VPNs with servers in South Korea

The operator keeps a ledger of each disclosure and reports on disclosures to the Minister of Science and ICT twice a year. The Communications Secrets Protection Act (Article 15-2) obliges operators to cooperate with requests for communication confirmation data from prosecutors, judicial police officers and heads of intelligence and investigative agencies.

A presidential decree under that Act sets the keeping periods; in its 2008 text they were at least twelve months for most categories of communication confirmation data, six months for local and long-distance telephone records, and three months for internet log records. Whether a VPN operator is a telecommunications business operator, or a value-added business that must report under Article 22, is not established.

The Korea Communications Standards Commission has sites blocked through internet providers; from February 2019 the blocking also reads the server name in HTTPS connections. Separately, Article 22-5 of the Telecommunications Business Act requires reporting value-added operators and special value-added operators to delete or block illegal filmed material, synthesised sexual material and child or youth sexual exploitation material once it is reported.

Defamation under Article 307 of the Criminal Act carries up to two years for a true statement and five for a false one; insult under Article 311 carries up to one year and needs a complaint. Article 70 of the Network Act raises the ceilings for defamation over an information network to three years and seven. The online offence requires intent to defame, and the victim’s express objection bars prosecution.

On 3 November 2017 the Court of Appeals lifted the Commission’s March 2016 block of a US-based website, which the Commission had justified under Article 7 of the National Security Act. It held that blocking an entire site is allowed only in exceptional circumstances, where all its content is shown to be illegal, and that a non-resident foreign owner may challenge a block in Korean courts.

On 21 July 2022 the Constitutional Court held non-conforming with the Constitution the part of the Telecommunications Business Act that lets operators share user data with investigators without notifying the person concerned, and gave the legislature until the end of 2023 to amend it, according to ARTICLE 19. The order of the rows is the security score, and a server’s location is not a recommendation.