This article is a contribution by Attorney Hye-rin Kim of Choi & Lee Law Firm. If you would like to share quality content for startups in the form of a contribution, please contact the Venture Square editorial team at editor@venturesquare.net.
Many companies install and use CCTV in their workplaces for various purposes, including security and customer safety. Installing and managing CCTV often leads to concerns like these: "I think someone stole something. Can I check the CCTV footage?", "I have a dispute with a customer. Can I use the CCTV footage as evidence?", or "Would it be a violation of the Personal Information Protection Act to display CCTV footage indiscriminately?"
The Supreme Court recently issued a ruling regarding a case questioning whether submitting CCTV footage containing personal information to investigative authorities as evidence in a criminal complaint constitutes a violation of the Personal Information Protection Act. Today, we'll briefly review the key points of this ruling, examining precautions for CCTV installation, CCTV footage management, and the potential use of CCTV footage as evidence in disputes.
1. CCTV Installation: Be sure to follow these rules.
A. CCTV cannot be installed everywhere.
The legal term for CCTV is "fixed video information processing device," and the Personal Information Protection Act stipulates restrictions on its installation and operation. CCTV may only be installed and operated by authorized personnel for specific purposes, such as when specifically permitted by law, when necessary for crime prevention and investigation, or for facility safety and management or fire prevention (Article 25, Paragraph 1 of the Personal Information Protection Act). Most startups and small and medium-sized enterprises (SMEs) install CCTV for facility safety and management purposes, which is sufficiently permitted under the Personal Information Protection Act. However, installing and operating CCTV to view the interior of places that pose a significant risk of infringement on an individual's privacy, such as restrooms, changing rooms, and shower rooms, is strictly prohibited under the Personal Information Protection Act, and violations are subject to a fine of up to 50 million won (Article 25, Paragraph 2, Article 75, Paragraph 1, Subparagraph 1 of the Personal Information Protection Act).
B. When installing CCTV, a signboard is required.
If you install CCTV, you must install a sign (Article 25, Paragraph 4 of the Personal Information Protection Act). This sign must clearly state the purpose and location of the installation, the scope and time of the recording, and the contact information of the person responsible for the recording. Simply stating "CCTV recording in progress" is inappropriate. Furthermore, a sign containing all of the above information must be installed in a location easily visible to the data subject (the person being filmed).
A. The recording function cannot be used.
While it's permissible to record video using CCTV, the recording function of the CCTV must not be used (Article 25, Paragraph 5 of the Personal Information Protection Act). For example, an apartment management office manager was punished for violating the Personal Information Protection Act for recording conversations between employees and tenant representatives using CCTV installed in the management office and tenant representative meeting room (Seoul Central District Court Decision 2017GoHap99, March 31, 2017).
2. Manage CCTV footage like this.
A. CCTV footage must be stored safely for a specified retention period.
CCTV footage is personal information and must be managed securely to prevent loss, theft, or leakage (Article 25, Paragraph 6 of the Personal Information Protection Act). It is recommended to take necessary measures, such as setting a password on the recording device and limiting access to the footage to a minimum. Furthermore, even if CCTV footage is managed securely, it cannot be stored indefinitely. When the specified retention period expires or the footage becomes unnecessary, it must be promptly destroyed. The Standard Personal Information Protection Guidelines recommend a retention period of no more than 30 days from the date of recording if determining the retention period is difficult (Article 41, Paragraph 2 of the Standard Personal Information Protection Guidelines).
B. You must not show it to others carelessly.
CCTV footage is considered personal information under the Personal Information Protection Act, and therefore cannot be provided or shared with third parties without the consent of the information subject (the person filmed) (Article 17, Paragraph 1 of the Personal Information Protection Act). Violating this provision by providing CCTV footage to others without the consent of the information subject, both the provider and the knowing recipient may be subject to imprisonment for up to five years or a fine of up to 50 million won (Article 71, Paragraph 1 of the Personal Information Protection Act). For example, in one case, the head of the electrical department at an apartment management office was punished for violating the Personal Information Protection Act by providing CCTV footage of a resident of a rental apartment to the chairman of the neighborhood association without the consent of the resident (Seoul Central District Court Decision 2019gojeong615, June 19, 2019).
3. CCTV footage can be submitted as evidence in case of a dispute.
We previously confirmed that CCTV footage is personal information, and therefore providing it to a third party without the consent of the data subject (the person filmed) is punishable. Returning to our initial question, if a theft occurs in a store, is it permissible to submit the CCTV footage of the theft to the police without the consent of the data subject (the person filmed)? The Supreme Court issued a noteworthy ruling on this issue in September 2025.
Officials from an apartment complex's residents' association filed a complaint against a resident for obstruction of business, etc., for posting a notice on a bulletin board without the association's consent. They submitted CCTV footage of the resident posting the notice to the police along with the complaint. The appeals court found the defendants guilty, stating that "provision of the CCTV footage exceeded the scope of the original purpose of collection," and also rejected the defendants' argument that the footage was legitimate, stating that "the footage could have been obtained through due process (such as a search and seizure) by investigative agencies after the complaint was filed."
However, the Supreme Court overturned this and ruled, “If evidence containing personal information is submitted to an investigative agency to clarify criminal charges or exercise the right to defense during a trial or investigative procedure, or if evidence containing personal information is submitted to an investigative agency to clarify criminal charges or exercise the right to defense during a complaint, accusation, or investigative procedure, it may be deemed an act that does not violate social norms and thus may be deemed unlawful under Article 20 of the Criminal Act” (Supreme Court Decision 2025do9522, pronounced on September 25, 2025).
This reaffirms the position stated in the July 2025 ruling (Supreme Court Decision 2023do17590, July 18, 2025, Supreme Court Decision 2023do3673, July 18, 2025). In the case of submitting CCTV footage as evidence to an investigative agency in the event of a dispute by attaching it to a complaint, considering the circumstances and purpose of the submission, whether it is the minimum information submitted, and the unavoidable circumstances that led to the submission, if it can be deemed a justifiable act, the illegality is eliminated and it is not a violation of the Personal Information Protection Act. However, this is limited to cases of submission to investigative agencies. Please be especially careful as posting CCTV footage on social media, internet communities, etc., disclosing it to other customers or employees, or distributing it for personal revenge purposes may violate the Personal Information Protection Act and may also lead to defamation.
4. In conclusion
CCTV is an essential and widely used tool for protecting corporate safety and property. However, many companies often overlook the restrictions and legal risks posed by relevant laws, such as the Personal Information Protection Act, when installing, managing, and utilizing CCTV footage. Use this column as a checklist to review your company's CCTV operations to ensure they are installed legally and in compliance with relevant laws and regulations, and that footage is not being stored unnecessarily for extended periods or inadvertently shared with external parties.
- See more related columns
You must be logged in to post a comment.