CONTENTS
- 1. The Client Who Sought Assistance Regarding a Violation of the Personal Information Protection Act
- - What Is a Violation of the Personal Information Protection Act?
- - How to Respond Alone to a Violation of the Personal Information Protection Act?
- 2. Establishing a Defense Strategy for the Charge of Violating the Personal Information Protection Act
- - Does an Unidentified Seller of Personal Information Qualify as a Personal Information Controller?
- - Did the Recipient Accept the Provision Despite Knowing the Circumstances?
- 3. Non-Referral Decision Despite the Charge of Violating the Personal Information Protection Act
1. The Client Who Sought Assistance Regarding a Violation of the Personal Information Protection Act
This is the story of a client who requested assistance for a violation of the Personal Information Protection Act.
The alleged facts of the violation of the Personal Information Protection Act in which the clients were involved are as follows.
A person who processes or has processed personal information must not divulge personal information learned in the course of duties or provide it for use by another person without authority, and must not receive personal information for a profit-making or improper purpose while being aware of such circumstances.
Nevertheless, the clients received, from a person selling personal information over the internet, a file containing the personal information of an unspecified number of people, including names and mobile phone numbers.
They conspired to use this in illegal advertising for the community they operated.
Daeryun criminal law attorneys, who have experience with numerous cases involving the Personal Information Protection Act, formed a TF team and undertook a detailed response to the case.
What Is a Violation of the Personal Information Protection Act?
🔗Violation of the Personal Information Protection Act means a case in which a personal information controller violates the standards set by law when processing personal information.
Under this Act, a person who processes personal information (such as a business operator or institution) must not, without authorization, disclose to an outside party personal information learned in the course of business or provide it so that another person may use it without legitimate authority.
Also, receiving such personal information for a commercial or wrongful purpose is strictly prohibited.
Any of the following persons shall be punished by imprisonment for not more than 5 years or a fine of not more than 50 million won.
A person who, in violation of the following, discloses personal information learned in the course of business or provides it so that another person may use it without authority, and a person who receives personal information for a commercial or wrongful purpose while knowing of such circumstances
1. The act of acquiring personal information or obtaining consent concerning its processing by false or other wrongful means or methods
2. The act of disclosing personal information learned in the course of business or providing it so that another person may use it without authority
3. The act of using, damaging, destroying, altering, forging, or leaking another person's personal information without legitimate authority or in excess of permitted authority
How to Respond Alone to a Violation of the Personal Information Protection Act?
When being investigated on a charge of violating the Personal Information Protection Act, it is important to explain the facts accurately to the investigative agency and to clearly state that one was unaware of the illegality.
Recording as much as possible the source of the personal information and the circumstances of the provider, and submitting supporting materials, helps with the defense.
However, because legal review is needed from the early stage of the investigation, there may be limits to responding alone.
2. Establishing a Defense Strategy for the Charge of Violating the Personal Information Protection Act
The firm undertook to establish a defense strategy for the client charged with a violation of the Personal Information Protection Act.
Daeryun criminal law attorneys acknowledged the basic facts but focused on the following issues.
-Whether the clients' merely having received the personal information file alone constitutes a violation of the Personal Information Protection Act
Does an Unidentified Seller of Personal Information Qualify as a Personal Information Controller?
For the crime under Article 71, subparagraph 9 of the Personal Information Protection Act to be recognized against the clients, the following requirements must be satisfied.
▲The person who provided the personal information must be a person who processes or has processed personal information
▲It must be recognized that the person received the personal information 'while being aware' of the circumstance that it was provided by a person who divulged personal information learned in the course of business or provided it for use by another person without authority
The criminal law specialist attorney argued that strict proof must be made as to whether the 'unidentified personal information seller' who provided the personal information to the clients was, beyond merely a person holding a large volume of illegally distributed personal information files, a person who processes personal information 'in the course of business.'
The attorney emphasized that, in the absence of clear evidence on this point, the unidentified personal information seller could not be deemed a 'personal information controller' merely on the ground that the seller distributed personal information files.
Did the Recipient Accept the Provision Despite Knowing the Circumstances?
In order to qualify as a ‘recipient’ punishable under Article 71, subparagraph 9 of the Personal Information Protection Act, a person must receive the information while aware of the circumstance that it had been disclosed by someone who came to know the personal information in the course of duties, or that it was provided for another's use without authority.
However, the clients only knew that the personal information had been leaked from somewhere, and they knew nothing whatsoever about the source of the file or who provided it.
① Whether, at the prior stage, the information was ‘personal information acquired by a personal information controller through false or unlawful means’
② Whether there was any illegality in the process of obtaining consent for that personal information
the court held that, if a person did not specifically know matters such as the above, the recipient cannot be punished merely on the ground that there was no consent from the data subject.
This is because, even if the clients knew that there was no consent from the data subject regarding their purchase of the personal information, it is difficult to find that they specifically knew the circumstances above if they did not know the source of the personal information or the course of its distribution.
3. Non-Referral Decision Despite the Charge of Violating the Personal Information Protection Act
The clients who requested help regarding the violation of the Personal Information Protection Act received a non-referral decision and successfully concluded the case.
The police accepted the opinion of the Daeryun attorney and issued a non-referral decision, finding that there was no evidence to conclude that the clients had received the personal information with sufficient awareness of the unlawful course of its distribution or the fact of its unlawful acquisition.
A violation of the Personal Information Protection Act is a serious crime that goes beyond a matter of mere spam advertising or unauthorized promotion and may lead to criminal punishment where it is recognized as the purchase and use of personal information for a commercial purpose.
Therefore, in a case involving a violation of the Personal Information Protection Act, it is advisable to receive the help of an attorney with extensive experience in criminal cases from the early stage of the investigation.
Please trust and entrust your case to Daeryun Law Firm, with its prompt response by a task force dedicated solely to the client and its record of resolving numerous Personal Information Protection Act cases.
This content is based on actual case studies of Daeryun Law LLC with some adaptations, and the copyright belongs to our firm.
Unauthorized reproduction, duplication, or distribution and other copyright infringements may result in legal action under applicable laws.
