Key points. On 26 June 2025 the Supreme Court of Korea held that watching CCTV footage and reporting what it showed, without giving the footage to anyone, is "use" of personal information under art. 18(1) of the Personal Information Protection Act ("PIPA") (Decision 2023Do18539). The decision reversed and remanded an acquittal and did not convict anyone. Two questions were left to the remand court: whether the use went beyond the purpose for which the footage was collected, and whether the person who viewed it was a personal information controller. The case after remand (Seoul Eastern District Court 2025No1005) was still pending as of 13 October 2026.
Take a hypothetical. A manager at a Korean entity goes through two weeks of office security footage, tells HR orally when an employee was away from the desk, and adds that the video file was never given to anyone. The Supreme Court considered an argument of the same structure in 2023Do18539, and this note covers that decision only.
What happened in the case?
The defendant was the director of a public daycare centre established by a district office, whose operation had been entrusted to a corporation. Around July 2021 the director viewed the centre's CCTV footage to find out whether a childcare teacher was using a mobile phone during working hours. The cameras had been installed for the safety of infants and young children, including the prevention of child abuse, and for the security of the centre.
The director identified three instances of phone use and reported them to the person in charge of the childcare business at the corporation as a failure to follow work instructions. The corporation then moved to include the report among the grounds for discipline and to open a disciplinary review.
The prosecutor charged the director with using personal information beyond the purpose of collection (former PIPA arts. 18(1) and 71(ii)) and charged the corporation under the joint penalty provision, art. 74(2). The text of PIPA before the amendment of 14 March 2023 applied, but the structure of art. 18(1), which prohibits use beyond the scope set by art. 15(1), is the same in the current Act.
Both lower courts acquitted (on appeal, Seoul Eastern District Court, 30 November 2023, 2023No612). The appellate court reasoned that the director had only described the teacher's working attitude orally. In its view that description was different from the footage the director had obtained as a controller and did not by itself identify any individual, so there had been no use beyond the purpose.
What did the Supreme Court decide?
The Court began with the meaning of "use" in art. 18(1). What follows is our paraphrase and an unofficial translation.
According to the Court, use is an act by which a personal information controller itself uses personal information, without passing control and management of that information to another person. Use is not limited to using the information in the form in which it was collected. It also covers using the information after processing or editing it, and using information extracted from it. The Court added that whether conduct amounts to use has to be judged by looking at the series of acts as a whole (「일련의 행위를 전체적으로 보아」).
The footage showed the teacher's face and body, so the teacher could be identified from it, and the footage was personal information. The director watched it, selected and analysed the scenes of phone use, recorded them, and reported content based on that record to the corporation as a matter for discipline. The Court treated the whole sequence, from viewing to reporting, as use of the CCTV footage as material for a disciplinary review. The fact that the corporation received information taken from the footage, and not the footage, was not a reason to decide otherwise. The Court found that the appellate court had misunderstood the law by separating the final act of reporting from what came before it.
What did the Court leave open?
The Court did not find anyone guilty. It reversed the appellate judgment unanimously and remanded the case to the Seoul Eastern District Court. Its ruling goes only as far as the point that the director's conduct was "use". As of 13 October 2026 the case after remand, Seoul Eastern District Court 2025No1005, was pending and no judgment had been given. The Court noted two issues for the remand court.
- Whether the use went beyond the purpose of collection. The Court left this to be decided in light of the purpose and content of the CCTV provisions in the Infant Care Act (영유아보육법) and of the purpose and circumstances of the director's use.
- Whether the director was a personal information controller. The Court wrote that if the corporation is the controller and the director is a person who handles personal information under the corporation's direction and supervision, the director cannot be punished directly under arts. 71(ii) and 18(1). In that case the director could only come within the joint penalty provision of art. 74(2).
It is therefore difficult to read the decision as saying that using CCTV footage in a disciplinary matter is punishable. What it appears to settle is that "we only reported it orally" does not, on its own, take the conduct outside "use".
| Explanation a company might give | Position after 2023Do18539 |
|---|---|
| The video file was not copied or handed over | Closed. Use does not require passing on control |
| The content was only reported orally | Closed. Using extracted information is use of the footage |
| What was reported did not identify anyone by itself | Not accepted. The acts are viewed as a whole |
| The use was within the installation purpose | Open. Left to the remand court |
| The viewer was not the controller | Open. Left to the remand court |
What should a company check, and in what order?
The daycare case also involved the CCTV rules of the Infant Care Act, so its outcome cannot be carried over to a company's CCTV as it stands. Four checks follow from the decision and the current text of PIPA.
- Find the installation purpose in writing. Under art. 15(1) a controller may use personal information within the purpose of collection. For a fixed visual data processing device (CCTV) in a place open to the public, the purpose appears on the signboard (art. 25(4)) and in the operating policy (art. 25(7)). Where art. 25 does not apply to the location, the company first has to find which document records the purpose.
- If the use is outside that purpose, name the subparagraph of art. 18(2). Subparagraphs (v) to (ix) apply only to public institutions. For a private company the subparagraphs to consider are essentially separate consent of the data subject (subparagraph (i)), a special provision in another statute (subparagraph (ii)) and an urgent need to protect an interest in life, body or property (subparagraph (iii)). Whichever subparagraph applies, the use is not permitted where it is likely to unfairly infringe the interests of the data subject or a third party.
- Consider art. 15(3). This provision allows use without consent, as prescribed by Presidential Decree, within a scope reasonably related to the original purpose of collection. The factors include whether the data subject suffers a disadvantage and whether security measures have been taken. Whether viewing footage for attendance or discipline fits here can differ from case to case.
- Record who the controller is. As the second remand issue shows, individual criminal liability can differ depending on whether the controller is the company or the manager. Use in breach of art. 18(1) or (2) carries imprisonment of up to five years or a fine of up to KRW 50 million (art. 71(ii)). Art. 74(2) also fines the corporation, except where it did not neglect due care and supervision. The same breach is a ground for a penalty surcharge (art. 64-2(1)(i)).
On subparagraph (ii), the Korean article linked below discusses two administrative cases involving public institutions, in which the result appears to have turned on how specifically the statute relied on permitted the act. A private company would need to check whether a statute that applies to it contains such a provision before relying on that subparagraph.
What this note does not cover
Whether the disciplinary measure is valid, whether the footage can be used as evidence, and review under Korean labour legislation are outside the scope of this note.
Frequently asked questions
Q. Is it 'use' of personal information under Korean law if nobody copies the CCTV file and the content is only reported orally?
Q. Does the decision mean that using CCTV footage to discipline an employee is a criminal offence in Korea?
Q. What should a company check first before using security CCTV footage in an attendance or disciplinary matter?
Sources
- Supreme Court of Korea, Decision 2023Do18539, 26 June 2025 (violation of the Personal Information Protection Act), as published in the National Law Information Center case database (case serial No. 607211). The decision reversed and remanded. As of 13 October 2026 the case after remand, Seoul Eastern District Court 2025No1005, was shown in the court case search as pending, with no final result.
- Seoul Eastern District Court, Decision 2023No612, 30 November 2023 (the appellate judgment reversed by the Supreme Court).
- Personal Information Protection Act, arts. 15(1) and (3), 18(1) and (2), 25(4) and (7), 64-2(1)(i), 71(ii) and 74(2), as in force on 11 September 2026: Korean text. The Supreme Court case was decided under the text in force before the amendment of 14 March 2023 (Act No. 19234).
- Korean article on this decision (Korean): the fuller version of this note, including the two administrative cases (Seoul High Court 2018Nu37672; Busan District Court 2025Guhap20046).
This note is a general summary of a published court decision and the current statutory text for readers outside Korea, and is not legal advice. The outcome in a particular matter depends on the installation purpose of the CCTV, how the footage came to be used and the legislation that applies to the company, and requires individual review. All English renderings of Korean judgments and statutes on this page are unofficial; the Korean text governs.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, with an ENG switch at the top right). Questions about this page can be sent through the contact page.