1. The defendants' appeal is dismissed.

2. The costs of appeal are assessed against the Defendants.

Purport of claim and appeal

(b).

1. The reasoning of the judgment of the court of first instance, excluding the part on the judgment of the court of first instance regarding "2. Judgment on the defense of this case" among the grounds of the judgment of the court of first instance, is identical to the reasoning of the judgment of the court of first instance, except where the judgment on the defendants' assertion is added in the following 2. Thus, it is acceptable to

2. Additional determination

A. As to the Defendant A’s assertion, the Defendant A asserts that Article 9 of the Criteria for Measures to Secure the Safety of Personal Information is not a provision that is not a premise on the establishment of a security program that has the function of preventing the leakage of personal information by using the USB joints (USB blocking).

However, the above provision provides that "a person who manages personal information shall install and operate a security program for white software, etc. that can prevent and treat malicious programs, etc.," and Article 6 (3) of the standards for securing the stability of personal information provides that "a person who manages personal information shall take measures in his/her personal information processing system and business computer to prevent disclosure or leakage to a person who is not authorized to peruse through the Internet homepage, P2P, sharing establishment, etc." and pursuant to Article 15 (2) and Article 28 (1) 2 of the Enforcement Decree of the Information and Communications Network Act, a provider of information and communications services, etc. shall take the following measures to prevent illegal access to personal information:

Provided, That measures referred to in subparagraph 3 shall be limited to a provider of information and communications services or similar whose number of users stored and managed with such personal information for the immediately preceding three months as at the end of the preceding year is at least one million daily, or whose sales during the preceding year (in cases of a corporation, referring to the preceding business year)

The term "public official" means a public official who is a public official in charge of the relevant business.

1. The authority to access the database system systematically organized to process personal information (hereinafter referred to as the "personal information processing system");