All appeals are dismissed.

The costs of appeal are assessed against the Defendants.

The grounds of appeal are examined.

1. As to the ground of appeal No. 1 by Defendant BU

A. After recognizing the facts as indicated in its holding, the lower court determined that Defendant BU (hereinafter “Defendant BU”) was obligated to secure the safety of personal information or to take necessary measures to protect user information as prescribed by the former Personal Information Protection Act (amended by Act No. 13423, Jul. 24, 2015) or the former Electronic Financial Transactions Act (amended by Act No. 11814, May 22, 2013).

In addition, in the process that Defendant BV Co., Ltd. (hereinafter “Defendant BV”) entered into a development service agreement related to the card accident analysis system (FDS), and Defendant BV’s development personnel provide and handle personal information to the card customer, in violation of the aforementioned statutes, Defendant BV did not fulfill the duty of installation and management of security programs, the duty of management and supervision of documents regarding technical and administrative measures when entrusting the management of personal information, the duty of providing encrypted card customer information, the duty of not storing and sharing user information, and the duty to take security measures such as restrictions on access rights, and thus, Defendant BV is held liable for damages caused by tort against the Plaintiffs that leaked personal information.

B. In light of relevant provisions and records, the above determination by the court below is just, and contrary to the allegations in the grounds of appeal, there were no errors of misapprehending the legal principles regarding the establishment of liability for damages by erroneous interpretation of the standards for measures to ensure the safety of personal information, or failing to exhaust all necessary deliberations,

2. Defendant BV’s grounds of appeal Nos. 1, 2, and 3