Violation of the Personal Information Protection Act

Personal information is defined under the statutes as information relating to a living individual, and refers to information falling under any one of the following.

| Information by which an individual can be identified, such as a name, resident registration number, or image

| Information by which a specific individual cannot be identified on its own but can be identified when combined with other information

| Pseudonymized information by which an individual cannot be identified without additional information

Acquiring personal information or obtaining consent regarding its processing by false or improper means, and divulging personal information learned in the course of duties or providing it for use by another person without authority, constitute violations of the Personal Information Protection Act.

In addition, any act of damaging, altering, falsifying, or leaking another person's personal information without proper authority or in excess of the permitted authority constitutes a violation of the Personal Information Protection Act, and may be strictly punished.

Types falling under Article 71 of the Personal Information Protection Act

① A person who provides personal information to a third party without the consent of the data subject, and a person who receives such personal information knowing of that fact

② A person who uses personal information or provides it to a third party, and a person who, knowing of that fact, receives such personal information for profit-making or improper purposes

③ A person who processes the personal information of a child under 14 years of age without the consent of the legal representative

④ A person who processes sensitive information or unique identifying information

⑤ An institution that has combined pseudonymized information without being designated as a specialized institution by the Protection Commission or the head of the relevant central administrative agency

⑥ A person who takes combined information outside the institution that performed the combination without the approval of the head of the specialized institution, or provides it to a third party, and a person who, knowing of that fact, receives the combined information for profit-making or improper purposes

⑦ A person who processes pseudonymized information for the purpose of identifying a specific individual

⑧ A person who divulges personal information learned in the course of duties or provides it for use by another person without authority, and a person who, knowing of that fact, receives such personal information for profit-making or improper purposes

⑨ A person who uses, damages, destroys, alters, falsifies, or leaks another person's personal information

Types falling under Article 72 of the Personal Information Protection Act

① A person who arbitrarily manipulates a fixed-type video information processing device for a purpose other than the purpose for which it was installed, points it at another location, or uses its recording function

② A person who acquires personal information or obtains consent regarding the processing of personal information by false or other improper means or methods, and a person who, knowing of that circumstance, receives personal information for profit-making or improper purposes

③ A person who divulges a secret learned in the course of duties or uses it for a purpose other than the performance of duties

Even as a witness, there is a possibility of being converted to a suspect depending on the content of your statement.

Because it is difficult to determine clearly whether the matter is a simple confirmation of facts or whether the investigative agency suspects an offense, you should understand the scope and purpose of the statement precisely and make your statement carefully.

Speculative remarks or conclusive expressions may invite an unfavorable inference, so it is advisable to avoid them.

In the early stage of an investigation, evidence may be limited, so you should refrain from hastily admitting the charges.

It is advisable to organize the facts thoroughly and, if the violation is clear, to admit the charge and attempt a settlement with the victim.

A settlement with the victim can help lower the level of punishment, and genuine remorse and efforts to recover the harm are important.

In addition to this, it is necessary to review the sentencing guidelines and prepare a response suited to your situation.

In the course of the trial, the evidence and statements secured during the investigation stage have a significant influence.

It is recommended to maintain a consistent position from the outset and to submit a letter of remorse or a petition to the investigative agency and the court, acknowledging one's wrongdoing and seeking leniency.

You should respond faithfully to the investigative agency's questioning, clearly explain your position, and, if there is a misunderstanding, actively present the relevant evidence.

Even with the status of a witness, there is a possibility of being reclassified as a suspect depending on the content of your statement.

Because it is difficult to determine clearly whether the matter is a simple confirmation of facts or whether the investigative authority suspects an allegation, you should accurately understand the scope and purpose of your statement and proceed with care.

Speculative remarks or conclusory expressions may invite unfavorable inferences, so it is best to avoid them.

※ Korea Internet & Security Agency Personal Information Infringement Report Center 118

Online filing is the general rule / fax and postal mail are also accepted

A report requires a precise description of the facts of the personal information infringement and the submission of supporting evidence.

As a general rule, the processing of a personal information infringement report is to be completed within 60 days from the date of receipt.

Report Processing Procedure

① Case Assignment

Once a personal information infringement report is received, the case is assigned to an investigator at the report center.

If the matter does not fall under the center's jurisdiction, the relevant agency is identified, and where civil dispute resolution is needed, the matter is referred to the Dispute Mediation Committee.

② Fact-Finding Investigation

The investigator may request the submission of materials from the respondent (public institution, corporation, organization, individual, etc.) or conduct an on-site investigation to ascertain the facts.

③ Corrective Recommendation

If a violation is confirmed, a recommendation for voluntary corrective measures may be issued to the respondent.

④ Notification Of Results

Once the fact-finding investigation is complete, the investigator notifies the reporting party of the investigation results and the measures taken, and closes the case.

If you have suffered harm from a violation of the Personal Information Protection Act, you may seek to have the perpetrator punished through a criminal complaint.

A criminal complaint should specify the following.

- Information on the complainant and the accused

- Details of the leaked personal information

- Circumstances of the leak

- Grounds for the complaint

If you suffer harm as a result of a personal information controller's violation of the Personal Information Protection Act, you may claim damages from the controller.

Where personal information is lost, stolen, leaked, forged, altered, or damaged due to the intent or negligence of the personal information controller, you may claim damages within a range of up to 3 million won, with a reasonable amount set as the amount of loss.

A person whose rights or interests have been infringed by an unlawful or unjust disposition or omission by an administrative agency concerning the processing of personal information may file an administrative appeal or administrative litigation, as provided by the "Administrative Appeals Act" and the "Administrative Litigation Act."

Daeryun Law Firm has formed a dedicated TF composed of criminal attorneys who have handled numerous cases involving violations of the Personal Information Protection Act, as well as civil attorneys and administrative attorneys assigned according to the nature of the case.

The attorneys in each field cooperate closely to develop a response strategy suited to the circumstances, and work diligently to protect the client's rights and to resolve the matter smoothly.

A case involving a violation of the Personal Information Protection Act may extend beyond criminal punishment to administrative and civil issues, so when it is difficult to respond alone, seeking the help of legal counsel can be a sound approach.

If you are facing difficulties in responding to a case involving a violation of the Personal Information Protection Act, 🔗scheduling a legal consultation with a criminal attorney is available, and you are welcome to request a consultation.