Among them, parts against Defendant A, B, C, and D shall be reversed, respectively.

Defendant

A, Defendant, and Defendant, respectively, shall be punished by imprisonment for up to two years and four months.

A. Defendant A1 is merely an employee of Defendant B, D, C, and M of the instant crime of fraud, and thus does not constitute “third party” under Article 71 subparag. 1 and Article 17(1) of the Personal Information Protection Act. Therefore, among the facts charged against Defendant A, the violation of each of the Personal Information Protection Act regarding the provision of personal information to Defendant B, D, C, and M does not constitute a violation of each of the Personal Information Protection Act, but the lower court found Defendant A guilty of each of the facts charged, thereby adversely affecting the conclusion of the judgment by misapprehending the legal doctrine on the provision of personal information to a third party. 2) The imprisonment (two years and six months) sentenced by the lower court is too unreasonable.

B. The sentence (Defendant B, C: one year and six months of imprisonment, three years of probation, 120 hours of community service, Defendant D, E, one year of probation, two years of probation, and 80 hours of community service) that the lower court sentenced by the prosecutor is too unfasible and unfair.

2. Judgment on Defendant A’s assertion of misapprehension of the legal principle

A. Article 2 Subparag. 5 of the Personal Information Protection Act provides that “A public institution, corporation, organization, individual, etc. that processes personal information directly or through another person to operate a personal information file for the purpose of his/her duties” (Article 2 Subparag. 5) provides that “A personal information manager may provide the personal information to a third party in cases where the consent of the subject of information is obtained from the subject of information” (Article 17(1)); and “when a personal information manager obtains consent from the subject of information pursuant to Article 17(1)1, he/she shall notify the subject of information of the subject of

(Article 17(2)2). On the other hand, when a personal information manager entrusts a third party with the management of personal information, the personal information manager shall not perform the entrusted duties.