ANNEX II

May 18, 2021

His Excellency Mr. Didier Reynders, Commissioner for Justice of the European Commission

Your Excellency,

I welcome the constructive discussions between Korea and the European Commission aiming at building the framework for transfer of personal data from EU to Korea.

Upon the request from the European Commission to the government of Korea, I am sending a document attached herewith providing an overview of the legal framework concerning access to information by the government of Korea.

This document concerns many ministries and agencies of the government of Korea, and regarding the contents of the document, the relevant ministries and agencies (Personal Information Protection Commission, Ministry of Justice, National Intelligence Service, National Human Rights Commission of Korea, National Counter Terrorism Center, Korea Financial Intelligence Unit) are responsible for the passages within the scope of their respective competences. Please find below the relevant ministries and agencies and respective signatures.

The Personal Information Protection Commission accepts all inquiries on this document and will coordinate the necessary responses among the relevant ministries and agencies.

I hope that this document would be helpful in making decisions at the European Commission.

I do appreciate your great contribution to date in this matter.

Sincerely yours,

L0442022EN110120211217EN0001.00036919022Legal framework for the collection and use of personal data by Korean public authorities for law enforcement and national security purposesThe following document provides an overview of the legal framework for the collection and use of personal data by Korean public authorities for criminal law enforcement and national security purposes (hereinafter referred to as government access), in particular as regards the available legal bases, applicable conditions (limitations) and safeguards, as well as independent oversight and individual redress possibilities.1.GENERAL LEGAL PRINCIPLES RELEVANT FOR GOVERNMENT ACCESS1.1.Constitutional frameworkThe Constitution of the Republic of Korea lays down the right to privacy in general (Article 17) and the right to privacy of correspondence in particular (Article 18). It is the duty of the State to guarantee these fundamental rightsArticle 10 of the Constitution of the Republic of Korea, promulgated on 17 July 1948 (hereafter the Constitution).. The Constitution furthermore stipulates that the rights and freedoms of citizens may only be restricted by law and when necessary for national security, or the maintenance of law and order for public welfareArticle 37(2) of the Constitution.. Even when such restrictions are imposed, they may not affect the essence of the freedom or rightArticle 37(2) of the Constitution.. The Korean courts have applied these provisions in cases concerning government interference with privacy. For example, the Supreme Court found that the monitoring of civilians violated the fundamental right to privacy, stressing that citizens have the right to self-determination of personal information.Supreme Court of Korea Decision No. 96DA42789, 24 July 1998. In another case, the Constitutional Court held that privacy is a fundamental right that provides protection from state intervention and observation in the private life of citizensConstitutional Court Decision No. 2002Hun-Ma51, 30 October 2003. Similarly, in Decision 99Hun-Ma513 and 2004Hun-Ma190 (consolidated), 26 May 2005, the Constitutional Court clarified that the right to control one's own personal information is a right of the subject of the information to personally decide when, to whom or by whom, and to what extent his or her information will be disclosed or used. It is a basic right, although not specified in the Constitution, existing to protect the personal freedom of decision from the risk caused by the enlargement of state functions and info-communication technology..The Korean Constitution furthermore guarantees that no person shall be arrested, detained, searched, interrogated, or items seized except as provided by lawArticle 12(1), first sentence of the Constitution.. Moreover, searches and seizures may only be conducted on the basis of a warrant issued by a judge, upon request of a prosecutor, and in respect of due processArticle 16 and 12(3) of the Constitution.. In exceptional circumstances, i.e. where a criminal suspect is apprehended while committing a crime (flagrante delicto), or where there is a risk that a person suspected of committing a crime punishable by imprisonment of three years or more may escape or destroy evidence, investigative authorities may conduct a warrantless search or seizure, in which case they must request a warrant ex postArticle 12(3) of the Constitution.. These general principles are further developed in specific laws dealing with criminal procedure and the protection of communications (see below for a detailed overview).With respect to foreign nationals, the Constitution stipulates that their status is guaranteed as prescribed by international law and treatiesArticle 6(2) of the Constitution.. Several international agreements to which Korea is a party guarantee privacy rights, such as the International Covenant on Civil and Political Rights (Article 17), the Convention on the Rights of Persons with Disabilities (Article 22) and the Convention on the Rights of the Child (Article 16). In addition, while the Constitution in principle refers to the rights of citizens, the Constitutional Court has ruled that also foreign nationals hold basic rightsConstitutional Court Decision No. 93Hun-MA120, 29 December 1994. See also for example Constitutional Court Decision No. 2014Hun-Ma346 (31 May 2018), where the Court found that the constitutional right of a Sudanese national held at the airport to receive assistance of legal counsel was violated. In another case, the Constitutional Court found that the freedom to choose one’s legal workplace is closely related to the right to pursue happiness as well as human dignity and value, and is therefore not reserved to citizens only but may also be guaranteed to foreigners that are legally employed in the Republic of Korea (Constitutional Court Decision No. 2007Hun-Ma1083, 29 September 2011).. In particular, the Court held that the protection of dignity and a person’s value as a human being as well as the right to seek happiness are rights of any human being, and not just of citizensConstitutional Court Decision No. 99HeonMa494, 29 November 2001.. The Court also clarified that the right to control one’s information is considered to be a basic right, grounded in the right to dignity and the pursuit of happiness and the right to private lifeSee for instance Constitutional Court Decision No. 99HunMa513.. Although case law has so far not specifically dealt with the right to privacy of non-Korean nationals, it is therefore widely accepted among scholars that Articles 12-22 of the Constitution (which include the right to privacy as well as personal liberty) set out rights of human beings.Finally, the Constitution also provides for a right to claim just compensation from public authoritiesArticle 29(1) of the Constitution.. Moreover, on the basis of the Constitutional Court Act, any person whose fundamental rights guaranteed by the Constitution are infringed by the exercise of governmental power (excluding judgments of the courts) may lodge a constitutional complaint with the Constitutional CourtArticle 68(1) Constitutional Court Act..1.2.General data protection rulesThe general data protection law in the Republic of Korea, the Personal Information Protection Act (hereafter PIPA), applies to both the private and public sector. With respect to public authorities, PIPA specifically refers to the obligation to formulate policies to prevent abuse and misuse of personal information, indiscrete surveillance and tracking, etc. and to enhance the dignity of human beings and individual privacy.Article 5(1) PIPA.The processing of personal data for law enforcement purposes is subject to the entirety of PIPA’s requirements. This means for instance that criminal law enforcement authorities must comply with the obligations for lawful processing, i.e. rely on one of the legal bases listed in PIPA for the collection, use or provision of personal information (Articles 15-18 PIPA), as well as the principles of purpose limitation (Article 3(1), (2) PIPA), proportionality/data minimisation (Article 3(1), (6) PIPA), limited data retention (Article 21 PIPA), data security, including data breach notification (Articles 3(4), 29 and 34 PIPA), and transparency (Articles 3(1), (5), 20, 30 and 32 PIPA). Specific safeguards apply with respect to sensitive information (Article 23 PIPA). Moreover, in accordance with Articles 3(5) and 4 PIPA, as well as Articles 35 to 39-2 PIPA, individuals can exercise their rights of access, correction, deletion and suspension vis-à-vis law enforcement authorities.While PIPA therefore fully applies to the processing of personal data for criminal law enforcement purposes, it contains an exception when personal data is processed for national security purposes. According to Article 58(1) lit. 2 PIPA, Articles 15-50 PIPA do not apply to personal information collected or requested for the analysis of information related to national securityArticle 58(1) lit. 2 PIPA.. Conversely, Chapter I (General provisions), Chapter II (Establishment of personal information protection policies, etc.), Chapter VIII (Class-action lawsuit over data infringement), Chapter IX (Supplementary provisions) and Chapter X (Penalty provisions) of PIPA remain applicable. This includes the general data protection principles set out in Article 3 (Principles of protecting personal information) and the individual rights guaranteed by Article 4 PIPA (Rights of data subjects). This means that the main principles and rights are guaranteed also in this area. In addition, Article 58(4) PIPA provides that such information must be processed to the minimum extent necessary to attain the intended purpose and for the minimum period; it also requires the personal information controller to put in place the necessary measures to ensure safe data management and appropriate processing, such as technical, managerial and physical safeguards, as well as measures for the appropriate handling of individual grievances.In Notification No. 2021-1 on Supplementary rules for the interpretation and application of the Personal Information Protection Act, the Personal Information Protection Commission (hereafter PIPC) has further clarified how PIPA applies to the processing of personal data for national security purposes, in light of this partial exemptionNotification No. 2021-1 of the PIPC on Supplementary rules for the interpretation and application of the Personal Information Protection Act, Section III, 6.. This includes in particular the rights of individuals (access, rectification, suspension and deletion) and the grounds as well as limitations for possible restrictions thereof. According to the Notification, the application of the core principles, rights and obligations of PIPA to the processing of personal data for national security purposes reflects the guarantees provided by the Constitution for the protection of the individual’s right to control his or her own personal information. Any restriction to that right, for example when necessary for the protection of national security, requires a balancing of the rights and interests of the individual against the relevant public interest and may not affect the essence of the right (Article 37(2) of the Constitution).2.GOVERNMENT ACCESS FOR LAW ENFORCEMENT PURPOSES2.1.Competent public authorities in the area of law enforcementBased on the Criminal Procedure Act (hereafter CPA), the Communications Privacy Protection Act (hereafter CPPA) and the Telecommunications Business Act (hereafter TBA), the police, prosecutors and courts may collect personal data for criminal law enforcement purposes. To the extent the National Intelligence Service Act confers this power also onto the National Intelligence Service (hereafter NIS), it has to comply with the aforementioned ActsSee Article 3 NIS Act (Act No. 12948), which refers to criminal investigations of certain crimes, such as insurrection, rebellion and crimes related to national security (e.g. espionage). The procedures of the CPA regarding searches and seizures would apply in such a context, while the CPPA would govern the collection of communication data (see part 3 on the provisions dealing with access to communications for national security purposes).. Finally, the Act on Reporting and Using Specified Financial Transaction Information (hereafter ARUSFTI) provides a legal basis for financial institutions to disclose information to the Korea Financial Intelligence Unit (hereafter KOFIU) for the purpose of preventing money laundering and terrorism financing. This specialised agency may in turn provide such information to law enforcement authorities. However, these disclosure obligations only apply to data controllers that process personal credit information pursuant to the Credit Information Act and are subject to the oversight of the Financial Services Commission. Since the processing of personal credit information by such controllers is excluded from the scope of the adequacy decision, the limitations and safeguards that apply under the ARUSFTI are not described in further detail in this document.2.2.Legal bases and limitationsThe CPA (see 2.2.1), CPPA (see 2.2.2) and Telecommunications Business Act (see 2.2.3) provide legal bases for the collection of personal information for law enforcement purposes and set out the applicable limitations and safeguards.2.2.1.Searches and seizures2.2.1.1.Legal basisProsecutors and senior judicial police officers may only inspect articles, search persons or seize articles (1) if a person is suspected of having committed a crime (a criminal suspect), (2) it is necessary for the investigation and (3) the articles to be inspected, persons to be searched, and any articles seized are deemed to be connected with the caseArticle 215(1) and (2) CPA.. Likewise, courts may conduct searches and seize any articles to be used as evidence or liable to confiscation, as long as such articles or persons are considered to be connected with a specific caseArticles 106(1), 107 and 109 CPA..2.2.1.2.Limitations and safeguardsAs a general obligation, prosecutors and judicial police officers must respect the human rights of the criminal suspect as well as those of any other person concernedArticle 198(2) CPA.. In addition, compulsory measures to achieve the purpose of the investigation may only be taken where explicitly provided for in the CPA and to the least extent necessaryArticle 199(1) CPA..Searches, inspections or seizures by police officers or prosecutors as part of a criminal investigation may only take place on the basis of a court-issued warrantArticle 215(1) and (2) CPA.. The authority requesting a warrant must submit materials demonstrating the grounds for suspecting an individual of having committed a crime, that the search, inspection or seizure is necessary, and that the relevant articles to be seized existArticle 108(1) Regulation on Criminal Procedure.. As for the warrant, it must amongst other elements contain the names of the criminal suspect and the offence; the place, person or articles to be searched, or articles to be seized; the date of issuing; and the effective period of applicationArticle 114(1) CPA in conjunction with Article 219 CPA.. Similarly, when, as part of ongoing Court proceedings, searches and seizures are carried out other than in open court, a court-issued warrant must be obtained beforehandArticle 113 CPA.. The concerned individual and his/her defence council is notified in advance of the search or seizure and may be present when the warrant is being executedArticle 121 and 122 CPA..When conducting searches or seizures and where the article to be searched is a computer disc or other data storage medium, in principle only the data itself (copied or printed out) will be seized rather than the entire mediumArticle 106(3) CPA.. The data storage medium itself may only be seized when it is considered substantially impossible to print out or copy the required data separately, or when it is considered substantially impracticable to otherwise accomplish the purpose of the searchArticle 106(3) CPA.. The concerned individual must be notified of the seizure without delayArticle 219 CPA in conjunction with Article 106(4) CPA.. There are no exceptions to this notification requirement under the CPA.Warrantless searches, inspections and seizures may only take place in limited situations. First, this is the case when it is impossible to obtain a warrant because of urgency at the scene of an offenceArticle 216(3) CPA.. However, a warrant must subsequently be obtained without delayArticle 216(3) CPA.. Second, warrantless searches and inspections may take place in loco when a criminal suspect is arrested or detainedArticle 216(1) and (2) CPA.. Finally, a prosecutor or senior judicial police officer may seize an article without a warrant when the article has been discarded by a criminal suspect or third person, or was voluntarily producedArticle 218 CPA. As regards personal information, this only covers the voluntary production by the concerned individual him-/herself, not by a personal information controller holding such information (which would require a specific legal basis under the Personal Information Protection Act). Voluntarily produced articles are only admitted as evidence in court proceedings if there is no reasonable doubt regarding the voluntary nature of the disclosure, which it is for the prosecutor to demonstrate. See Supreme Court Decision 2013Do11233, 10 March 2016..Evidence that has been obtained in violation of the CPA will be considered inadmissibleArticle 308-2 CPA.. Moreover, the Criminal Act stipulates that illegal searches of persons or a person’s place of residence, guarded building, structure, automobile, ship, aircraft or occupied room, is punishable by imprisonment for a maximum of three yearsArticle 321 Criminal Act.. This provision therefore also applies where objects, such as data storage devices, are seized during an illegal search.2.2.2.Collection of communication information2.2.2.1.Legal basisThe collection of communication information is governed by a specific Act, the CPPA. In particular, the CPPA stipulates a prohibition for anyone to censor any mail, wiretap any telecommunications, provide communication confirmation data, or record or listen to any conversation between others that are not made public, except on the basis of the CPA, the CPPA or the Military Court ActArticle 3 CPPA. The Military Court Act in principle governs the collection of information on military personnel and can only apply to civilians in a limited number of cases (e.g. if military personnel and civilians would commit a crime together, or if an individual commits a crime against the military, proceedings may be initiated before a military court, see Article 2 Military Court Act). The general provisions governing searches and seizures are similar to the CPA, see e.g. Articles 146-149 and 153-156 Military Court Act. For example, postal mail may only be collected when necessary for an investigation and on the basis of a warrant from the Military Court. To the extent that electronic communications would be collected, the limitations and safeguards of the CPPA apply.. The term communication within the meaning of the CPPA covers both ordinary mail and telecommunicationsArticle 2(1) CPPA, i.e. transmission or reception of all kinds of sounds, words, symbols or images by wire, wireless, fibre cable or other electromagnetic system, including telephone, e-mail, membership information service, facsimile and radio paging.. In this respect, the CPPA distinguishes between communication-restricting measuresArticles 2(7) and 3(2) CPPA. and the collection of communication confirmation data.The notion of communication-restricting measures covers censorship, i.e. the collection of the content of traditional postal mail, as well as wire-tapping, i.e. the direct interception (acquiring or recording) of the content of telecommunicationsCensorship is defined as opening mail without the consent of the party concerned or acquiring knowledge of, recording or withholding its contents through other means (Article 2(6) CPPA). Wiretapping means acquiring or recording the contents of telecommunications by listening to or communally reading the sounds, words, symbols or images of the communications through electronic and mechanical devices without the consent of the party concerned or interfering with their transmission and reception (Article 2(7) CPPA).. The notion of communication confirmation data covers data on the records of telecommunications, which includes the date of telecommunications, their start- and end time, the number of outgoing and incoming calls as well as the subscriber number of the other party, the frequency of use, log files on the use of telecommunication services and location information (e.g. from transmission towers where signals are received)Article 2(11) CPPA..The CPPA sets out the limitations and safeguards for the collection of both types of data, and non-compliance with several of these requirements is subject to criminal penaltiesArticles 16 and 17 CPPA. This applies for instance to warrantless collection, failure to keep records, failure to discontinue the collection when an emergency ceases to exist, or failure to give notice to the concerned individual..2.2.2.2.Limitations and safeguards applicable to the collection of the content of communications (communication restricting measures)The collection of the content of communications may only take place as a supplementary means of facilitating a criminal investigation (i.e. as a measure of last resort) and efforts must be made to minimise the interference with people's communication secretsArticle 3(2) CPPA.. In line with this general principle, communication-restricting measures may only be deployed where it is difficult to otherwise prevent the commission of a crime, arrest the criminal, or collect the evidenceArticle 5(1) CPPA.. Law enforcement agencies collecting the content of communications must immediately cease to do so once continued access is no longer deemed to be necessary, thereby ensuring that the infringement of the privacy of communications is as limited as possibleArticle 2 CPPA Enforcement Decree..Moreover, communication-restricting measures may only be used when there is substantial reason to suspect that certain serious crimes specifically listed in the CPPA are being planned, are being committed, or have been committed. These include crimes such as insurrection, drug-related crimes or crimes involving explosives, as well as crimes related to national security, diplomatic relations, or military bases and installationsArticle 5(1) CPPA.. The target of a communication-restricting measure must be specific mail items or telecommunications sent or received by the suspect, or mail items or telecommunications sent or received by the suspect during a fixed period of timeArticle 5(2) CPPA..Even when these requirements are met, the collection of content data may only take place on the basis of a court-issued warrant. In particular, a prosecutor may ask the court to permit the collection of content data regarding the suspect or person under investigationArticle 6(1) CPPA.. Similarly, a judicial police officer may apply for authorisation to a prosecutor, who in turn may request a warrant from the courtArticle 6(2) CPPA.. A request for a warrant must be made in writing and must contain specific elements. In particular, it must set out (1) the substantial reasons to suspect that one of the listed crimes is planned, being committed or has been committed as well as any materials establishing a prima facie case of suspicion; (2) the communication-restricting measures as well as their target, scope, objective and effective period; and (3) the place where the measures would be executed and how they would be carried outArticle 6(4) CPPA and Article 4(1) CPPA Enforcement Decree..Where the legal requirements are satisfied, the court may grant written permission to carry out communication-restricting measures with respect to the suspect or person under investigationArticles 6(5) and 6(8) CPPA.. This warrant specifies the kinds of measures as well as their target, scope, effective period, place of execution and how they shall be carried outArticle 6(6) CPPA..Communication-restricting measures may only be carried out for a period of two monthsArticle 6(7) CPPA.. If the objective of the measures is achieved earlier within that period, the measures must be discontinued immediately. Conversely, if the required conditions are still met, a request to extend the effective period of communication-restricting measures may be filed within the two months’ time limit. Such a request must include materials establishing a prima facie case for extending the measuresArticle 6(7) CPPA.. The extended period may not exceed a total of one year, or three years for certain particularly serious crimes (e.g. crimes related to insurrection, foreign aggression, national security, etc.)Article 6(8) CPPA..Law enforcement authorities may compel the assistance of communication operators by providing them with the court’s written permissionArticle 9(2) CPPA.. Communication operators are required to cooperate and to keep the permission received in their filesArticle 15-2 CPPA and Article 12 CPPA Enforcement Decree.. They may refuse cooperation when information on the targeted individual as indicated in the court’s written permission (for example the individual’s telephone number) is incorrect. Moreover, they are prohibited under all circumstances from disclosing passwords used for telecommunicationsArticle 9(4) CPPA..Anyone executing communication-restricting measures or requested to cooperate must keep records specifying the objectives of the measures, their execution, the date on which cooperation was provided and the targetArticle 9(3) CPPA.. Records must also be kept by law enforcement authorities implementing communication-restricting measures, setting out the details and obtained outcomesArticle 18(1) CPPA Enforcement Decree.. Judicial police officers must provide this information by means of a report to the prosecutor when they close an investigationArticle 18(2) CPPA Enforcement Decree..When a prosecutor issues an indictment with respect to a case in which communication-restricting measures were used, or issues a disposition not to indict or arrest the relevant individual (i.e. not just a stay of prosecution), the prosecutor must notify the individual subject to the communication-restricting measures of the fact that communication-restricting measures were executed, the executing agency and the execution period. Such notice must be provided in writing within 30 days from the dispositionArticle 9-2(1) CPPA.. Notice may be deferred when it is likely to seriously endanger national security or disrupt the public safety and order, or when it is likely to result in material harm to the lives and bodies of othersArticle 9-2(4) CPPA.. When intending to defer notice, the prosecutor or judicial police officer must obtain approval from the head of the District Public Prosecutor’s OfficeArticle 9-2(5) CPPA.. Once the grounds for referral cease to exist, notice must be provided within 30 days from that moment in timeArticle 9-2(6) CPPA..The CPPA also sets out a specific procedure for the collection of the content of communications in emergency situations. In particular, law enforcement agencies may collect the content of communications in the event that the planning or execution of organised crime or another serious crime that may directly cause death or serious injury is imminent, and an emergency exists that makes it impossible to go through the regular procedure (as set out above)Article 8(1) CPPA.. In such an emergency, a police officer or prosecutor may take communication-restricting measures without prior court permission but must file for court permission immediately after execution. If the law enforcement agency fails to obtain court permission within 36 hours from the moment the emergency measures were carried out, the collection must be discontinued immediately, typically followed by the destruction of the collected informationArticle 8(2) CPPA.. Police officers carrying out emergency surveillance do so under the control of a prosecutor, or, in case receiving the prosecutor’s instructions in advance is impossible due to the necessity of acting urgently, the police must obtain the approval of a prosecutor immediately upon commencing executionArticle 8(3) CPPA and Article 16(3) CPPA Enforcement Decree.. The rules on the notification of the individual as described above also apply to the collection of the content of communications in emergency situations.Collection of information in emergency situations must always take place in accordance with an emergency censorship/wiretapping statement and the authority carrying out the collection must keep a register of any emergency measureArticle 8(4) CPPA.. The request to a court to grant permission for emergency measures must be accompanied by a written document indicating the necessary communication-restricting measures, the target, subject, scope, period, place of execution, method, and an explanation as to how the relevant communication-restricting measures meet Article 5(1) CPPAThat is, that there is a substantial reason to suspect that certain serious crimes are being planned or committed, or have been committed, and it is impracticable otherwise to prevent the commission of a crime, arrest the criminal, or collect evidence., along with supporting documents.In cases when emergency measures are completed within a short time, thus ruling out court permission (e.g. if the suspect is arrested immediately after initiating the interception, which therefore stops), the head of the competent Public Prosecutor's Office serves an emergency measure notice to the competent courtArticle 8(5) CPPA.. The notice must set out the objective, target, scope, period, place of execution and method of collection as well as the grounds for not filing a request for court permissionArticle 8(6)-(7) CPPA.. This notice allows the receiving court to examine the legality of the collection and must be entered into a registry of emergency measure notices.As a general requirement, the content of communications acquired through the execution of communication-restricting measures on the basis of the CPPA may only be used to investigate, prosecute or prevent the specific crimes listed above, in disciplinary proceedings for the same crimes, a claim for damages raised by a party to the communications or where this is allowed by other lawsArticle 12 CPPA..Specific safeguards apply where telecommunications transmitted over the internet are collectedArticle 12-2 CPPA.. Such information may only be used to investigate the serious crimes listed in Article 5(1) CPPA. To retain the information, approval must be obtained from the court that authorised the communication-restricting measuresThe prosecutor or police officer executing the communication-restricting measures must select the telecommunications to be retained within 14 days after the measures end and request court approval (in the case of a police offer, the application must be made to a prosecutor, who in turn submits the request to the court), see Article 12-2(1) and (2) CPPA.. A request for retention must contain information on the communication-restricting measures, a summary of the results of the measures, the reasons for retention (together with supporting materials) and the telecommunications to be retainedArticle 12-2(3) CPPA.. In the absence of such a request, the acquired telecommunications must be deleted within 14 days after the communication-restricting measures have endedArticle 12-2(5) CPPA.. If a request is rejected, the telecommunications must be destroyed within seven daysArticle 12-2(5) CPPA.. Where telecommunications are deleted, a report must be filed within seven days with the court that authorised the communication-restricting measures, setting out the reasons for the deletion, as well as the details and timing thereof.More generally, if information was illegally obtained by means of communication-restricting measures, it will not be admitted as evidence in judicial or disciplinary proceedingsArticle 4 CPPA.. Also, the CPPA prohibits any person taking communication-restricting measures from disclosing confidential information obtained in the course of implementing such measures, and from using the information obtained to damage the reputation of those who are subject to the measuresArticle 11(2) CPPA Enforcement Decree..2.2.2.3.Limitations and safeguards applicable to the collection of communication confirmation informationOn the basis of the CPPA, law enforcement authorities may request telecommunication operators to provide communication confirmation data when necessary to conduct an investigation or execute a sentenceArticle 13(1) CPPA.. Unlike for the collection of content data, the possibility to collect communication confirmation data is not limited to certain specific crimes. However, as is the case for content data, the collection of communication confirmation data requires prior written permission from a court, subject to the same conditions as described earlierArticles 13 and 6 CPPA.. When grounds of urgency make it impossible to obtain court permission, communication confirmation data may be collected without a warrant, in which case the permission must be obtained immediately after requesting the data and must be communicated to the telecommunication providerArticle 13(2) CPPA. As is the case for urgent communication-restricting measures, a document setting out the details of the case (the suspect, the measures to be taken, the suspected crime as well as the urgency) must be drawn up. See Article 37(5) CPPA Enforcement Decree.. If no subsequent permission is obtained, the collected information must be destroyedArticle 13(3) CPPA..Prosecutors, judicial police officers and courts must keep records of requests for communication confirmation dataArticle 13(5) and (6) CPPA.. In addition, telecommunication providers must twice per year report on the disclosure of communication confirmation data to the Minister of Science and ICT, and must keep records thereof for seven years from the date on which data has been disclosedArticle 13(7) CPPA..Individuals are in principle notified of the fact that communication confirmation data has been collectedSee Article 13-3(7), in conjunction with Article 9-2 CPPA.. The timing for such notification depends on the circumstances of the investigationArticle 13-3(1) CPPA.. Once a decision is taken (not) to prosecute, notification must be provided within 30 days. Conversely, if indictment is suspended, notification must be provided within 30 days following one year after such decision is taken. In any event, notification must be provided within 30 days following one year after the information has been collected.The notification may be deferred if it is likely to (1) endanger national security, public security and order, (2) cause death or bodily injury, (3) impede fair judicial proceedings (e.g. leading to the destruction of evidence or threatening of witnesses), or (4) defame the suspect, victims or other persons related to the case, or invade their privacyArticle 13-3(2) CPPA.. Notification on one of the aforementioned grounds requires authorisation from the director of a competent district public prosecutors’ officeArticle 13-3(3) CPPA.. When the grounds for deferral cease to exist, notice must be provided within 30 days from that moment in timeArticle 13-3(4) CPPA..Notified individuals may submit a written request to the prosecutor or judicial police officer concerning the reasons for the collection of the communication confirmation dataArticle 13-3(5) CPPA.. In that case, the prosecutor or judicial police officer must provide the reasons in writing within 30 days after receiving the request, unless one of the abovementioned grounds (exceptions for deferral of notification) appliesArticle 13-3(6) CPPA..2.2.3.Voluntary disclosure by telecommunications business operatorsArticle 83(3) of the TBA allows telecommunications business operators to voluntarily comply with a request (made in support of a criminal trial, investigation or the execution of a sentence) from a court, prosecutor or the head of an investigative agency, to disclose communications data. In the context of the TBA, communications data cover the name, resident registration number, address and phone number of users, the dates on which users subscribe or terminate their subscription as well as user identification codes (i.e. codes used to identify the rightful user of computer systems or communication networks)Article 83(3) TBA.. For the purpose of the TBA, only individuals that directly contract services from a Korean telecommunications provider are considered usersArticle 2(9) TBA.. As a consequence, situations where EU individuals whose data has been transferred to the Republic of Korea would be considered users under the TBA are likely to be very limited, as those individuals would normally not conclude a direct contract with a Korean telecommunications operator.Requests to obtain communications data on the basis of the TBA must be made in writing and state the reasons for the request, the link to the relevant user and the scope of the requested dataArticle 83(4) TBA.. Where it is impossible to provide a written request due to urgency, the written request must be provided as soon as the reason for the urgency disappearsArticle 83(4) TBA.. Telecommunications business operators that comply with requests to disclose communications data must retain ledgers which contain records indicating that communications data have been provided, as well as the related materials, such as the written requestArticle 83(5) TBA.. Moreover, telecommunications business operators must report on the provision of communications data to the Minister of Science and ICT twice per yearArticle 83(6) TBA..There is no obligation for telecommunications business operators to comply with requests to disclose communications data on the basis of the TBA. Each request must therefore be assessed by the operator in light of the applicable data protection requirements under PIPA. In particular, a telecommunications business operator must take into account the interests of the data subject and may not disclose the information if it would be likely to infringe unfairly on the interest of the individual or a third partyArticle 18(2) PIPA.. In addition, in accordance with Notification No. 2021-1 on Supplementary rules for the interpretation and application of the Personal Information Protection Act, the concerned individual must be notified of the disclosure. In exceptional situations, such notification may be delayed, in particular if and for as long as the notification would jeopardise an ongoing criminal investigation or is likely to harm the life or body of another person, where those rights or interests are manifestly superior to the rights of the data subjectNotification No. 2021-1 of the PIPC on Supplementary rules for the interpretation and application of the Personal Information Protection Act, Section III, 2, (iii)..In 2016, the Supreme Court confirmed that the voluntary provision of communications data by telecommunications business operators without a warrant on the basis of the TBA does not as such violate the right to informational self-determination of the user of the telecommunication service. At the same time, the Court clarified that there would be such a violation if it is manifestly apparent that the requesting agency abused its authority to request the disclosure of communications data, thereby violating the interests of the individual concerned or a third partySupreme Court Decision No. 2012Da105482, 10 March 2016.. More generally, any request for voluntary disclosure by a law enforcement authority must comply with the principles of lawfulness, necessity and proportionality following from the Korean Constitution (Articles 12(1) and 37(2)).2.3.OversightOversight of criminal law enforcement authorities is carried out through different mechanisms, both internally and by external bodies.2.3.1.Self-auditingIn accordance with the Act on Public Sector Audits, public authorities are encouraged to establish an internal body for self-auditing, with the task, amongst others, to carry out legality controlArticles 3 and 5 Act on Public Sector Audits.. The heads of such audit bodies must be guaranteed independence to the largest extent possibleArticle 7 Act on Public Sector Audits.. More specifically, they are appointed from outside the relevant authority (e.g. former judges, professors) for a period of two to five years and can only be dismissed for justified reasons (e.g. when unable to perform duties due to a mental or physical disorder, when subject to disciplinary action)Articles 8-11 Act on Public Sector Audits.. Likewise, auditors are appointed on the basis of specific conditions laid down in the ActArticles 16 et seq. Act on Public Sector Audits.. Audit reports may include recommendations or requests for compensation or correction, as well as reprimands and recommendations or requests for disciplinary actionArticle 23(2) Act on Public Sector Audits.. They are notified to the head of the public authority subject to the audit, as well as to the Board of Audit and Inspection (see section 2.3.2) within 60 days from completion of the auditArticle 23(1) Act on Public Sector Audits.. The authority concerned must implement the required measures and report the results to the Board of Audit and InspectionArticle 23(3) Act on Public Sector Audits.. In addition, audit results are generally made available to the publicArticle 26 Act on Public Sector Audits.. The refusal or obstruction of a self-audit is subject to administrative finesArticle 41 Act on Public Sector Audits.. In the area of criminal law enforcement, to comply with the aforementioned legislation, the National Police Agency operates an Inspector-General system to handle internal audits, including with respect to possible human rights violationsSee in particular the divisions under the Director General for Audit and Inspection: https://www.police.go.kr/eng/knpa/org/org01.jsp..2.3.2.The Board of Audit and InspectionThe Board of Audit and Inspection (hereafter BAI) may inspect the activities of public authorities and, on the basis of such inspections, issue recommendations, request disciplinary actions, or file a criminal complaintArticles 24 and 31-35 Board of Audit and Inspection Act (hereafter BAI Act).. The BAI is established under the President of the Republic of Korea, but retains an independent status with respect to its dutiesArticle 2(1) BAI Act.. In addition, the Act establishing the BAI requires that the BAI shall be granted independence to the maximum extent with respect to the appointment, dismissal and organisation of its staff, as well as the compilation of its budgetArticle 2(2) BAI Act.. The Chairperson of the BAI is appointed by the President, with the consent of the National AssemblyArticle 4(1) BAI Act.. The six remaining Commissioners are appointed by the President, upon recommendation of the Chairperson, for a four-year termArticles 5(1) and 6 BAI Act.. Commissioners (including the Chairperson) must meet specific qualifications laid down by lawE.g. having served as a judge, public prosecutor or attorney-at-law for at least ten years, worked as a public servant, or professor or higher-ranking position at a university for at least eight years, or worked for at least ten years in a stock-listed corporation or government-invested institution (of which at least five years as an executive officer), see article 7 BAI Act. and may only be dismissed in case of impeachment, sentencing to imprisonment or inability to perform their duties due to long-term mental or physical weaknessArticle 8 BAI Act.. Moreover, Commissioners are prohibited from participating in political activities, and from concurrently holding offices in the National Assembly, administrative agencies, organisations subject to audit and inspection by the BAI or any other office or position that is remuneratedArticle 9 BAI Act..The BAI conducts a general audit on an annual basis, but may also conduct specific audits on matters of special interest. The BAI may request the submission of documents in the course of an inspection and request the attendance of individualsSee e.g. Article 27 BAI Act.. As part of an audit, the BAI examines the revenue and expenditure of the State, but also oversees general compliance with the duties of public authorities and public officials with a view to improving the operation of public administrationArticles 20 and 24 BAI Act.. Its oversight therefore extends beyond budgetary aspects and also includes a legality control.2.3.3.The National AssemblyThe National Assembly may investigate and inspect public authoritiesArticle 128 National Assembly Act and Articles 2, 3 and 15 Act on the Inspection and Investigation of State Administration. This includes annual inspections of government affairs as a whole and investigations of specific matters.. During an investigation or inspection, the National Assembly may request the disclosure of documents and compel the appearance of witnessesArticle 10(1) Act on the Inspection and Investigation of State Administration. See also Articles 128 and 129 National Assembly Act.. Anyone committing perjury during an investigation of the National Assembly is subject to criminal sanctions (imprisonment for up to ten years)Article 14 Act on Testimony, Appraisal, etc. before the National Assembly.. The process and results of inspections may be made publicArticle 12-2 Act on the Inspection and Investigation of State Administration.. If the National Assembly finds unlawful or improper activity, it may request that the relevant public authority takes corrective measures, including awarding compensation, taking disciplinary action, and improving its internal proceduresArticle 16(2) Act on the Inspection and Investigation of State Administration.. Following such a request, the authority must act without delay and report the outcome to the National AssemblyArticle 16(3) Act on the Inspection and Investigation of State Administration..2.3.4.The Personal Information Protection CommissionThe Personal Information Protection Commission (hereafter PIPC) exercises oversight over the processing of personal information by criminal law enforcement authorities in line with PIPA. In addition, according to Article 7-8(3), (4) and Article 7-9(5) PIPA, the oversight of the PIPC also covers possible infringements of the rules setting out the limitations and safeguards with respect to the collection of personal information, including those contained in the specific laws regulating the collection of (electronic) evidence for the purposes of criminal law enforcement (see section 2.2). Given the requirements in Article 3(1) PIPA for the lawful and fair collection of personal information, any such infringement also constitutes a violation of PIPA, allowing the PIPC to carry out an investigation and to take corrective measuresSee PIPC Notification No. 2021-1 on Supplementary rules for the interpretation and application of the Personal Information Protection Act..In exercising its oversight function, the PIPC has access to all relevant informationArticle 63 PIPA.. The PIPC may provide advice to law enforcement authorities to improve the level of personal information protection of their processing activities, impose corrective measures (e.g. to suspend data processing or take necessary measures to protect personal information) or advise the authority to take disciplinary actionArticles 61(2), 65(1), 65(2) and 64(4) PIPA.. Finally, criminal sanctions are foreseen for certain PIPA violations, such as unlawfully using or disclosing personal information to third parties or the unlawful processing of sensitive informationArticles 70-74 PIPA.. In this respect, the PIPC may refer the matter to the competent investigative agency (including a prosecutor)Article 65(1) PIPA..2.3.5.The National Human Rights CommissionThe National Human Rights Commission (hereafter NHRC) – an independent body tasked with protecting and promoting fundamental rightsArticle 1 Human Rights Commission Act (hereafter NHRC Act). – has the power to investigate and remedy violations of Articles 10–22 of the Constitution, which include the rights to privacy and privacy of correspondence. The NHRC is comprised of 11 Commissioners, appointed upon nomination by the National Assembly (four), the President (four) and the Chief Justice of the Supreme Court (three)Article 5(1) and (2) NHRC Act.. To be appointed, a Commissioner must (1) have served for at least ten years at a university or an authorized research institute, at least as an associate professor; (2) have served as a judge, prosecutor, or attorney-at-law for at least ten years; (3) have been engaged in human rights activities for at least ten years (e.g. for a non-profit, non-governmental organisation or international organisation); or (4) have been recommended by civil society groupsArticle 5(3) NHRC Act.. The Chairperson is appointed by the President from among the Commissioners and must be confirmed by the National AssemblyArticle 5(5) NHRC Act.. Commissioners (including the Chairperson) are appointed for a renewable term of three years and may only be dismissed in case they are sentenced to imprisonment or are no longer capable of performing their duties due to prolonged physical or mental weakness (in which case two thirds of the Commissioners must agree to the dismissal)Article 7(1) and Article 8 NHRC Act.. NHRC Commissioners are prohibited from holding a concurrent office in the National Assembly, local councils, or any State or local government (as a public official)Article 10 NHRC Act..The NHRC may initiate an investigation on its own initiative or on the basis of a petition from an individual. As part of its investigation, the NHRC may request the submission of relevant materials, conduct inspections and summon individuals to testifyArticle 36 NHRC Act. In accordance with Article 36(7) of the Act, the submission of materials or articles may be rejected if it would prejudice state confidentiality liable to have a substantial effect on state security or diplomatic relations or would present a serious obstacle to a criminal investigation or pending trial. In such cases, the Commission may request further information from the head of the relevant agency (which has to comply in good faith) where necessary to review whether the refusal to provide the information is justified.. Following an investigation, the NHRC may issue recommendations to improve or correct specific policies and practices, and may make them publicArticle 25(1) NHRC Act.. Public authorities must notify the NHRC of a plan to implement such recommendations within 90 days upon receiving themArticle 25(3) NHRC Act.. Moreover, in case of a failure to implement recommendations, the concerned authority must inform the Commission thereofArticle 25(4) NHRC Act.. The NHRC may in turn disclose such failure to the National Assembly, and/or make it public. Public authorities generally comply with NHRC recommendations and have a strong incentive to do so as their implementation has been assessed as part of the general evaluation conducted by the Office for Government Policy Coordination, under the authority of the Prime Minister’s Office.2.4.Individual redress2.4.1.Redress mechanisms available under PIPAIndividuals may exercise their rights of access, correction, deletion and suspension under PIPA with respect to personal information processed by criminal law enforcement authorities. Access may be requested directly from the relevant authority, or indirectly via the PIPCArticle 35(2) PIPA.. The competent authority may limit or deny access only where this is provided for by law, where it would likely cause damage to the life or body of a third party, or would likely lead to or unjustified infringement of property and other interests of another person (i.e. where the interests of the other person would outweigh the interests of the individual making the request)Article 35(4) PIPA.. If an access request is denied, the individual must be informed of the reasons therefor and how to appealArticle 42(2) PIPA Enforcement Decree.. Similarly, a request for correction or erasure may be denied where this is provided for in other laws, in which case the individual must be informed of the underlying reasons and the possibility to appealArticle 36(1)-(2) PIPA and Article 43(3) PIPA Enforcement Decree..As regards redress, individuals may lodge a complaint with the PIPC, including through the Privacy Call Centre operated by the Korea Internet and Security AgencyArticle 62 PIPA.. In addition, an individual may obtain mediation through the Personal Information Dispute Mediation CommitteeArticles 40-50 PIPA and Articles 48-2 to 57 PIPA Enforcement Decree.. These redress avenues are available both in case of possible infringements of the rules contained in specific laws setting out the limitations and safeguards with respect to the collection of personal information (section 2.2) and of PIPA. In addition, individuals may challenge the decisions or inaction of the PIPC under the Administrative Litigation Act (see section 2.4.3).2.4.2.Redress before the National Human Rights CommissionThe NHRC handles complaints from individuals (both Korean and foreign nationals) concerning human rights violations committed by public authoritiesAlthough Article 4 NHRC Act refers to citizens and foreigners residing in the Republic of Korea, the term residing reflects a concept of jurisdiction rather than territory. Therefore, if the fundamental rights of a foreigner outside of Korea are violated by national institutions within Korea, that individual may file a complaint with the NHRC. See for example the corresponding question on the NHRC’s Frequently Asked Questions page, available at https://www.humanrights.go.kr/site/program/board/basicboard/list?boardtypeid=7025&menuid=002004005001&pagesize=10¤tpage=2. This would be the case if personal data of a foreigner transferred to Korea is unlawfully accessed by Korean public authorities.. There is no standing requirement for individuals to lodge a complaint with the NHRCA complaint must in principle be filed within one year from the violation, but the NHRC may still decide to investigate a complaint that is lodged after that time period as long as the statute of limitation under criminal or civil law has not expired (Article 32(1) lit. 4 NHRC Act).. As a consequence, a complaint will be handled by the NHRC even if the concerned individual cannot demonstrate an injury in fact at the admissibility stage. In the context of the collection of personal data for criminal law enforcement purposes, an individual would therefore not be required to demonstrate that his/her personal information has in fact been accessed by Korean public authorities for the complaint to be admissible before the NHRC. An individual may also request to resolve the complaint through mediationArticles 42 et seq. NRHC Act..To investigate a complaint, the NHRC can make use of its investigatory powers, including by requesting the submission of relevant materials, conducting inspections and summoning individuals to testifyArticles 36 and 37 NHRC Act.. If the investigation reveals that a violation of relevant laws has occurred, the NHRC may recommend the implementation of remedies or the rectification or improvement of any relevant statute, institution, policy or practiceArticle 44 NHRC Act.. Proposed remedies may include mediation, cessation of the human rights violation, compensation for damages and measures to prevent recurrence of the same or similar violationsArticle 42(4) NHRC Act.. In the case of unlawful collection of personal information under applicable rules, remedial measures may include the deletion of the personal information collected. If it is deemed highly likely that the infringement is ongoing and it is deemed likely that, if left unattended, damage difficult to remedy would be caused, the NHRC may adopt urgent relief measuresArticle 48 NHRC Act..While the NHRC has no power to compel, its decisions (e.g. a decision not to continue the investigation of a complaint)For example, if the NHRC is exceptionally not able to inspect certain materials or facilities because they concern state secrets liable to have a substantial effect on state security or diplomatic relations, or where the inspection would present a serious obstacle to a criminal investigation or pending trial (see footnote 166), and where this prevents the NHRC from carrying out the investigation necessary to assess the merits of the petition received, it will inform the individual of the reasons why the complaint was rejected, in accordance with Article 39 NHRC Act. In this case, the individual could challenge the NHRC’s decision under the Administrative Litigation Act. and recommendations can be challenged before the Korean courts under the Administrative Litigation Act (see section 2.4.3 below)See e.g. Seoul High Court Decision 2007Nu27259, 18 April 2008, confirmed by Supreme Court Decision 2008Du7854, 9 October 2008; Seoul High Court Decision 2017Nu69382, 2 February 2018.. In addition, if the findings of the NHRC reveal that personal data was unlawfully collected by a public authority, an individual could seek further redress before the Korean courts against that public authority, e.g. by challenging the collection under the Administrative Litigation Act, filing a constitutional complaint under the Constitutional Court Act, or applying for compensation of damages under the State Compensation Act (see section 2.4.3 below).2.4.3.Judicial redressIndividuals may invoke the limitations and safeguards described in the previous sections to obtain redress before the Korean courts through different avenues.First, in accordance with the CPA, the concerned individual and his/her counsel may be present when a warrant for a search or seizure is being executed, and may therefore raise an objection at the time the warrant is being executedArticles 121 and 219 CPA. In addition, the CPA provides for a so-called quasi-complaint mechanism, which allows individuals to petition the competent court with a request to cancel or alter a disposition made by a prosecutor or police officer concerning a seizureArticle 417 CPA in conjunction with Article 414(2) CPA. See also Supreme Court Decision No. 97Mo66, 29 September 1997.. This allows individuals to challenge the measures taken to execute a seizure warrant.Moreover, individuals may obtain compensation for damages before the Korean courts. On the basis of the State Compensation Act, individuals may apply for compensation for damages inflicted by public officials in performing their official duties in violation of the lawArticle 2(1) State Compensation Act.. A claim under the State Compensation Act may be filed with a specialised Compensation Council, or directly with the Korean courtsArticles 9 and 12 State Compensation Act. The Act establishes District Councils (chaired by the deputy prosecutor of the corresponding prosecutor’s office), a Central Council (chaired by the Vice Minister of Justice) and a Special Council (chaired by the Vice Minister of National Defense and in charge of compensation claims for damages inflicted by military personnel or civilian employees of the military). Claims for compensation are in principle handled by District Councils, which under certain circumstances have to forward cases to the Central/Special Council, e.g. if the compensation exceeds a certain amount or in case an individual applies for re-deliberation. All Councils consist of members appointed by the Minister of Justice (e.g. from among public officials of the Ministry of Justice, judicial officers, lawyers, and persons having an expertise in in relation to state compensation) and are subject to specific rules on conflict of interest (see Article 7 Enforcement Decree of the State Compensation Act).. If the victim is a foreign national, the State Compensation Act applies as long as that national’s country of origin equally ensures state compensation for Korean nationalsArticle 7 State Compensation Act.. According to case law, this condition is fulfilled if the requirements to request compensation in the other country are not significantly off-balanced between Korea and the other country and are not generally stricter than those determined by Korea, having no material and substantive difference."Supreme Court Decision No. 2013Da208388, 11 June 2015. The Civil Act governs the state’s liability for compensation and, as a consequence, state liability also covers non-property damages (e.g. mental suffering)See Article 8 State Compensation Act, as well as Article 751 Civil Act..For violations of the data protection rules, an additional legal remedy is provided under PIPA. According to Article 39 PIPA, any individual suffering harm as a result of a violation of PIPA or of a loss, theft, divulgence, forgery, alteration of, or damage to his/her personal information may obtain compensation for damages before the courts. There is no similar requirement of reciprocity as under the State Compensation Act.In addition to compensation for damages, administrative redress may be obtained against actions or omissions of administrative agencies under the Administrative Litigation Act. Any individual may challenge a disposition (i.e. the exercise of, or refusal to exercise, public power in a specific case) or omission (the prolonged failure of an administrative agency to take a certain disposition contrary to a legal obligation to do so), which may lead to the revocation/alteration of an illegal disposition, a finding of nullity (i.e. a finding that the disposition does not have legal effect or its non-existence in the legal order) or a finding that an omission is illegalArticles 2 and 4 Administrative Litigation Act.. In order to be able to challenge an administrative disposition, it must directly impact on civil rights and dutiesSupreme Court Decision 98Du18435, 22 October 1999, Supreme Court Decision 99Du1113, 8 September 2000, and Supreme Court Decision 2010Du3541, 27 September 2012.. This includes measures to collect personal data, be it directly (e.g. intercepting communications) or by way of a disclosure request (e.g. to a service provider).The aforementioned claims may first be brought before administrative appeals commissions established under certain public authorities (e.g. the NIS, the NHRC) or before the Central Administrative Appeals Commission established under the Anti-Corruption and Civil Rights CommissionArticle 6 Administrative Appeals Act and Article 18(1) Administrative Litigation Act.. Such an administrative appeal provides an alternative, more informal avenue to challenge a disposition or omission of a public authority. However, a claim may also be brought directly before the Korean courts, under the Administrative Litigation Act.A request for revocation/alteration of a disposition under the Administrative Litigation Act may be filed by any person having a legal interest to seek the revocation/alteration, or to be restored in his/her rights by the revocation/alteration in case the disposition no longer has effectArticle 12 Administrative Litigation Act.. Similarly, litigation to affirm nullity may be brought by a person having a legal interest in such affirmation, while a litigation to affirm the illegality of an omission may be initiated by any person who has made a request for a disposition and has a legal interest to seek that the illegality of the omission be affirmedArticles 35 and 36 Administrative Litigation Act.. According to case law of the Supreme Court, legal interest is interpreted as a legally protected interest, i.e. a direct and specific interest protected by laws and regulations on which administrative dispositions are based (i.e. not general, indirect and abstract interests of the public)Supreme Court Decision No. 2006Du330, 26 March 2006.. Individuals therefore have a legal interest in case of any violation of the limitations and safeguards with respect to the collection of their personal data for criminal law enforcement purposes (under specific laws or PIPA). A final judgment under the Administrative Litigation Act is binding on the partiesArticle 30(1) Administrative Litigation Act..A request for revocation/alteration of a disposition and a request to affirm the illegality of an omission must be filed within 90 days from the date the individual becomes aware of the disposition/omission and in principle no later than one year from the date the disposition is issued/omission occurred, unless there are justifiable reasonsArticle 20 Administrative Litigation Act. This time limit also applies to a claim to affirm the illegality of an omission, see Article 38(2) Administrative Litigation Act.. According to the case law of the Supreme Court, the notion of justifiable reasons is to be interpreted broadly and requires assessing whether it is socially acceptable to allow a delayed complaint, in light of all the circumstances of the caseSupreme Court Decision 90Nu6521, 28 June 1991.. For example, this includes (but is not limited to) reasons for delay for which the concerned party cannot be held responsible (i.e. situations that are outside the control of the complainant, for instance where (s)he has not been notified of the collection of his/her personal information) or force majeure (e.g. natural disaster, war).Finally, individuals may also file a constitutional complaint with the Constitutional CourtArticle 68(1) Constitutional Court Act.. On the basis of the Constitutional Court Act, any person whose fundamental rights guaranteed by the Constitution are infringed due to the exercise or non-exercise of governmental power (excluding judgments of the courts), may request adjudication of a constitutional complaint. If other remedies are available, these must be exhausted first. According to the case law of the Constitutional Court, foreign nationals may file a constitutional complaint to the extent their basic rights are recognised under the Korean Constitution (see the explanations in section 1.1)Constitutional Court Decision No. 99HeonMa194, 29 November 2001.. Constitutional complaints must be filed within 90 days after the individual has become aware of the infringement, and within one year after its occurrence. Given that the procedure of the Administrative Litigation Act is applied to litigation under the Constitutional Court ActArticle 40 Constitutional Court Act., a complaint will still be admissible if there are justifiable reasons, as interpreted in accordance with the Supreme Court case law described above.If other remedies need to be exhausted first, a constitutional complaint must be filed within 30 days after the final decision on such a remedyArticle 69 Constitutional Court Act.. The Constitutional Court may invalidate the exercise of governmental power that caused the infringement or confirm that a certain failure to act is unconstitutionalArticle 75(3) Constitutional Court Act.. In that case, the relevant authority is required to take measures to comply with the decision of the Court.3.GOVERNMENT ACCESS FOR NATIONAL SECURITY PURPOSES3.1.Competent public authorities in the area of national securityThe Republic of Korea has two dedicated intelligence agencies: the NIS and the Defense Security Support Command. Beyond that, the police and prosecution may also collect personal information for national security purposes.The NIS is established by the National Intelligence Service Act (hereafter NIS Act) and operates directly under the jurisdiction and supervision of the PresidentArticles 2 and 4(2) NIS Act.. In particular, the NIS collects, compiles and distributes information on foreign countries (and North Korea)This notion does not cover information on individuals, but information on general information on foreign countries (trends, developments) and on the activities of third country state actors., intelligence related to the task of countering espionage (including military and industrial espionage), terrorism and the activities of international crime syndicates, intelligence on certain types of crime directed against public and national security (e.g. domestic insurrection, foreign aggression) and intelligence related to the task of ensuring cyber security and preventing or countering cyberattacks and threatsArticle 3(1) NIS Act.. The NIS Act, which establishes the NIS and sets out its tasks, also provides general principles that frame all of its activities. As a general principle, the NIS must maintain political neutrality and protect the freedom and rights of individualsArticles 3(1), 6(2), 11, 21. See also the rules on conflicts of interest, in particular Articles 10, 12.. The President of the NIS is charged with developing general guidelines that set out the principles, scope and procedures for the performance of the NIS’ duties in relation to the collection and use of information, and has to report them to the National AssemblyArticle 4(2) NIS Act.. The National Assembly (through its Intelligence Committee) may require the guidelines to be corrected or supplemented if it considers that they are illegal or unjust. More generally, when carrying out their duties, the Director and NIS personnel may not force any institution, organisation or individual to do anything they are not obligated to do, nor obstruct any person’s exercise of rights, by abusing their official authorityArticle 13 NIS Act.. In addition, any censorship of mail, interception of telecommunications, collection of location information, collection of communication confirmation data or the recording of or listening in on private communications by the NIS must comply with the CPPA, Location Information Act or CPAArticle 14 NIS Act.. Any abuse of power or the collection of information in violation of these laws is subject to criminal sanctionsArticles 22 and 23 NIS Act..The Defense Security Support Command is a military intelligence agency, established under the Ministry of Defense. It is responsible for security matters within the military, military criminal investigations (subject to the Military Court Act) and military intelligence. In general, the Defense Security Support Command does not carry out surveillance of civilians, unless this is necessary to conduct its military functions. Persons that may be investigated are military personnel, civilian employees of the military, persons in military training, persons in military reserve or recruit service and prisoners of warArticle 1 Military Court Act.. When collecting communication information for national security purposes, the Defense Security Support Command is subject to the limitations and safeguards laid down by the CPPA and its Enforcement Decree.3.2.Legal bases and limitationsThe CPPA, the Act on Anti-Terrorism for the Protection of Citizens and Public Security (hereafter Anti-Terrorism Act) and the TBA provide legal bases for the collection of personal information for national security purposes and set out the applicable limitations and safeguardsWhen investigating crimes related to national security, the Police and NIS will act on the basis of the CPA, while the Defense Security Support Command is subject to the Military Court Act.. These limitations and safeguards, as described in the next sections, ensure that the collection and processing of information is limited to what is strictly necessary to achieve a legitimate objective. This excludes any mass and indiscriminate collection of personal information for national security purposes.3.2.1.Collection of communication information3.2.1.1.Collection of communication information by intelligence agencies3.2.1.1.1.Legal basisThe CPPA empowers intelligence agencies to collect communication data and requires communication providers to cooperate with requests from those agenciesArticle 15-2 CPPA.. As described in section 2.2.2.1, the CPPA distinguishes between the collection of the content of communications (i.e. communication-restricting measures such as wire-tapping or censorshipArticle 2(6) and (7) CPPA. measures), and the collection of communication confirmation dataArticle 2(11) CPPA..The threshold for collecting these two types of information differs, but the applicable procedures and safeguards are to a large extent identicalSee also Article 13-4(2) CPPA and Article 37(4) CPPA Enforcement Decree, which stipulate that the procedures applicable to the collection of the content of communications apply mutatis mutandis to the collection of communication confirmation data.. The collection of communication confirmation data (or meta-data) may take place for the purpose of preventing threats to national securityArticle 13-4 CPPA.. A higher threshold applies for the execution of communication-restricting measures (i.e. to collect the content of communications), which may only be taken when national security is expected to be put in grave danger and the collection of intelligence is necessary to prevent such danger (i.e. if there is a grave risk to national security and the collection is necessary to prevent it)Article 7(1) CPPA.. Moreover, access to the content of communications may only be carried out as a measure of last resort to ensure national security, and efforts must be made to minimize the violation of the privacy of communicationsArticle 3(2) CPPA.. Even when the appropriate approval/permission has been obtained, such measures must be stopped immediately once they are no longer necessary, thereby ensuring that any infringement of the individual’s communication secrets is limited to the minimumArticle 2 CPPA Enforcement Decree..3.2.1.1.2.Limitations and safeguards applying to the collection of communication information involving at least one Korean nationalThe collection of communication information (both content and meta-data) where either one or both individuals involved in the communication are Korean nationals may only take place with the permission from a senior Chief Justice of the High CourtArticle 7(1)1 CPPA. The competent court is the high court having jurisdiction over the place of domicile or seat of one or both parties subject to the surveillance.. The request from the intelligence agency must be made in writing to a prosecutor or a High Prosecutors’ OfficeArticle 7(3) CPPA Enforcement Decree.. It must indicate the reasons for the collection (i.e. that the national security is expected to be put in grave danger, or that the collection is necessary for preventing threats to national security), together with the materials supporting those reasons and establishing a prima facie case, as well as the details of the request (i.e. the objectives, targeted individual(s), scope, effective period of collection, as well as how and where the collection will take place)Articles 7(3) and 6(4) CPPA.. The prosecutor/High Prosecutors’ Office in turn requests permission from a senior Chief Justice of the High CourtArticles 7(4) CPPA Enforcement Decree. The prosecutor’s request to the court must set out the main grounds for suspicion and, to the extent that several permissions are requested at the same time, the justification therefor (see Article 4 CPPA Enforcement Decree).. The Chief Justice may only grant written permission when (s)he deems the application justified and will dismiss the request when (s)he considers it groundlessArticles 7(3), 6(5) and 6(9) CPPA.. The warrant specifies the type, objective, target, scope and effective period of collection, as well as where and how it may take placeArticles 7(3) and 6(6) CPPA..Specific rules apply in the event that the measure aims at the investigation of an act of conspiracy that threatens national security and an emergency exists that makes it impossible to go through the aforementioned proceduresArticle 8 CPPA.. When these conditions are fulfilled, intelligence agencies may carry out surveillance measures without prior court approvalArticle 8(1) CPPA.. However, immediately after the execution of the emergency measures, the intelligence agency must request the permission of the court. If permission is not obtained within 36 hours from the time the measures are taken, they must be discontinued immediatelyArticle 8(2) CPPA.. The collection of information in emergency situations must always take place in accordance with an emergency censorship/wiretapping statement and the intelligence agency carrying out the collection must keep a register of any emergency measureArticle 8(4) CPPA. See above section 2.2.2.2. for emergency measures in the context of law enforcement..In cases where the surveillance is completed within a short time, ruling out court permission, the head of the competent High Prosecutors’ Office must send an emergency measure notice prepared by the intelligence agency to the head of the competent court, which retains the emergency measure registryArticle 8(5) and (7) CPPA. This notice must indicate the objective, target, scope, period, place of execution and method of surveillance, as well as the grounds for not filing a request before taking the measure (Article 8(6) CPPA).. This allows the court to examine the legality of the collection.3.2.1.1.3.Limitations and safeguards applying to the collection of communication information involving only non-Korean nationalsTo collect information on communications exclusively between non-Korean nationals, intelligence agencies must obtain prior written approval from the PresidentArticle 7(1)2 CPPA.. Such communications will only be collected for national security purposes if they fall within one of several listed categories, i.e. communications between government officials or other individuals of countries hostile to the Republic of Korea, foreign agencies, groups or nationals suspected of engaging in anti-Korean activitiesThis refers to activities that threaten the nation’s existence and safety, democratic order or the people’s survival and freedom., or members of groups within the Korean Peninsula effectively beyond the sovereignty of the Republic of Korea and their umbrella groups based in foreign countriesMoreover, if one party is a person described in Article 7(1)2 CPPA and the other is unknown or cannot be specified, the procedure prescribed by Article 7(1)2 will apply.. Conversely, if one party to a communication is a Korean national and the other a non-Korean national, court approval will be required in accordance with the procedure described in section 3.2.1.1.2.The head of an intelligence agency must submit a plan for the measures intended to be taken to the Director of the NISArticle 8(1) CPPA Enforcement Decree. The Director of the NIS is appointed by the President following confirmation by the Parliament (Article 7 NIS Act).. The Director of the NIS reviews whether the plan is appropriate and, if this is the case, submits it for approval to the PresidentArticle 8(2) CPPA Enforcement Decree.. The information that must be included in the plan is the same as the information required for an application for court permission to collect information of Korean nationals (as described above)Article 8(3) CPPA Enforcement Decree, in conjunction with Article 6(4) CPPA.. In particular, it must indicate the reasons for the collection (i.e. that the national security is expected to be put in grave danger, or that the collection is necessary for preventing threats to national security), the main grounds for suspicion, together with the materials supporting those reasons and establishing a prima facie case, as well as the details of the request (i.e. the objectives, targeted individual(s), scope, effective period of collection, as well as how and where the collection will take place). Where several permits are requested at the same time, the purport and grounds thereofArticles 8(3) and 4 CPPA Enforcement Decree..In emergency situationsThat is, in cases when the measure aims at an act of conspiracy that threatens national security, there is insufficient time to obtain approval of the President and failure to adopt emergency measures may harm national security (Article 8(8) CPPA)., prior approval from the Minister to whom the relevant intelligence agency belongs must be obtained. However, in this case the intelligence agency must request the approval of the President immediately after the emergency measures have been taken. If an intelligence agency fails to obtain approval within 36 hours from the time the application is made, the collection must be discontinued immediatelyArticle 8(9) CPPA.. In such cases, the collected information will always be destroyed.3.2.1.1.4.General limitations and safeguardsWhen requesting the cooperation of private entities, intelligence agencies have to provide them with the court warrant/presidential permission or a copy of the cover of an emergency censorship statement, which the compelled entity must keep in its filesArticle 9(2) CPPA and Article 12 CPPA Enforcement Decree.. Entities requested to disclose information to intelligence agencies on the basis of the CPPA may refuse to do so when the authorisation or emergency censorship statement refers to the wrong identifier (e.g. a telephone number belonging to a different individual than the one identified). Moreover, in all cases, passwords used for communications may not be disclosedArticle 9(4) CPPA..Intelligence agencies may entrust the implementation of communication-restricting measures or the collection of communication confirmation information to a post office or a telecommunications service provider (as defined by the Telecommunications Business Act)Article 13 CPPA Enforcement Decree.. Both the relevant intelligence agency and the provider receiving a request to cooperate must keep registries indicating the purpose of requesting the measures, the date of execution or cooperation, and the object of the measures (e.g. mail, telephone, email) for three yearsArticle 9(3) CPPA and Article 17(2) CPPA Enforcement Decree. This time period does not apply to communication confirmation data (see Article 39 CPPA Enforcement Decree).. Telecommunications service providers providing communication confirmation data have to keep information on the frequency of collection in their files for seven years and report twice per year to the Minister of Science and ICTArticle 13(7) CPPA and Article 39 CPPA Enforcement Decree..Intelligence agencies have to report on the information they have gathered and the outcome of the surveillance activity to the Director of the NISArticle 18(3) CPPA Enforcement Decree.. With respect to the collection of communication confirmation data, records must be kept of the fact that a request for such data was made, as well as the written request itself and the institution that relied on itArticle 13(5) and 13-4(3) CPPA..The collection of both the content of communications and communication confirmation data may only last for a maximum period of four months and, if the pursued objective is achieved in the meantime, must be discontinued immediatelyArticle 7(2) CPPA.. If the conditions for permission persist, the period may be extended for up to four months, with the court’s permission or President’s approval. The application to obtain approval to extend the surveillance measures must be made in writing, stating the reasons why extension is sought and providing supporting materialsArticle 7(2) CPPA and Article 5 CPPA Enforcement Decree..Depending on the legal basis for collection, individuals are generally notified when their communications are collected. In particular, regardless of whether the information collected concerns the content of communications or communication confirmation data and regardless of whether the information was obtained through the ordinary procedure or in an emergency situation, the head of the intelligence agency must notify the individual concerned of the surveillance measure in writing within 30 days from the date on which the surveillance endedArticle 9-2(3) CPPA. In accordance with Article 13-4 CPPA, this applies both to the collection of the content of communications and of communication confirmation data.. The notification must include (1) the fact that the information has been collected, (2) the executing agency and (3) the execution period. However, if it is likely that the notice would put national security at risk or would harm people’s life and physical safety, the notice may be deferredArticle 9-2(4) CPPA.. Notice must be given within 30 days once the grounds for deferral cease to existArticles 13-4(2) and 9-2(6) CPPA..This notification requirement however only applies to the collection of information where at least one of the parties is a Korean national. As a consequence, non-Korean nationals will only be notified when their communications with Korean nationals are collected. There is therefore no notification requirement when communications exclusively between non-Korean nationals are collected.The content of any communications as well as communication confirmation data acquired through surveillance on the basis of the CPPA may only be used (1) for the investigation, prosecution or prevention of certain crimes, (2) for disciplinary proceedings, (3) for judicial proceedings where a party relating to the communication relies on them in a claim for damages or (4) on the basis of other lawsArticles 5(1)-(2), 12 and 13-5 CPPA..3.2.1.2.Collection of communication information by the police/prosecutors for national security purposesThe police/prosecutor may collect communication information (both the content of communications and communication confirmation data) for national security purposes under the same conditions as described in section 3.2.1.1. When acting in emergency situationsThat is, where the measure aims at an act of conspiracy that threatens national security and an emergency exists that makes it impossible to go through the ordinary approval procedure (Article 8(1) CPPA)., the applicable procedure is the one that was described earlier with respect to the collection of the content of communications for law enforcement purposes in emergency situations (i.e. Article 8 CPPA).3.2.2.Collection of information on terrorist suspects3.2.2.1.Legal basisThe Anti-Terrorism Act empowers the Director of the NIS to collect information on terrorist suspectsArticle 9 Anti-Terrorism Act.. Terrorist suspect is defined as a member of a terrorist groupTerrorist group is defined as a group of terrorists designated by the United Nations (Article 2(2) Anti-Terrorism Act)., a person who has propagated a terrorist group (by promoting and disseminating ideas or tactics of a terrorist group), raised or contributed funds for terrorismTerrorism is defined by Article 2(1) Anti-Terrorism Act as conduct carried out for the purpose of impeding the exercise of the authority of the State, a local government or a foreign government (including local governments and international organisations), or for the purpose of causing it to conduct any affair which is not obligatory for it, or threatening the public. This includes (a) killing a person or posing a risk to a person’s life by causing bodily injury or arresting, confining, kidnapping, or taking a person hostage; (b) certain types of conduct targeted at an aircraft (e.g. crashing, hijacking or damaging an aircraft in flight); (c) certain types of conduct related to a ship (e.g. seizing a ship or marine structure in operation, destroying a ship or marine structure in operation or inflicting damage thereon to a degree that endangers the safety thereof, including damaging the cargo loaded on a ship or marine structure in operation); (d) placing, detonating, or using in any other way a biochemical, explosive, or incendiary weapon or device with the intention to cause death, serious injury, or serious material damage or having such effect on certain types of vehicles or facilities (e.g. trains, trams, motor vehicles, public parks and stations, facilities to supply electricity, gas and telecommunications etc.); (e) certain types of conduct related to nuclear materials, radioactive materials, or nuclear facilities (e.g. harming human lives, bodies, or property, or otherwise disturbing public safety by destroying a nuclear reactor or wrongfully manipulating radioactive materials, etc.)., or engaged in other activities of preparing, conspiring, propagandizing, or instigating terrorism, or a person for whom there are good grounds to be suspected of having performed such activitiesArticle 2(3) Anti-Terrorism Act.. As a general rule, any public official enforcing the Anti-Terrorism Act must respect the basic rights enshrined in the Korean ConstitutionArticle 3(3) Anti-Terrorism Act..The Anti-Terrorism Act does not by itself set out specific powers, limitations and safeguards for the collection of information on terrorist suspects, but rather refers to the procedures in other statutes. First, on the basis of the Anti-Terrorism Act, the Director of the NIS may collect (1) information on the entry into and departure from the Republic of Korea, (2) information on financial transactions and (3) information on communications. Depending on the type of information sought, the relevant procedural requirements are provided in the Immigration Act and Customs Act, the ARUSFTI or the CPPA, respectivelyArticle 9(1) Anti-Terrorism Act.. For the collection of information on the entry into and departure from Korea, the Anti-Terrorism Act refers to the procedures set out in the Immigration Act and the Customs Act. However, these acts at present do not provide for such powers. For the collection of communication information and financial transaction information, the Anti-Terrorism Act refers to the limitations and safeguards in the CPPA (which are further detailed below) and the ARUSFTI (which, as explained in section 2.1, is not relevant for the purpose of the assessment for the adequacy decision).In addition, Article 9(3) of the Anti-Terrorism Act specifies that the Director of the NIS may request personal information or location information of a terrorist suspect from a personal information controllerAs defined in Article 2 PIPA, i.e. a public institution, legal person, organization, individual, etc. that processes personal information directly or indirectly to operate personal information files for official or business purposes. or a location information providerAs defined in Article 5 Act on the Protection, Use, etc. of Location Information (hereafter Location Information Act), i.e. anyone that has obtained permission from the Korea Communications Commission to engage in a location information business.. This possibility is limited to requests for voluntary disclosure, to which personal information controllers and location information providers are not required to respond, and in any event may only do so in accordance with PIPA and the Location Information Act (see section 3.2.2.2 below).3.2.2.2.Limitations and safeguards applying to voluntary disclosure under PIPA and the Location Information ActRequests for voluntary cooperation under the Anti-Terrorism Act must be limited to information on terrorist suspects (see above section 3.2.2.1). Any such request from the NIS must comply with the principles of lawfulness, necessity and proportionality following from the Korean Constitution (Articles 12(1) and 37(2))See also Article 3(2) and (3) Anti-Terrorism Act. as well as the PIPA requirements for the collection of personal information (Article 3(1) PIPA, see above section 1.2). The NIS Act furthermore specifies that the NIS may not force any institution, organisation or individual to do anything they are not obligated to do, nor obstruct any person’s exercise of rights, by abusing its official authorityArticle 11(1) NIS Act.. A violation of this prohibition may be subject to criminal sanctionsArticle 19 NIS Act..Personal information controllers and location information providers receiving requests from the NIS on the basis of the Anti-Terrorism Act are not required to comply. They may comply on a voluntary basis, but are only allowed to do so in accordance with PIPA and the Location Information Act.. As regards compliance with PIPA, the controller must in particular take into account the interests of the data subject and may not disclose the information if it would be likely to infringe unfairly on the interest of the individual or a third partyArticle 18(2) PIPA.. In addition, in accordance with Notification No. 2021-1 on Supplementary rules for the interpretation and application of the Personal Information Protection Act, the concerned individual must be notified of the disclosure. In exceptional situations, such notification may be delayed, in particular if and for as long as the notification would jeopardise an ongoing criminal investigation or is likely to harm the life or body of another person, where those rights or interests are manifestly superior to the rights of the data subjectNotification No. 2021-1 of the PIPC on Supplementary rules for the interpretation and application of the Personal Information Protection Act, Section III, 2, (iii)..3.2.2.3.Limitations and safeguards under the CPPAOn the basis of the Anti-Terrorism Act, intelligence agencies may only collect communication information (both the content of communications and communication confirmation data) when necessary for counterterrorism activities, i.e. activities related to the prevention of and countermeasures against terrorism. The procedures of the CPPA described in section 3.2.1 apply to the collection of communication information for anti-terrorism purposes.3.2.3.Voluntary disclosure by telecommunications business operatorsOn the basis of the TBA, telecommunications business operators may comply with a request to disclose communications data from an intelligence agency that intends to collect the information to prevent a threat to national securityArticle 83(3) TBA.. Any such request must comply with the principles of lawfulness, necessity and proportionality following from the Korean Constitution (Articles 12(1) and 37(2))See also Article 3(2) and (3) Anti-Terrorism Act. as well as the PIPA requirements for the collection of personal information (Article 3(1) PIPA, see above section 1.2). Moreover, the same limitations and safeguards as with respect to voluntary disclosures for law enforcement purposes apply (see section 2.2.3)In particular, the request must be in writing and state the reasons for the request, as well as the link to the relevant user and the scope of requested information, and the telecommunications business provider must keep records and report to the Minister of Science and ICT twice per year..A telecommunication business operators is not required to comply, but may do so on a voluntary basis and only in accordance with PIPA. In this respect, the same obligations, including as regards notification of the individual, apply to telecommunication business operators as when they receive requests from criminal law enforcement authorities, as explained in more detail in section 2.2.3.3.3.OversightDifferent bodies oversee the activities of Korean intelligence agencies. The oversight of the Defense Security Support Command is carried out by the Ministry of National Defense, pursuant to the Ministry’s Directive on Implementation of Internal Audit. The NIS is subject to oversight by the executive, the National Assembly and other independent bodies, as explained in more detail below.3.3.1.The Human Rights Protection OfficerWhen intelligence agencies collect information on terrorist suspects, the Anti-Terrorism Act provides for oversight by the Counterterrorism Commission and the Human Rights Protection Officer (hereafter HRPO)Article 7 Anti-Terrorism Act..The Counterterrorism Commission inter alia develops policies concerning counterterrorism activities and oversees the implementation of counterterrorism measures as well as the activities of different competent authorities in the area of counterterrorismArticle 5(3) Anti-Terrorism Act.. The Commission is chaired by the Prime Minister and comprised of several ministers and heads of governmental agencies, including the Minister of Foreign Affairs, the Minister of Justice, the Minister of National Defense, the Minister of Interior and Safety, the Director of the NIS, the Commissioner General of the National Police Agency and the Chairman of the Financial Services CommissionArticle 3(1) Anti-Terrorism Act Enforcement Decree.. When conducting counterterrorism investigations and tracing terrorist suspects to collect information or materials necessary for counterterrorism activities, the Director of the NIS must report to the Chairperson of the Counterterrorism Commission (i.e. the Prime Minister)Article 9(4) Anti-Terrorism Act..The Anti-Terrorism Act furthermore establishes the HRPO in order to protect the basic rights of individuals against infringements caused by counterterrorism activitiesArticle 7 Anti-Terrorism Act.. The HRPO is appointed by the Chairperson of the Counterterrorism Commission among individuals that meet the qualifications listed in the Enforcement Decree of the Anti-Terrorism Act (i.e. anyone qualified as an attorney-at-law with at least ten years working experience, or with expert knowledge in the field of human rights and serving or having served (at least) as an associate professor for at least ten years, or having served as a higher public official in State agencies or local governments, or with at least ten years working experience in the field of human rights, e.g. in a non-governmental organisation)Article 7(1) Anti-Terrorism Act Enforcement Decree.. The HRPO is appointed for two years (with the possibility for a renewed term) and may only be removed from office on specific, limited grounds and for good cause, e.g. when indicted in a criminal case related to his/her duties, when divulging confidential information, or because of long-term mental or physical incapacityArticle 7(3) Anti-Terrorism Act Enforcement Decree..In terms of powers, the HRPO may issue recommendations for improving the protection of human rights by agencies involved in counterterrorism activities, and process civil petitions (see section 3.4.3)Article 8(1) Anti-Terrorism Act Enforcement Decree.. Where the existence of an infringement of human rights in the performance of official duties can reasonably be established, the HRPO may recommend the head of the responsible agency to correct such violationArticle 9(1) Anti-Terrorism Act Enforcement Decree. The HRPO decides autonomously on the adoption of recommendations, but is required to report such recommendations to the Chairperson of the Counterterrorism Commission.. In turn, the responsible agency must notify the HRPO of the action und