Your boss can probably read your chats. What does Korean law say? And what can you do about it?

High-profile cases in Korea involving ADOR CEO Min Hee-jin and dog trainer Kang Hyung-wook have raised questions over the privacy of workplace chats.

Min Hee-jin, left, and Kang Hyung-wook, both in legal conflict over online messengers [JOINT PRESS CORPS, JOONGANG ILBO]

Private conversations on online messaging apps might not be as private as some may think. Recent legal battles on whether it is legal for companies to read and take note of employee chats became a contentious issue with the cases of girl group NewJeans' producer Min Hee-jin and dog trainer Kang Hyung-wook.

Each case sits at the opposite end of the spectrum. While Min reported HYBE for restoring her laptop data and leaking private messages to the press, Kang has been reported by his former employees for reading their online chats and sending parts of conversations to other staff members, as well as other abuses of power.

In a digitalized era where online messaging apps have become an inseparable part of work, especially after the pandemic during which the online space quickly became the global norm for all types of jobs, Min and Kang’s cases have rung alarm bells for anyone who has ever used a messaging app at work for professional — and also personal — reasons.

Can companies use your chats against you? If so, does an individual have no choice but to always remain on guard?

Kang Hyung-wook, right, and his wife Susan Elder deny recent accusations mainly centering around their workplace behavior in a video posted on their YouTube channel BodeumTV on May 24. [SCREEN CAPTURE]

Kang Hyung-wook, the watcher

Min and Kang’s cases differ on countless levels, but a significant part of the issue centers on whether it is legal for a company to access employees’ work chats and use the content of the conversations against them.

Last month, Kang, CEO of dog training company Bodeum Company, was reported by former employees and 331 other online petitioners to the police for allegedly accessing employees' online conversations without their consent.

The complainants accused Kang and his wife, Susan Elder, of accessing internal conversations stored on the company's collaboration app on July 21, 2018. The couple reportedly read six months' worth of conversations in one day, some of which they disclosed in a KakaoTalk group chat with other employees.

The complainants argued that such actions violated Articles 48 and 49 of the Information and Communications Network Act, which prohibit unauthorized access to information systems and the disclosure of others' secrets.

Kang and Elder explained in an hourlong YouTube video that they only resorted to reading the chats after coming across messages that were insulting their son and using misandrist terms, but comments still remained negative toward the couple. Kang stepped down as the head of his own company in late June.

ADOR CEO Min Hee-jin at a press conference on April 25 [NEWS1]

Min Hee-jin’s plea

On the other hand, Min, CEO of ADOR, reported five HYBE executives, including current CEO Park Ji-won, to Yongsan Police Station for leaking her private messages to the press. She accused them of defamation and disruption of business.

During the now three-month-long back-and-forth between Min and HYBE, the majority shareholder of Min’s company ADOR, numerous KakaoTalk messages sent by Min were released to the press and public.

Min presented her chats with HYBE CEO Park and chairman Bang Si-hyuk at her first press conference on April 25, which she argued were evidence that HYBE pushed her and the members of NewJeans aside in favor of other labels’ girl groups, namely Source Music’s Le Sserafim and Belift Lab’s ILLIT.

HYBE retaliated by disclosing Min’s chats with her shaman in which she leaked company information. News outlets also reported on other chats with ADOR managers where she plotted to overthrow the current ownership structure of ADOR by getting a third-party investor involved.

ADOR CEO Min Hee-jin explaining her KakaoTalk messages she had with the chairman of HYBE, Bang Si-hyuk [NEWS1]

Min’s legal attorneys argued that she handed in her laptop to the company after wiping all the data, saying the company must have restored the data and leaked it to the press. HYBE argued that Min never handed in the laptop and that the data was saved onto HYBE’s server because she had sent the chat log to an outsider within the office.

“Min Hee-jin claims that HYBE illegally leaked information, but all the chats that were reported by the press were included in the report as a result of the internal audit,” a HYBE official told the Korea JoongAng Daily.

“We have handed in the report to legal offices and the police, so it doesn’t make sense for her to argue that HYBE has been leaking information when reporters are getting their sources from elsewhere.”

HYBE warned that it will countersue Min for false accusations on July 24, the same day that Min reported its higher-ups to the police.

An iPhone displaying the apps for Facebook and Messenger [AP/YONHAP]

“You agreed to it”

One argument that HYBE made while fending off Min was that Min had agreed to the company being able to access personal information when she signed her contract with HYBE and that other ADOR officials voluntarily handed in their data.

And that's what the law says, too.

“Almost all messaging apps allow the operators to gain access to the users’ chats — it’s just a matter of when and why they exercise that power,” a legal team head at a major company said under the condition of anonymity.

“Most employees sign their contracts without reading all the terms, but it’s likely that they gave the company consent to access their data — whether it be online chats or the memory saved on their drives — without their knowledge. The argument comes down to proving how justified the reason was for opening up the data.”

Kakao's work messenger and tool service Kakao Work introduced in September 2020 [YONHAP]

What becomes critical in court is whether the company had a just cause for tapping into the employee chats.

According to the Act on Promotion of Information and Communications Network Utilization and Information Protection, companies or other investigative forces have the right to access information with “just cause.” The act, however, does not spell out what counts as just cause, leaving individuals to fight over the issue in court.

In fact, the Supreme Court ruled in 2009 that it was just for a company to look into an employee who was found suspicious of trying to leak confidential data to outsiders. But in 2018, it ruled that it was illegal for a staff member to read another member’s online messaging conversations. In this instance, an employee gathered information from another person's computer when the latter had vacated their seat and their computer was turned on. The court determined this action didn't have just cause.

“A company’s messaging app is like a company car,” said Koo Tae-eon, an attorney specializing in tech and privacy at Law Firm Lin. “Just as companies need to be able to keep track of the car’s usage log, messaging data is also open to a company because it’s part of a company’s assets. Individuals who feel reluctant about the company accessing their data should use their private messaging apps instead.”

Messenger app WeChat [REUTERS/YONHAP]

What can I do?

The key is in compartmentalization, especially in an age where online messaging has become the norm. Sending your personal chats through personal messaging apps and only talking about work on workplace platforms may be the only option.

But that might be easier said than done.

KakaoTalk had 45 million monthly active users as of March this year, a whopping 87 percent of all Korean citizens, according to market tracker IGAWorks. In a 2021 survey by Open Survey, 53 percent of people’s workplaces used KakaoTalk for work without using a separate messaging service.

Tech companies have rolled out workplace messaging apps, such as Naver Works — used by Kang's company — Kakao Work and Jandi, which can help companies gain control over their employees’ data. But not all companies have the luxury or the will to use such tools.

“The case is different for Kang Hyung-wook and Min Hee-jin because the Naver Works service that Kang paid for mandates his employees to only use the messaging app for work purposes,” said Moon Eugene, a judge-turned-lawyer at Law Firm Judgemind.

“However, KakaoTalk is a private app that individuals can use as they see fit. If [HYBE] indeed restored her data to get access, then it could be held on charges of infringing her privacy. And if the company really did leak the information, as alleged by Min, then it would be difficult for HYBE to prove itself not guilty.”

Kang Hyung-wook, right, and his wife Susan Elder in a video posted on their YouTube channel BodeumTV on May 24 [SCREEN CAPTURE/JOONGANG ILBO]

Companies also need to be clearer to employees about how their personal information can be processed by the company, and messaging services also need to inform the users, according to government guidelines.

For instance, Naver Works only notifies companies that they must receive consent from all employees regarding the potential access to their data but along with the clause that Naver Works “will not take responsibility in the case of any conflict between the client and its constituent.”

The Personal Information Protection Guideline determined by the Personal Information Protection Commission and the Ministry of Employment and Labor stipulates a number of rules that may deal with this issue. The guideline goes into effect on Sept. 15.

It states that company staff should be able to decide whether or not to agree to the privacy terms freely; given clear and specific details of the terms; have the details explained in understandable language; and given the opportunity to explicitly express their consent.

“When gaining consent from information holders on processing their personal information, the information holders must be able to make their decision freely according to their own beliefs,” reads the latest amendment to the guideline, published last December.

“Denying them the provision of services or products if users do not consent cannot be deemed as giving users the right to freely choose according to their beliefs."

BY YOON SO-YEON [yoon.soyeon@joongang.co.kr]