The Personal Information Protection Act protects personal information and also sets certain limits on collecting and processing it for intelligence agencies that collect personal information and for companies or individuals that collect customer information.

In particular, Article 58 (partial exclusion from application) in Chapter 8 (supplementary provisions) is an important legal basis under which personal information collected or requested for analysis related to national security is excluded from the act. Under Article 58(1), 'personal information collected or requested to be provided for the purpose of analyzing information related to national security' is excluded from the act and can be lawfully collected and analyzed.

To protect personal information from illegal collection, misuse and leaks, the act sets out prohibited acts. They also apply to people who process or have processed personal information while working at state agencies, intelligence agencies or investigative agencies, who are subject to criminal punishment.

People who process or have processed personal information are prohibited from the following acts (Article 59 of the act).

1) Obtaining personal information or consent to its processing by deception or other unfair means or methods.

2) Disclosing personal information learned in the course of duty or providing it for use by others without authority.

3) Using, damaging, destroying, altering, forging or leaking another person's personal information without lawful authority or beyond the authority granted.

The Personal Information Protection Act falls under the Personal Information Protection Commission and is administered by its policy division. The following provisions are the most important ones relating to the collection of open-source information.

Article 1 (Purpose): This act aims to protect the freedom and rights of individuals and further to realize the dignity and value of individuals by setting out matters concerning the processing and protection of personal information.

Article 2 (Definitions): The terms used in this act are defined as follows.

1. 'Personal information' means information relating to a living individual that falls under any of the following items.

(b) Information that, even if it cannot by itself identify a particular individual, can easily be combined with other information to identify one. In this case, whether it can easily be combined must be judged by reasonably considering the time, cost and technology needed to identify the individual, such as the availability of the other information.

(c) Information produced by pseudonymizing information under item (a) or (b) under subparagraph 1-2 so that a particular individual cannot be identified without using or combining additional information to restore it to its original state (hereinafter 'pseudonymized information').

1-2. 'Pseudonymization' means processing personal information, by deleting part of it or replacing part or all of it, so that a particular individual cannot be identified without additional information.

2. 'Processing' means collecting, generating, linking, interlocking, recording, storing, retaining, processing, editing, searching, outputting, correcting, restoring, using, providing, disclosing or destroying personal information, and other similar acts.

3. 'Data subject' means a person who can be identified by the information processed and who is the subject of that information.

4. 'Personal information file' means a set of personal information arranged or organized systematically according to certain rules so that it can easily be searched.

5. 'Personal information controller' means a public institution, corporation, organization or individual that processes personal information, directly or through others, to operate a personal information file for business purposes.

6. 'Public institution' means the following.

(a) Bodies handling the administrative affairs of the National Assembly, the courts, the Constitutional Court and the National Election Commission, central administrative agencies (including agencies under the President and the Prime Minister) and their affiliated agencies, and local governments.

7. 'Fixed visual data processing device' means a device, prescribed by presidential decree, that is installed in a certain space and continuously or periodically films people or objects or transmits such images over wired or wireless networks.

7-2. 'Mobile visual data processing device' means a device, prescribed by presidential decree, that is worn or carried by a person or attached to or mounted on a movable object and films people or objects or transmits such images over wired or wireless networks.

8. 'Scientific research' means research applying scientific methods, such as technology development and demonstration, basic research, applied research and privately funded research.

To add: the concept of pseudonymized information was introduced by the so-called three data laws amendment that took effect in August 2020, when the Personal Information Protection Commission was also upgraded to a central administrative agency. A March 2023 amendment (mostly in force from September that year) folded the special rules for information and communications service providers into the general provisions and created the right to request transmission of personal information, the right to refuse or seek an explanation of automated decisions, and rules on mobile visual data devices. The agency contact details, web screens and search engine removal procedures in the paper are as of the time of writing, so current guidance should be checked before use. A personal information dispute mediation, once accepted, has the same effect as a judicial settlement.