Photo by Sasun Bughdaryan on Unsplash
On 24 July 2014, APC member Korean Progressive Network Jinbonet initiated a lawsuit against Google following revelations about mass surveillance by the United States National Security Agency (NSA) alongside partners from the Citizens' Coalition for Economic Justice, Amnesty International Korea and the Citizens' Action Network. The lawsuit called for transparency regarding the potential sharing of users’ personal data with intelligence agencies, with Jinbonet and partners demanding access to records that would confirm whether their data had been disclosed without consent.
Although the case was complicated by US confidentiality laws, which prevented full disclosure regarding possible intelligence agency access, the Supreme Court of Korea made a landmark ruling on 2 June 2025 that Google could not deny user access to third-party disclosure records purely on the basis of foreign confidentiality laws.
This decision marked a significant victory for digital rights advocates and set a legal precedent in which Google committed to a series of changes that will bolster user rights in South Korea. Under the terms of the agreement, Google must now provide Korean users with greater transparency about the handling of their data, including individualised responses to requests regarding third-party data disclosures and the creation of clearer, Korean-language privacy tools. These changes will significantly enhance users’ ability to access, understand and challenge the ways their personal data is used or shared. According to Byoung-il Oh, president of Jinbonet:
Many companies, including Google, allow users to access certain categories of their personal information online. However, this does not extend to providing access to all personal information held by the company. In particular, service usage records are an example of personal information that is generally not fully accessible online. For this reason, even where companies provide some degree of online access to personal information, it remains essential that users retain the ability to request access to the personal information they specifically seek.
This case holds wide relevance for digital rights defenders and civil society groups globally as it highlights the power of sustained, collective legal action to challenge tech giants and enforce users’ rights under national legal frameworks. It also reveals the tensions between domestic privacy protections and international legal constraints, particularly those rooted in US law.
Jinbonet’s role was central in sustaining this long legal struggle and pushing for reforms that address the growing influence of big tech on privacy and data governance. To recognise over a decade of the pursuit of justice, we connected with Byoung-il Oh of Jinbonet to discuss the impact of this case and its relevance to digital rights defenders who may be facing similar legal challenges.
This interview has been edited for length and clarity.
Google has been asked to provide the plaintiffs with access to records indicating whether their personal data and service usage history were disclosed to third parties. What has it shared so far?
Google agreed, as part of the settlement, to provide the plaintiffs’ personal information and records of disclosure to third parties within a specified period, and has now fulfilled that undertaking. Most of the personal information was made accessible by directing the plaintiffs to Google’s Privacy Policy and to the relevant menus within their individual accounts, while certain categories of personal data were provided through downloadable links.
Furthermore, Google stated that it had not received any notice from US government authorities or other agencies indicating that the confidentiality obligations under US law concerning the plaintiffs’ personal information had been lifted. This means that, irrespective of whether the plaintiffs’ personal information was shared with US intelligence agencies, no notification of any release from confidentiality obligations had been received.
What would you highlight as major changes brought about by this recent decision?
The Supreme Court rendered its decision in this case on 13 April 2023. Unlike the lower courts, the Supreme Court held that even if foreign laws impose a confidentiality obligation concerning the disclosure of personal information, such laws do not constitute an unconditional ground for refusing to comply with obligations under Korean law. Rather, the Court emphasised that it must be comprehensively considered whether the foreign law is compatible with the Constitution and statutes of the Republic of Korea, whether the need to respect such foreign law significantly outweighs the need to protect personal information, and whether the foreign law in fact imposes a substantive obligation of non-disclosure.
Furthermore, the Court made it clear that even where a confidentiality obligation under foreign law is recognised, a service provider must nonetheless notify the domestic user of the specific grounds for limitation or refusal by reference to the particular item requested. In addition, once the grounds for non-disclosure have ceased to exist, the provider must comply with the user’s request for disclosure of records concerning the provision of personal information. This holding carries significant meaning: whereas foreign enterprises had previously refused to comply with protective measures or users’ rights under Korean law by invoking foreign legislation, the Supreme Court clarified that Korean courts may substantively review obligations purportedly arising under foreign laws in order to safeguard the rights of users who receive services in Korea. The decision therefore represents an important precedent not only for the present case, but also for the broader protection of Korean users against transnational corporations.
As a result, although it could not be confirmed whether the plaintiffs’ personal information had in fact been disclosed to US intelligence agencies (a negative aspect), the settlement with Google nevertheless served as a meaningful step toward enhancing the overall level of personal information protection for Korean users (a positive aspect).
Are there other concrete examples of the impacts of existing policy gaps regarding the obligations of big tech companies, and do you have plans to tackle these?
Beyond this litigation, we plan to continue addressing a wide range of issues caused by big tech companies. For example, earlier this year we filed a petition with the Personal Information Protection Commission against Meta and X for using users’ personal information for artificial intelligent (AI) training purposes without consent.
In addition, YouTube (operated by Google) blocked the channels of domestic civil society organisations and individuals without legitimate grounds. These channels included videos of citizens’ rallies protesting the imposition of martial law by a former president and calling for impeachment, raising suspicions that such videos formed the basis of the takedown. Even when appeals were filed, the channels were not restored.
Ultimately, it was only through indirect intervention via Google’s Global Human Rights Policy team that the channels were reinstated. We therefore intend to raise further concerns regarding YouTube’s unjustified restrictions on the rights of domestic users and the malfunctioning of its appeals process.
The spread of disinformation and hate speech through YouTube also constitutes a serious social problem. It was particularly shocking when the impeached former president was reported to have placed more trust in far-right YouTubers than in mainstream media. Yet the political establishment has sought to address this issue merely by strengthening criminal penalties for disinformation. Civil society organisations remain deeply concerned about the impact of big tech platforms such as YouTube on democracy, but think that harsher penalties for disinformation cannot serve as a true solution. On the contrary, there are serious concerns that such measures may be politically abused.
What in the Korean process can serve as inspiration for other countries or in the international debate on confidentiality and protection of users’ rights?
Particularly US-based big tech companies often invoke US law as a means of evading responsibility in other jurisdictions. However, when such companies conduct business in a given country, they are obliged to comply with that country’s laws and to respect the rights of its users accordingly.
That said, the case was not ultimately resolved through a final judgment on appeal but instead concluded by way of settlement. This reflected the continuing practical limitations in reaching and enforcing a definitive judicial determination, notwithstanding the Supreme Court’s decision. More broadly, significant challenges remain in ensuring that global big tech companies comply with national laws and protect users’ rights.
Nevertheless, this litigation demonstrates that progress can be achieved. Just as Google’s Korean Privacy Policy was improved in line with practices under the European Union General Data Protection Regulation (GDPR), it is necessary to continue efforts to make big tech’s business practices more transparent in each jurisdiction, and to expand practices most favourable to the protection of users’ rights.
Do you see these new policies having an impact beyond the court decision?
The settlement agreement not only requires Google to respond to the plaintiffs’ access requests (to the extent such responses are not precluded by confidentiality obligations under US law), but also obligates Google to implement changes to its privacy policies in order to enhance the overall level of personal information protection for Korean users.
1. Korean-language access request webform: Google shall provide a webform in Korean through which Korean users may submit personal information access requests. While such webforms were already available in Europe, Korean users had previously been required to submit such requests by email.
2. Explicit notice of US confidentiality limitations: Google shall expressly inform Korean users, through its Privacy Help Center page, that access to records of third-party disclosures of personal information may be restricted where US law imposes confidentiality obligations.
3. Individualised responses to disclosure requests: Where Korean users submit access requests concerning the provision of their personal information to government agencies, Google shall provide individualised responses regarding whether such disclosures occurred and whether the user was notified. In addition, where Korean users request confirmation of any release from confidentiality obligations under US law, Google shall provide individualized responses to such requests.
4. Enhanced supplementary information page: Google shall expand the supplementary information page for Korean users within its Privacy Policy to include more detailed explanations regarding the purposes of data processing and the categories of data processed for each purpose. While such a supplementary page previously existed, under the settlement Google has committed to provide substantially more detailed disclosures about its processing of personal information.
We have confirmed that Google has complied with these settlement obligations.