Information Restriction

Institutions and practices that restrict the disclosure of certain information in the public and private sectors through laws, contracts, and technical means

Information Restriction

Overview

Information restriction (情報制限) refers to any and all acts by which administrative agencies, corporations, research institutions, and similar entities withhold some of the information they hold from disclosure, or narrow the scope of access to it, through statutes, contracts, or technical measures. The core issue is finding an institutional balance point where interests worth protecting—such as national security, personal information, trade secrets, and the fairness of investigations and trials—collide with the public's right to know and freedom of expression. In recent years, the collection of training data for generative AI and the spread of deepfakes have rapidly expanded both the targets and the means of restriction.

Key Details

Concept and Scope

Information restriction is largely divided into three layers. First, statutory non-disclosure, in which state agencies refuse disclosure on a legal basis; second, contractual restriction, in which the scope of sharing is set by contract or internal regulation; and third, technical restriction, such as encryption, access control, and masking. Restriction takes the form not only of full non-disclosure but also of partial disclosure (redaction) that conceals only specific fields such as names, addresses, or amounts.

Legal Basis and Principles

Article 9 of Korea's Official Information Disclosure Act enumerates the information subject to non-disclosure. These include information prescribed as confidential or non-disclosable by other statutes; information concerning national security, defense, unification, and diplomacy; information that would significantly obstruct the protection of the lives, bodies, or property of the people; information concerning ongoing trials or investigations; internal review information from audit and decision-making processes; personal information; trade secrets of corporations and organizations; and information raising concerns of real estate speculation or hoarding. Because non-disclosure constitutes an exception, the consistent position of Supreme Court precedent is that it must be interpreted strictly. Administrative agencies must present specific reasons when making a non-disclosure decision, and relief procedures exist through information disclosure review committees and administrative appeals and litigation.

Main Means

Masking and pseudonymization: De-identifying resident registration numbers, contact details, faces, voices, and the like.
Classification levels: Assigning document classifications such as confidential, restricted, internal, and public to differentiate access privileges.
Non-disclosure agreements (NDAs): Restricting the scope of use by the recipient of information in employment, investment, M&A, and joint research contexts.
Embargoes: Reducing information gaps among stakeholders by agreeing on publication timing in advance.
Deletion and blocking requests: Demanding that platforms remove posts on grounds such as defamation, copyright infringement, or illegally filmed material.

Personal Information Protection

The Personal Information Protection Act and the GDPR prescribe purpose limitation, minimum collection, and the data subject's rights to access, rectification, and erasure. Pseudonymized and anonymized information, by contrast, may be used for statistical and research purposes, making the drawing of boundaries between restriction and utilization a point of contention.

Restrictions in Journalism and Research

Source protection, conditions attached to the provision of materials, and protection of public-interest whistleblowers are representative issues surrounding journalists' access to information. In the research field, the scope of disclosure of clinical trial raw data, genomic data, and national R&D outputs is under discussion.

Recent Trends

The changes of 2024–2025 fall broadly into three strands. First, restrictions on access to AI training data have gathered pace. As major news organizations and platforms introduce crawler blocking (robots.txt) and licensing agreements, and copyright disputes such as The New York Times v. OpenAI continue, the terms of data use are being reorganized. Second, there is the institutionalization of regulation. The EU AI Act took effect in 2024 and is being applied in stages from 2025, imposing transparency obligations such as the publication of summaries of training data, and Korea likewise passed the AI Framework Act (Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation of Trust) in 2025, introducing transparency and risk-management obligations for high-impact AI. Third, there is the political realignment of disclosure and restriction. In the United States, additional documents related to the assassinations of Kennedy and King were released, and in various countries the number of information disclosure requests and lawsuits over non-disclosure decisions is rising. In addition, debate is expanding over regulation of deepfakes and synthetic content, blocking of harmful information for minors, and platform self-regulation versus government request powers.