The costs of appeal are assessed against the Defendants.

1. On the ground of appeal No. 1 of Defendant A, the lower court, based on its stated reasoning, held that Defendant A Co., Ltd. (hereinafter “Defendant A”) is liable to take necessary measures to ensure the safety of personal information prescribed by the aforementioned Act, Enforcement Decree, and public announcement (based on measures to ensure the safety of personal information) of the former Personal Information Protection Act (amended by Act No. 13423, Jul. 24, 2015). The lower court concluded a development service agreement with Defendant B Co., Ltd. (hereinafter “Defendant B”) on the card accident analysis system (FDS), and provided the development personnel of Defendant B with personal information of the card customer, in the process of providing the personal information to the development personnel of Defendant B, by failing to perform the duty to install and supervise security programs, to restrict access rights, to provide encrypted card customer information, and to compensate the Plaintiffs for damages caused by the divulgence of personal information.

In light of the relevant laws and records, the above determination by the court below is justifiable. Contrary to the allegations in the grounds of appeal, it did not err by exceeding the bounds of the principle of free evaluation of evidence against logical and empirical rules, or by misapprehending the legal principles on various duties of care, storage and sharing of personal information devices, proximate causal relation, establishment of liability for damages, etc. prescribed in the standards

2. As to Defendant B’s grounds of appeal Nos. 1 through 3, the lower court, on the grounds as indicated in its reasoning, did not err in the misapprehension of the legal doctrine as to Defendant B’s act of developing FDS, by divulging Defendant A’s card customer information in the course of performing the FDS development as the user of Defendant B, etc., and thus Defendant B