[2] In a case where Company A, a provider of information and communications services under the former Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., deemed to have consented to “verification” without providing information on items, purposes, and holding period through an open market and pop-up advertising shop, the Korea Communications Commission collected user personal information without explicit consent and provided it to insurance companies, etc., the case affirming the judgment below holding that Company A did not obtain lawful consent from users necessary for collecting user personal information through the event screen and providing it to the third party

[2] In a case where Company A, a provider of information and communications services under the former Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (amended by Act No. 11690, Mar. 23, 2013; hereinafter “Information and Communications Network Act”), took corrective measures, etc. against Company A on the ground that: (a) collecting user’s personal information without explicit consent and providing it to insurance companies; and (b) the Korea Communications Commission’s act of posting the statutory notice at the bottom of the e-mail screen cannot be deemed as clearly providing the statutory information; (c) the mere fact that the Plaintiff installed a screen tower on the e-mail screen does not have the consent of collecting, using, and providing third parties with personal information; and (d) it cannot be deemed that the e-mail user’s consent to collecting personal information can be easily determined on the e-mail screen; and (d) it cannot be deemed that the e-mail user’s consent to the provision of personal information can be easily determined on the e-mail screen.

1. As to whether the Plaintiff’s consent should be obtained from the user in collecting and providing personal information (ground of appeal No. 8)

A. Whether the Plaintiff constitutes a provider of information and communications services

(1) Article 2(1)3 of the former Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (amended by Act No. 11690, Mar. 23, 2013; hereinafter “Information and Communications Network Act”) provides that “information and communications service provider” refers to a telecommunications business operator under Article 2 subparag. 8 of the Telecommunications Business Act and a “person who provides or arranges the provision of information using telecommunications services by a telecommunications business operator for profit” and “user” under Article 2 subparag. 4 provides that “person who uses information and communications services provided by a provider of information and communications services.”

(2) The lower court determined that: (a) the Plaintiff constitutes a “information and communications service provider” as a person who provides or arranges to provide information on the instant event on a commercial basis using telecommunications services provided by a telecommunications business operator; and (b) the person who provided personal information by accessing the instant event screen and participating in the event constituted a “user” using information and communications services provided by the Plaintiff.

(3) Examining the reasoning of the judgment below in light of the aforementioned relevant legal provisions and records, the judgment of the court below is just and acceptable, and there is no error in the misapprehension of legal principles as to the interpretation and application of users under the Information and Communications Network Act, contrary to the allegations in

B. Whether the Plaintiff can collect and use personal information without the consent of the subject of information pursuant to Article 15(1)4 of the Personal Information Protection Act

(1) According to Article 2 subparag. 5 of the Personal Information Protection Act, which was enacted by Act No. 10465 of Mar. 29, 2011 and enforced as of Sept. 30, 2011, the lower court: (a) is a “personal information controller” who directly or via another person to manage personal information files for the purpose of his/her duties; (b) is clearly distinguishable from a “information and communications service provider,” who is a criminal of the Information and Communications Network Act; and (c) The Personal Information Protection Act clearly stipulates that “Except as otherwise expressly provided for in other Acts, such as the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., and Credit Information Use and Protection Act, regarding the protection of personal information, the consent of users of information and communications service providers is necessary, and thus, Article 22 subparag. 5 of the Information and Communications Network Act should be applied preferentially to the Plaintiff’s personal information collection and use of personal information without the consent of users of information and communications services (Article 15 subparag. 15 of the Information Protection Act).

(2) Examining the reasoning of the lower judgment in light of the relevant legal principles and records, the lower court’s determination is just and acceptable, and there is no error in the misapprehension of legal principles as to the scope of application under Article 15(1)4 of the Personal Information Protection Act, contrary to what is alleged in

2. As to the Plaintiff’s lawful consent (ground of appeal Nos. 1 through 4, and 7)

A. (1) In order to collect and use user’s personal information, the Information and Communications Network Act provides that “A provider of information and communications services shall notify users of the purpose of collecting and using personal information, items collecting personal information, and the period during which personal information is held and used” (Article 22(1)). In order to provide user’s personal information to a third party, “a provider of information and communications services shall notify users of the purpose of using personal information, items of personal information provided, and the period during which the recipient owns and uses personal information (Article 24-2(1)).” Article 26-2 of the Information and Communications Network Act provides that “The method of obtaining consent from users shall be prescribed by Presidential Decree, taking into account media for collecting personal information, characteristics of each type of business, number of users, etc.” (amended by Presidential Decree No. 24047, Aug. 17, 2012; hereinafter “Information and Communications Services Act”) and shall clearly indicate whether a provider of information and communications services shall obtain consent from users.”

In light of the language, structure, purport, etc. of the provisions of the relevant statutes, the information and communications service provider’s right to make decisions on the provision of personal information can be freely exercised by users, so that the provider of information and communications services can exercise the right to make decisions on the collection and provision of personal information in accordance with the Information and Communications Network Act, and if the provider of information and communications services ordinarily uses the pertinent website to identify the details of the statutory notice easily. In addition, the part that publishes the statutory notice and the part that can indicate the consent of the user should be closely posted and the part that can indicate whether the user consented to the collection and provision of personal information can be identified by recognizing the statutory notice, and the implementation method should be prepared so that the user can consent to the collection and provision of personal information under the clear recognition that the user should consent to the collection and provision of personal information.

(2) In an appeal litigation, the burden of proof of the legality of the pertinent disposition is, in principle, against the agency asserting the legality of the disposition. However, in a case where the agency proves that it is reasonable and acceptable to the extent of the lawfulness of the pertinent disposition asserted, the disposition is justifiable, and any assertion and proof of exceptional circumstances contrary thereto are returned to the other party’s responsibility (see Supreme Court en banc Decision 2010Du27639, 27646, Jun. 18, 2012).

B. The court below, based on its adopted evidence, found facts as stated in its reasoning. ① The Plaintiff’s display of the statutory notice at the bottom of the day of the event cannot be deemed to have clearly known and verified the statutory notice in advance; ② The Plaintiff’s installation of screen rollers on the screen of this case cannot be deemed as a form that can easily recognize and confirm the existence of the statutory notice at the bottom of the screen; ③ If the Plaintiff intended to participate in the event without any indication on the body box, which requires to indicate the consent to the collection and provision of personal information on the screen of this case, the Plaintiff’s display of a series of poppy, which alone is subject to collection and provision of personal information by itself, and it cannot be deemed that the Plaintiff consented to the collection and provision of personal information on the screen of this case, i.e., legitimate disclosure of personal information by the user of this case, i., collecting and provision of personal information by means of an information and communications network.

Furthermore, the court below held that the provider of information and communications services proved that all of the personal information collected and provided without the consent of the Plaintiff was unlawful on the premise that the provider of information and communications services should obtain explicit consent from the users whenever it collects and provides such personal information, and that in light of the composition, quantity, and storage status of the personal information of this case, the Defendant proved that it reasonably acceptable the legality of each disposition of this case related to calculation of the frequency of unlawful acts. The Plaintiff’s assertion that the provider of information and communications services calculated the number of unlawful acts with the consent of the explicit consent of the provider is not acceptable on the ground that there

C. Examining the reasoning of the judgment below in light of the relevant legal principles and records, the fact-finding and judgment of the court below are just and acceptable. Contrary to the allegations in the grounds of appeal, there were no errors by misapprehending the legal principles regarding the method of obtaining consent under the Information and Communications Network Act, by failing to exhaust all necessary deliberations or by violating the rules of evidence concerning the frequency of collection and provision of personal information without express consent of the plaintiff.

3. As to whether each of the dispositions of this case violates the principle of trust protection (ground of appeal No. 5)

A. In general, in administrative legal relations, in order to apply the principle of the protection of trust to an act of an administrative agency, first, an administrative agency should name a public opinion that is the subject of trust to an individual; second, an administrative agency's trust in the statement of opinion should not be attributable to the individual; third, the individual should have trusted and trusted the statement of opinion; third, an administrative agency should have conducted any act corresponding thereto; fourth, an administrative agency's disposition contrary to the statement of opinion should result in infringing on the individual's interest; last, when taking an administrative disposition in accordance with the statement of opinion, it should not be likely to seriously undermine the public interest or legitimate interests of a third party (see Supreme Court Decision 2004Du46, Jun. 9, 2006, etc.). In determining whether there is a public opinion statement of an administrative agency, the determination of whether there is a public opinion statement of opinion should be made by the formal authority of the administrative organization, not by the formal authority of the administrative agency, in light of the organization and duties of the person in charge, the circumstances leading in question, and the other party's trust (see Supreme Court Decision 2016.).

B. After compiling the adopted evidence, the lower court acknowledged the facts as indicated in its reasoning, and rejected the Plaintiff’s assertion that the instant disposition violates the principle of trust protection and was unlawful on the grounds that the Defendant’s person responsible for responding to the Plaintiff’s civil petition for grievance on May 11, 2010, based on the following grounds: (a) the content of the response to the Plaintiff’s civil petition for grievance can be deemed lawful if it complied with the Information and Communications Network Act as a whole; and (b) the Plaintiff’s temporary response is only based on the data unilaterally submitted by the Plaintiff; and (c) it does not constitute a public statement of the administrative agency trusted; and (d) furthermore, the “non-prosecution disposition by the Prosecutor’s Office” or “a reply to civil petition by the Seoul Local Fair Trade Office” alleged by the Plaintiff is different from each of the instant dispositions

C. Examining the reasoning of the judgment below in light of the relevant legal principles and records, the judgment of the court below is just and acceptable, and there is no error in the misapprehension of legal principles as to the principle of protection of trust.

4. As to whether each disposition of this case constitutes a deviation or abuse of discretionary power (ground of appeal No. 6)

A. Generally, whether a punitive administrative disposition deviates from or abused the scope of discretion by social norms must be determined by comparing and comparing the degree of infringement on public interest and the disadvantage suffered by an individual due to the disposition, by objectively examining the content of the act of violation as a ground for the disposition, the public interest to be achieved by the disposition, and all the relevant circumstances (see Supreme Court Decision 2012Du1297, May 10, 2012, etc.).

B. In light of the legislative intent of the Information and Communications Network Act with the aim of promoting the use of information and communications networks, protecting the personal information of a person who uses information and communications services, and contributing to the improvement of people’s lives and promoting public welfare by creating an environment in which the information and communications networks can be used in a sound and safe manner, the lower court determined that: (a) the Defendant’s corrective action was the most appropriate means for protecting the right to self-determination of personal information derived from the provision of the Constitution; and (b) other management improvement measures, etc. are inappropriate to allow the holding of the personal information illegally collected and provided; and (c) on the other hand, the public interest intended to achieve each of the dispositions of this case is very large; (c) the Plaintiff’s disadvantage is not significantly higher than that of the public interest; and (d) the Plaintiff’s unlawful act is collected, 13, 420, and 3rd parties, etc., which compared the case of the Plaintiff’s unlawful act, and thus do not constitute abuse of discretionary power.

C. Examining the reasoning of the judgment below in light of the relevant legal principles and records, the judgment of the court below is just and there is no error in the misapprehension of legal principles as to deviation and abuse of discretionary power, as alleged in the grounds of appeal.

5. Conclusion

Therefore, the appeal is dismissed, and the costs of appeal are assessed against the losing party. It is so decided as per Disposition by the assent of all participating Justices.

Justices Jo Hee-de (Presiding Justice)