Violation of the Personal Information Protection Act | Criminal Attorney Obtains Non-Referral on a Charge of Unlawful Use of Personal Information

🔗Violation of the Personal Information Protection Act means a case in which a personal information controller violates the standards set by law when processing personal information.

Under this Act, a person who processes personal information (such as a business operator or institution) must not, without authorization, disclose to an outside party personal information learned in the course of business or provide it so that another person may use it without legitimate authority.

Also, receiving such personal information for a commercial or wrongful purpose is strictly prohibited.

When being investigated on a charge of violating the Personal Information Protection Act, it is important to explain the facts accurately to the investigative agency and to clearly state that one was unaware of the illegality.

Recording as much as possible the source of the personal information and the circumstances of the provider, and submitting supporting materials, helps with the defense.

However, because legal review is needed from the early stage of the investigation, there may be limits to responding alone.

For the crime under Article 71, subparagraph 9 of the Personal Information Protection Act to be recognized against the clients, the following requirements must be satisfied.

▲The person who provided the personal information must be a person who processes or has processed personal information
▲It must be recognized that the person received the personal information 'while being aware' of the circumstance that it was provided by a person who divulged personal information learned in the course of business or provided it for use by another person without authority

The criminal law specialist attorney argued that strict proof must be made as to whether the 'unidentified personal information seller' who provided the personal information to the clients was, beyond merely a person holding a large volume of illegally distributed personal information files, a person who processes personal information 'in the course of business.'

The attorney emphasized that, in the absence of clear evidence on this point, the unidentified personal information seller could not be deemed a 'personal information controller' merely on the ground that the seller distributed personal information files.

In order to qualify as a ‘recipient’ punishable under Article 71, subparagraph 9 of the Personal Information Protection Act, a person must receive the information while aware of the circumstance that it had been disclosed by someone who came to know the personal information in the course of duties, or that it was provided for another's use without authority.

However, the clients only knew that the personal information had been leaked from somewhere, and they knew nothing whatsoever about the source of the file or who provided it.