Court: "Foreign law 'confidentiality obligation' clause must comply with our laws to be recognized"
After nine years, a final ruling has been made ordering Google and Google Korea to disclose the details of Korean user information handed over to U.S. intelligence agencies.
The Supreme Court's 3rd Division (Presiding Justice No Jeong-hee) on the 13th upheld the lower court's ruling in favor of six domestic human rights activists, including Mr. Oh, who filed a lawsuit against Google and Google Korea demanding the disclosure of "records of personal information provided to third parties." However, the court remanded part of the case where some plaintiffs lost in the lower court due to insufficient examination back to the appellate court.
This lawsuit began in 2014 when Mr. Oh and others demanded Google disclose information about data disclosure. They claimed that "Google provided user information to the U.S. National Security Agency (NSA) under the PRISM program, and as a result, their personal information and Gmail usage details may have been transferred." ‘PRISM’ is an NSA surveillance program that collects internet information such as emails from fiber optic cables passing through the United States.
However, Google refused Mr. Oh's demands, stating, "We only provide user information to government agencies in accordance with the law, and we do not disclose whether a specific user was subject to an information provision request." Consequently, Mr. Oh and others filed a lawsuit demanding the disclosure of this information.
The trial focused on issues such as whether Google, headquartered in the U.S., must comply with domestic laws regarding personal information protection, whether de-identified information qualifies as personal information subject to disclosure, and whether lawsuits against Google's headquarters violate international jurisdiction agreements granting exclusive jurisdiction to U.S. courts.
The lower courts ruled that even if users agreed through terms and conditions to resolve legal disputes under foreign laws, domestic laws could still apply, and thus Korean courts have jurisdiction. They also ruled that de-identified information, when combined with other data that can identify individuals, qualifies as personal information and must be disclosed. However, Google may refuse to provide or allow access to information if U.S. laws impose confidentiality obligations.
Regarding the disclosure of information provision records related to Google Korea, the lower courts had conflicting rulings. The first trial court rejected the claim to disclose information provision records for Google Korea. In contrast, the appellate court ruled that since Google Korea obtained a license for location information business in Korea, it must comply with requests for access and provision of information limited to location information services and location-based services.
However, the Supreme Court overturned the lower court's ruling that allowed refusal of access or provision of information when foreign laws impose confidentiality obligations, citing insufficient examination. The court upheld the lower court's decisions on all other issues.
The court stated that the mere existence of foreign laws imposing confidentiality obligations does not automatically constitute a legitimate reason to refuse disclosure. It is necessary to examine whether the content and intent of such foreign laws align with the Korean Constitution and laws.
The court ruled, "It is necessary to comprehensively consider whether the necessity to respect the foreign law significantly outweighs the need to protect personal information, whether the confidentiality requirements stipulated by the foreign law are met regarding the information the user requests to access or provide, and whether information and communication service providers are effectively obligated to maintain confidentiality."
Furthermore, the court added, "Even if information was provided to foreign investigative agencies for reasons such as national security or criminal investigations, unless such reasons have ended and no longer hinder the purpose of information collection, users must be allowed to access and be informed of the fact that their information was provided."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
