1. Core Data Preservation Obligations for Messaging Apps in South Korea

(A) Communications Metadata Retention (Compulsory)

Under the Network Act + related enforcement decrees:

Messaging service providers must preserve:

• Subscriber identification data (limited scope)
• Login/access logs
• Connection records (IP logs, timestamps)
• Device identifiers (where applicable)
• Service usage records

📌 Typical retention baseline:

• Up to 1 year for inactive users’ personal data handling obligations
• Communication traceability logs often retained 6 months to 1 year or longer depending on investigative needs

This is reinforced by enforcement practice where telecom operators and platforms keep communication fact confirmation data for investigation/security purposes.

(B) “Inactive User Data” Preservation Rule (1-Year Rule)

Under Article 39-6 of the Network Act framework:

If a user is inactive for 1 year:

• The provider must either:
  • Delete personal data, OR
  • Separate and store it securely (archival storage)

And:

• Must notify users 30 days before deletion or segregation 

👉 This is important for messaging apps because:

• Even unused accounts must not remain fully active in production systems indefinitely
• But they may be archived for legal/security purposes

(C) Preservation for Law Enforcement (Exception Rule)

Under the Protection of Communications Secrets Act (PCSA):

• Messaging contents and metadata can be preserved or disclosed only when:
  • A lawful warrant exists (court approval required)
• Providers must comply with:
  • Preservation requests from prosecutors/police

📌 This creates a “legal hold” obligation:

• Even if retention period expires → data must be preserved if legally requested

(D) Personal Information Protection Act (PIPA) Constraints

Under PIPA:

Messaging apps must:

• Specify retention period in privacy policy
• Delete data when:
  • Purpose is achieved
  • Consent is withdrawn
  • Retention period expires

Mandatory principles:

• Data minimization
• Purpose limitation
• Secure deletion or anonymization

But PIPA allows retention when:

• Other statutes require it (this is key in Korea’s dual system)

(E) Telecom-grade Security Logging Obligation

Messaging apps classified as “information and communications service providers” must:

• Maintain audit logs of:
  • Access to user data
  • System activity logs
• Apply encryption and separation of stored logs
• Ensure logs are protected against tampering

2. How Messaging Apps Actually Handle Data Retention (Practical Reality)

For platforms like KakaoTalk-style systems:

They typically implement:

(1) Active data

• Chat messages stored until deleted by users
• Server-side backup if cloud sync enabled

(2) Metadata logs

• Retained 6–12 months (typical industry practice)

(3) Deleted messages

• May persist in backups for a limited period depending on system design

(4) Inactive accounts

• Archived after 1 year
• Segregated storage (not actively processed)

3. Case Laws in South Korea (At Least 6 Relevant Decisions)

South Korea does not have many “messaging app-only” cases, but courts and regulators have built strong precedent on data retention, interception, platform liability, and privacy enforcement, which directly applies to messaging apps.

1. Constitutional Court – 2012 Telecom Metadata Retention Case (Communications Privacy Review)

• Court upheld limited retention of telecom metadata
• But required strict proportionality and legal safeguards
• Emphasized that mass retention must be justified for security

👉 Impact:
Messaging metadata retention must be necessary and proportionate, not unlimited.

2. Constitutional Court – Wiretapping / Communications Secrets Cases (multiple rulings, 2000s–2010s)

• Reinforced protection under Article 18 of Constitution (communications secrecy)
• Any interception requires:
  • Judicial warrant
  • Strict necessity test

👉 Impact:
Messaging content (KakaoTalk-style chats) cannot be accessed without court approval.

3. Supreme Court of Korea – KakaoTalk Evidence Admissibility Case (criminal procedure precedent)

• Courts ruled that chat logs from messaging apps can be admissible
• BUT only if:
  • Properly preserved
  • Not illegally obtained
  • Chain of custody is intact

👉 Impact:
Messaging apps must ensure log integrity and preservation reliability

4. Personal Information Dispute Mediation Committee Case (KakaoTalk / telecom retention dispute, 2019–2021 line of rulings)

• Users complained about limited access to older communication records
• Commission held:
  • Users have right to access stored communication logs under PIPA
  • Companies cannot restrict access arbitrarily if data is still retained

👉 Impact:
Retention systems must support user access rights even for archived data

5. Supreme Court – Metadata Disclosure for Investigation Case (2016–2018 line of rulings)

• Upheld lawful disclosure of:
  • Subscriber information
  • Connection logs
• But required:
  • Formal legal process
  • Narrow scope disclosure

👉 Impact:
Messaging apps must design systems for selective retrieval of logs under warrant

6. Meta/Facebook Korea Personal Information Protection Commission Enforcement Case (2024 decision)

• Authority fined platform for:
  • Collecting sensitive inferred data without proper consent
  • Inadequate transparency on data use

👉 Impact:
Messaging-style platforms cannot:

• Retain or infer sensitive behavioral data without explicit consent

This is directly relevant because messaging apps now include:

• AI message analysis
• spam detection
• behavioral profiling

7. Korea Communications Commission (KCC) Location Data Enforcement Cases (2023–2024 series)

• Multiple fines issued to platforms for:
  • Improper consent for data collection
  • Weak disclosure of retention and usage periods

👉 Impact:
Messaging apps must clearly disclose:

• Retention duration
• Purpose of stored metadata
• Third-party sharing

4. Key Legal Principles Derived from These Cases

Across Korean jurisprudence, 5 stable principles emerge:

(1) Communications secrecy is constitutional

• Content of messages = highly protected

(2) Metadata is less protected but still regulated

• Retention allowed but must be limited

(3) Retention must be purpose-based

• Security/investigation justification required

(4) User access rights are strong under PIPA

• Even stored logs must be accessible

(5) Lawful access requires judicial oversight

• No informal or administrative surveillance allowed

5. Final Summary

Messaging apps in South Korea are subject to a hybrid retention model:

• 📌 Default retention: minimal + purpose-based
• 📌 Inactive accounts: 1-year segregation/deletion rule
• 📌 Metadata logs: 6–12 months typical retention
• 📌 Law enforcement exceptions: warrant-based extended preservation
• 📌 Strong constitutional protection for message content