and dismissed all of the plaintiff's final appeals.

Supreme Court Decision 2014Ma2239 dated July 1, 2016 held that "even if the details of the salaries and bonuses of officers and employees, etc. fall under personal information under the Personal Information Protection Act, the person possessing the document cannot refuse production of the document on that ground." As to occupational secrets, it stated that "even where certain information falls under occupational secrets, the person possessing the document may refuse production of the document only where the secret is one deserving protection"; and as to self-use documents, it stated that even for a document prepared within a company through approval procedures, in certain cases "one should not readily conclude that it is a self-use document merely on the ground that it is an internal document." The Court reversed and remanded the portion of the order of the court below finding against the applicant as to certain documents, and dismissed the remainder of the reappeal.

Practical checklist

This item is not advice but a bundle of questions that may be asked when cross-checking the Records. First, one may ask about the circumstances of disclosure. Whether the data subject disclosed the information directly or through a third party, through which medium and with what purpose and scope of targets it was disclosed, and whether the data subject held a position that may be regarded as a public figure can be confirmed from the materials.

Second, one may ask about the form of re-provision. One can organize the items of the information collected, whether a fee is charged, whether the scope of the targets of disclosure has become broader than the original through search and combination, whether the purpose of provision bears substantial relevance to the original purpose of disclosure, and whether there is a record of notifying the source of collection and the purpose of processing upon the request of the data subject. One can also check together whether the provisions of the Personal Information Protection Act that apply differ according to the time of the conduct.

Third, one may ask about the nature of the document. One can divide item by item the purpose of preparation of the document whose production is sought, the circumstances of its approval, whether it is scheduled to be disclosed externally, whether it contains the same information as documents in respect of which the applicant holds a right in law to demand inspection or the like, and whether the information contained is personal information or occupational secrets.

Fourth, one may ask about necessity and alternative means. One can confirm whether the matter sought to be proved by the document is directly related to the claim, whether the same materials can be obtained from other documents, and whether the burden can be reduced by partial production or by presentation to the court. This is no more than a list of materials to check, and the reader draws the conclusion.

Glossary

The right to self-determination with respect to personal information is, in the expression of Supreme Court Decision 2014Da235080, the right of the data subject to determine for himself or herself when, to whom, and to what extent information about himself or herself is to be made known and used. The judgment derived this from Articles 10 and 17 of the Constitution.

Personal information is defined in current Article 2, subparagraph 1 of the Personal Information Protection Act as information relating to a living individual, such as information by which the individual can be identified, including name, resident registration number, and image. Supreme Court Decision 2014Da235080 held that information formed in public life or already disclosed is also included in the objects of protection of the right to self-determination with respect to personal information.

Self-use document is the expression used in Supreme Court Decision 2014Ma2239, referring to a document to be used exclusively by the person possessing the document under Article 344 (2), subparagraph 2 of the Civil Procedure Act. The Decision held that whether it applies must be determined objectively by comprehensively considering various circumstances rather than the title or designation.

Occupational secrets refers, in the explanation of Supreme Court Decision 2014Ma2239, to cases where, if the matter is disclosed, it would seriously affect the occupation and make the subsequent pursuit of the occupation difficult. The Decision held that refusal to produce documents is permitted only where the secret is one deserving protection.

Sources and limitations

The sources of the provisions are the current texts of the National Law Information Center (Articles 10, 17, and 21 of the Constitution of the Republic of Korea, Articles 2, 15, 17, 18, 20, and 37 of the Personal Information Protection Act, Articles 750 and 751 of the Civil Act, and Articles 290, 315, 344, 347, and 349 of the Civil Procedure Act), and the date of comparison is October 16, 2026. The current Personal Information Protection Act was partially amended on March 10, 2026 and entered into force on September 11, 2026; Articles 15, 17, and 18 bear amendment or enactment notes of February 4, 2020 and March 14, 2023, and Articles 20 and 37 bear amendment notes of March 14, 2023. The provisions in force at the time of the conduct addressed by the two determinations may differ from these, and therefore they must be checked again on the basis of the statutes in force at the time of the conduct.

The judgments were compared with the Holdings, Summary of Decision, and disposition in the original texts of the National Law Information Center. The full text of the reasons for judgment was not compared; accordingly, facts such as the specific list of documents ordered to be produced, the contents of the claim in the lawsuit, and the amount of consolation money are not stated in this article.

The relevant provisions of the Enforcement Decree of the Personal Information Protection Act, special Acts in the field of credit information or information and communications networks, and the Act on the Protection of Trade Secrets were not compared in this article. The provisions of the Educational Public Officials Act and the Higher Education Act contained in the Reference Provisions of Supreme Court Decision 2014Da235080 are also outside the scope of comparison.

Points left open

What relationship the legal principle on the scope of consent in Supreme Court Decision 2014Da235080 bears to the current law's provision on legitimate interests (Article 15 (1), subparagraph 6) or the provisions on use and provision within a scope reasonably related to the original purpose of collection (Article 15 (3), Article 17 (4)) is a question this judgment could not address. This relationship may be particularly at issue in processing that collects large volumes of disclosed information for search or analysis.

The same judgment listed whether the data subject is a public figure as a factor for consideration. How the balancing changes for information of persons with a low degree of public status or for old information whose circumstances have changed since the disclosure leaves room for further organization case by case.

Supreme Court Decision 2014Ma2239, while not accepting refusal to produce on grounds of personal information, left infringements of privacy as a factor of weighing in the necessity assessment. How the personal information of third parties contained in documents produced is to be protected within the lawsuit, and what procedural means may be used, are matters not addressed in the Summary of Decision.

The relationship between occupational secrets and trade secrets also remains a question. While the Decision limited occupational secrets to secrets deserving protection and directed that they be determined by comparative weighing, which direction the weighing leans for secrets such as technical information whose disclosure makes restoration difficult requires gathering further judgments in the relevant field.

When to reconsider

This white paper will be rewritten if the provisions of the Personal Information Protection Act on collection, use, and provision and the provisions on the rights of data subjects, or the provisions of the Civil Procedure Act on production of documents, are amended, or if a new determination of the Supreme Court is handed down concerning the processing of disclosed personal information or grounds for refusal to produce documents.

At that time, the criteria for determining the scope of consent, the factors in the weighing of unlawfulness, and the limits of the grounds for refusal to produce documents will be reorganized within the scope stated in the Holdings and Summary of Decision of the new judgment.

Statutes referred to

• 대한민국헌법 제10조, 제17조, 제21조
• 개인정보 보호법 제2조, 제15조, 제17조, 제18조, 제20조, 제37조
• 민법 제750조, 제751조
• 민사소송법 제290조, 제315조, 제344조, 제347조, 제349조

Decisions referred to

• 대법원 2016. 8. 17. 선고 2014다235080 판결 · Decision ledger
• 대법원 2016. 7. 1. 자 2014마2239 결정 · Decision ledger

Verification status

The cited provisions (Articles 10, 17 and 21 of the Constitution of the Republic of Korea; Articles 2, 15, 17, 18, 20 and 37 of the Personal Information Protection Act; Articles 750 and 751 of the Civil Act; and Articles 290, 315, 344, 347 and 349 of the Civil Procedure Act) were checked against the current official texts on the National Law Information Center on 16 October 2026. The cited decisions (Supreme Court Judgment 2014Da235080 delivered on 17 August 2016 and Supreme Court Order 2014Ma2239 dated 1 July 2016) were checked against the holdings, the summaries of the decision and the operative parts in the original texts on the National Law Information Center. The full reasons of the decisions and the provisions of the Personal Information Protection Act in force at the time of the conduct were not checked.