Violation of the Personal Information Protection Act | Card Company W, Which Used Merchants' Personal Information Without Authorization, Faces a Penalty Surcharge of 13.4 Billion Won

Card Company W was subject to a penalty surcharge for a violation of the Personal Information Protection Act.

In April 2024, the Personal Information Protection Commission opened an investigation after a media report that Card Company W was using the personal information of merchant representatives (hereinafter "merchants") to solicit new card subscriptions.

The investigation found that Company W had used merchants' personal information, without their consent, for marketing aimed at issuing new credit cards, and that an employee of Company W's Incheon Sales Center had passed this information to card solicitors.

To increase its sales performance, Company W's Incheon Sales Center entered merchants' business registration numbers into the merchant management program from July 2022 to April 2024 and thereby looked up the personal information (name, resident registration number, mobile phone number, address, and the like) of at least 131,862 merchants.

In addition, after entering merchants' resident registration numbers into the card-issuance review program, it checked whether each merchant held a Company W credit card and recorded that information on printouts or photographed it and shared it in a KakaoTalk group chat in which card solicitors and others participated.

In particular, beginning in September 2023, it used a data-query command in the database (DB) holding the personal information of merchants and cardholders to look up merchants' personal information and whether they held cards, generated the results as files, and, on 100 occasions from January 8 to April 2, 2024, transmitted the personal information of 75,676 individuals to card solicitors by email.

In this way, the personal information of at least 207,538 merchants was looked up and transmitted to card solicitors, and that information was used for Company W card-issuance marketing.

However, 74,692 of these merchants had given no consent of any kind to such use for marketing.

For Company W's 🔗violation of the Personal Information Protection Act, the Personal Information Protection Commission imposed a total penalty surcharge of 13,451,000,000 won and issued corrective orders, including measures to strengthen internal controls to prevent the misuse and abuse of personal information, to comply with safety obligations such as minimizing and reviewing access privileges, and to strengthen the management and supervision of personal-information handlers.

In response, Company W stated that it would organize employees' access privileges to internal terminal systems and establish a management system requiring approval from the information protection department before any external email transmission.

It also appears that, to prevent the recurrence of similar cases, the company will strengthen internal controls, including employee training and ongoing review of its information protection systems.

The Commission emphasized that "even where consent is obtained at the time personal information is initially collected, processing personal information beyond the scope of that consent is unlawful," and that it is necessary to periodically check whether handlers' privileges are properly granted and managed and whether any unlawful lookups have occurred.

This was the first time the Commission had imposed a penalty surcharge on a card company.

The Commission added that it would review the response plan submitted within 90 days of the formal notice of the corrective order to the card company and would consider whether the matter would lead to the imposition of an administrative fine and a criminal accusation.

As this shows, a violation of the Personal Information Protection Act may result in a penalty surcharge ranging from hundreds of millions to tens of billions of won, and if the violation is intentional or repeated, it may lead to criminal punishment.

In addition, because a party may face not only an administrative disposition but also a civil claim for damages, a criminal accusation, and an order to make the matter public, it is most important to respond from the early stages of a case with the help of an experienced attorney.

This disposition against Company W was a case showing that processing personal information beyond the purpose for which it was collected and used is a clear violation of the law.

It is also a case showing that an organization should maintain a sound internal control system, periodically reviewing the access privileges of personal-information handlers such as employees and checking access logs to confirm that no unnecessary lookups or uses of personal information have occurred.

At Daeryun Law Firm LLP, attorneys experienced in numerous related cases form teams to develop response strategies for personal-information breach incidents.

The firm also provides assistance in designing personal-information protection organizations and procedures, designing internal audit processes and review items, and establishing support systems for the chief privacy officer, in order to build a corporate personal-information compliance framework.