CONTENTS
- 1. Overview of the Violation of the Personal Information Protection Act Case
- - Violation of the Personal Information Protection Act, the Lower Court's Determination
- 2. Violation of the Personal Information Protection Act, the Supreme Court's Determination
- 3. Violation of the Personal Information Protection Act, Daeryun's Strategy
1. Overview of the Violation of the Personal Information Protection Act Case
The defendants decided to obtain personal information about customers whose internet service subscriptions were nearing expiration, to contact those customers by telephone and encourage them to subscribe to other internet service businesses, to promote such businesses, or to transfer the personal information to other operators.
Defendant 1 received personal information from Non-Indicted Party 3 and an unidentified person, Defendant 2 from Non-Indicted Party 1, and Defendant 3 from Non-Indicted Party 2, in each case without the consent of the customers.
Accordingly, the defendants were indicted for violating the former Personal Information Protection Act (with the Information and Communications Network Act as a preliminary charge in part).
Violation of the Personal Information Protection Act, the Lower Court's Determination
Under Article 59, Item 1 of the former Personal Information Protection Act (the Act prior to its amendment on February 4, 2020), a person who is processing or has processed personal information may not obtain personal information, or obtain consent to its processing, by false or other unlawful means or methods.
In the case of a violation of the former Personal Information Protection Act, a person who obtains personal information or obtains consent to the processing of personal information by false or other unlawful means or methods, as well as a person who, knowing such circumstances, receives personal information for profit or for an unlawful purpose, is subject to imprisonment for up to five years or a fine of up to 50 million won.
The Seoul Central District Court, which heard the lower-court proceedings, found that the relevant charges had not been proven and, for the reasons set out below, rendered an acquittal as to ‘the principal and first preliminary charges concerning Defendant 1's receipt of personal information, Defendant 2's receipt of personal information from Non-Indicted Party 1, and Defendant 3's receipt of personal information from Non-Indicted Party 2.’
- The ‘false or other unlawful means or methods’ provided for in the former Personal Information Protection Act refer to any act of deception or other means recognized as unlawful under sound social norms that is used to obtain personal information or to obtain consent to its processing.(See Supreme Court, Decision of April 7, 2017, 2016 Do 13263)
- Such an act includes not only active or passive acts that may affect the decision-making of the data subject or the holder of the personal information, but also acts that, like hacking, are in themselves recognized as unlawful methods under sound social norms regardless of the data subject's decision-making.
- Because the former Personal Information Protection Act distinguishes between a ‘person who obtains’ in the first clause and a ‘person who receives’ in the second clause, the mere fact of receiving personal information while aware that it was being circulated without the consent of the data subject makes it difficult to find that the information was obtained by ‘false or other unlawful means or methods.’
- However, where a person who receives personal information does so while aware of ‘the circumstance that the person processing or who has processed the personal information obtained it, or obtained consent to its processing, by false or other unlawful means or methods,’ that falls under the second clause.
2. Violation of the Personal Information Protection Act, the Supreme Court's Determination
The prosecutor immediately filed a final appeal against the portion for which the defendants were acquitted, but the Supreme Court's view was likewise the same as that of the lower court.
The Supreme Court dismissed all of the final appeals concerning the violation of the Personal Information Protection Act for the following reasons.
- According to the reasoning of the lower judgment and the record, the defendants, for telemarketing purposes, purchased a large volume of personal information for value on several occasions from the non-indicted parties who sold personal information, without verifying its source; however, it cannot be found that such conduct affected the decision-making of the non-indicted parties and others by an unlawful method under sound social norms.
- Nor can this be regarded as a method that, like hacking, is in itself deceptive or otherwise unlawful under sound social norms.
- Although the defendants were aware that the personal information they purchased lacked the consent of the data subjects, it is difficult to find that they were aware of the circumstance that it was personal information obtained by an unlawful method.
3. Violation of the Personal Information Protection Act, Daeryun's Strategy
In this case, the conduct did not fall under either the first or second clause of Article 72 (Penalty Provisions), Item 2 of the former Personal Information Protection Act, and the court found that the above error of the lower court had no effect on the judgment.
Drawing on a broad range of accumulated experience in matters involving violations of the Personal Information Protection Act, Daeryun provides wide-ranging legal advice on responding to on-site personal information protection inspections, consulting on the risk of personal information breaches, resolving disputes related to hacking, and addressing the criminal punishment of violations of the Personal Information Protection Act.
If you have any questions regarding a violation of the Personal Information Protection Act, you are welcome to contact the relevant member by telephone at any time.
