Korea demands years of Google records over sex-crime victim data exposure

The Korean government said Friday it is reviewing Google’s potential legal liability over the exposure of sensitive personal information submitted in digital sex-crime content removal requests, while demanding that the tech firm disclose whether similar cases occurred dating back to 2018.

Gender Equality and Family Minister Won Min-kyung said the ministry, along with the Korea Media and Communications Commission, is closely examining whether Google violated laws governing the punishment of sexual crimes, telecommunications services and information-and-communications networks.

Separately on the same day, the Personal Information Protection Commission launched an investigation into the incident, requesting materials from Google to establish the facts about how the information was leaked and ended up on an external website.

This comes after the ministry found on Aug. 25 that some information submitted to Google by victims of digital sex crimes and human rights organizations seeking the removal of illegal sexual content had been posted on a third-party website, whose name was not disclosed over privacy issues. The information contained sensitive personal details such as victims’ names, workplaces and contact information.

“This is a serious matter that inflicts further harm on the victims,” Won told reporters during a briefing on the incident at Government Complex Seoul. “If violations are confirmed, Google will have to bear legal responsibility commensurate with them. I want to make this clear to Google that it is not a matter that can be lightly dismissed as a simple system error.”

She said the ministry moved immediately after learning of the incident, requesting that the company and the external website delete and block the information, and seeking emergency action from the Korea Media and Communications Commission, which can restrict access within Korea to unlawful online content.

But it took nearly two weeks to completely block the records from the website. Officials said the third-party website had blocked all removal-request records involving Korean individuals and support organizations from around 1 a.m. on Sept. 7.

The exact number of victims remains unclear. About 20 removal-request records contained information that could potentially identify victims, officials said, but that figure does not necessarily represent 20 victims because some links and URLs were duplicated.

Officials said they would communicate with affected victims to assess the extent of harm and determine whether additional documents or evidence are needed. The ministry plans to provide legal assistance, counseling and psychological support if victims ask for it, they said.

According to the ministry, it obtained an official letter from Google on Wednesday containing the company’s written assurance that it would not share externally any materials related to all future takedown requests submitted from Korea.

“Platforms like Google, which wield enormous influence around the world, bear an even greater responsibility to protect victims’ sensitive information and handle it securely,” Won said. She added that if a similar incident occurs again despite that assurance, she believes it could “face even greater liability.”

The ministry said it would closely monitor whether Google puts in place and follows through with effective measures to prevent a recurrence.