On 17 August 2016, the Supreme Court handed down its first judgment on whether, without requisite consent, the collection and disclosure of personal information which has already been publicised was illegal. For the reasons below, it held that notwithstanding such consent had not been provided, the collection and disclosure of personal information was not illegal.

1. Facts
A law professor working at a national university brought an action seeking the payment of compensation from internet websites that provide biographical information, such as LAWnB, Naver, Digital Chosun Daily Ilbo, arguing that such websites had collected and disclosed his personal information, including name, birth year, education and work experience, without his consent, which he claimed was illegal.
The appellate court, the Seoul High Court, became the centre of attention as its decision would have far reaching ramifications for internet, media and publishing companies in Korea.

2. Seoul High Court
The Seoul High Court held that, even if the owner of the relevant information is a public figure, it is against the relevant laws, including the Personal Information Protection Act (the “Act”), to collect and disclose personal information for profit-making purpose without the consent of the information owner. The key to this judgment was that requisite consent had not been obtained and a company had made profit from the use of the personal information. LAWnB was ordered to pay damages, but dismissed the claims with respect to the other defendants on the grounds that the relevant period of statute of limitations had expired.

3. Supreme Court of Korea
On its face, none of the exceptions applied to the facts. Many commentators expected that it would be difficult to persuade the Supreme Court to overturn the Seoul High Court’s decision as the Act provides very limited exceptions to the basic principle that the consent of the information owner is required to, among other things, the collection and disclosure of personal information. 

The Supreme Court overturned the Seoul High Court’s decision. It held that:
• One should objectively interpret the intention of the information owner to disclose personal information and consider whether implicit consent of such information owner has been given having regard to such intention.
• Whether consent can objectively be deemed to have been given will depend on the nature, the manner the personal information was disclosed and the extent to which personal information has been disclosed, and the intention of the information owner to disclose it.
• Whether the purpose of the disclosure was to make profit or not is not important.
• There should be a balance between the legal interest of the information owner and that of the information handler, having regard to matters such as whether the information owner is a public entity, whether the disclosed personal information is in the public interest and the scope of subjects to which such personal information was allowed to be disclosed from the outset.

4. Key takeaways
• Consent from the information owner to the collection and disclosure of personal information is required.
• Under the Act consent should be expressly obtained prior to the collection and disclosure of personal information.
• However, where such prior consent has not been obtained, and where certain personal information has already been publicised, consent may have been deemed to have been provided depending on the circumstances.