A. In providing health examination services at a discount price to the new union members in accordance with the designated hospital alliance agreement concluded between the Korea Credit Union (F) and the Incorporated Foundation F (F), only the FF on the grounds of time and expenses, etc. regarding health examination notice to be sent by the new union members, and Defendant A, the president of the new union, provided only the name and address of the union members through E for the limited purpose of sending the above notice in lieu of time and expenses. As such, the F is not in the position of the trustee of the business of sending the new consultation notice, and the Defendants’ above acts are not in the position of a third party who received personal information, and are not in the position of the trustee of the business of sending the new consultation notice, and are not in violation of social rules, and thus illegal.

B. The sentencing of each of the first instance judgments on the Defendants on the unreasonable sentencing (a fine of three million won is too unreasonable).

2. Determination

A. Comprehensively taking account of the evidence duly adopted and examined by the first instance court as to the assertion of mistake of facts and misapprehension of legal principles, the following facts can be acknowledged: ① entering into an agreement on the business of a designated hospital between the new cooperative and F on July 2013, and the two agencies’ duty to maintain confidentiality regarding personal information under Article 7 of the above Convention. However, the fact that the new cooperative did not obtain any consent from individual members of the data subject regarding the provision of personal information, such as the name and address of the association members to F; ② Furthermore, the new cooperative, as a welfare project under its articles of incorporation, did not provide a specific third party or new cooperative with personal information, such as name and address, or a third party designated or agreed upon in relation to the health examination service; and further, it did not follow any consent procedure on whether the management of personal information related thereto is entrusted.