2018Da213354 Compensation (as stated)

A person shall be appointed.

1. B

2. C Stock Company:

Suwon District Court Decision 2016Na55773 Decided January 12, 2018

December 13, 2018

All appeals are dismissed.

The costs of appeal are assessed against the Defendants.

The grounds of appeal are examined.

1. As to the ground of appeal No. 1 by Defendant B (hereinafter “Defendant B”)

A. For the following reasons, the lower court determined that Defendant B is liable for compensating the Plaintiff for the damages incurred by the Plaintiff due to the divulgence of the instant customer information pursuant to Article 750 of the Civil Act and Article 39 of the former Personal Information Protection Act (amended by Act No. 13423, Jul. 24, 2015; hereinafter “Personal Information Protection Act”) since Defendant B violated the legal obligations under which the personal information controller or electronic financial business entity should comply with for the protection of personal information or user information, thereby providing the cause of the accident involving the Plaintiff’s personal information leakage.

Defendant B is a personal information controller under the Personal Information Protection Act or the former Electronic Financial Transactions Act (hereinafter “Personal Information Protection Act”).

22. Any electronic financial business entity, as prescribed by this Act, is obligated to take measures necessary to ensure the safety of personal information or to protect user information as prescribed by relevant statutes, such as each Act and Enforcement Decree thereof, and public announcement (based on measures to ensure the safety of personal information).

Nevertheless, Defendant C Co., Ltd. (hereinafter “Defendant C”) and the card accident analysis system (FDS (hereinafter “FDS”) concluded a development service agreement with Defendant C Co., Ltd., and provided Defendant C’s development personnel with personal information, in the process of providing them to and handling personal information of card customers, Defendant C did not perform all the duty of installation and management of security programs in violation of the aforementioned statutes, the duty of contractual agreement on technical and administrative protective measures when entrusting personal information processing, the duty of providing encrypted card customer information, the duty of not keeping and sharing user information on the device, and the duty of restricting access rights.

B. Examining the relevant statutes and the record, the lower court’s aforementioned determination is justifiable. In so doing, contrary to what is alleged in the grounds of appeal, the lower court did not err by exceeding the bounds of the principle of free evaluation of evidence inconsistent with logical and empirical rules, or by misapprehending the legal doctrine on the establishment of various duties of care and liability to compensate for damages

2. As to the grounds of appeal Nos. 1, 2, and 3 of Defendant C, the lower court, based on its stated reasoning, determined that Defendant C is liable to compensate the Plaintiff for damages arising therefrom, jointly with Defendant B pursuant to Article 756(1) of the Civil Act, on the ground that D, an employee of Defendant C, committed a tort of leakage of customer information of this case in connection with the performance of his duties.

In light of the relevant legal principles and records, the above determination by the court below is justifiable. Contrary to the allegations in the grounds of appeal, the court below did not err by exceeding the bounds of the principle of free evaluation of evidence against logical and empirical rules, or by misapprehending the legal principles on the relation of work execution, exemption, and causation in employer responsibility.

3. As to Defendant B’s ground of appeal Nos. 2 and Defendant C’s ground of appeal No. 4

A. In a case where the personal information collected by a person who manages the personal information was divulged against the intent of the subject of information, the determination of whether the leaked personal information causes a mental damage to the subject of information as consolation money should be made on an individual case-by-case basis, comprehensively taking into account the following: (a) the type and nature of the leaked personal information; (b) the type and nature of the leaked personal information; (c) the likelihood of perusal by the subject of information; (d) the access of the leaked personal information; (e) the third party’s access to the leaked personal information; (e) the scope of access to the leaked personal information; (e) the possibility of additional infringement of legal interests; (e) the leakage of the leaked personal information; (e) the situation in which the subject of information manages the personal information; and (e) the details of the leaked personal information; and (e) the occurrence and spread of damage caused by the divulgence; and (e) the amount of consolation money for mental suffering caused by a tort, in consideration of various circumstances, the fact-finding court may determine ex officio discretion.

B. The court below held that the plaintiff's personal information leaked due to the divulgence of customer information of this case is not only recognizable by the plaintiff, but also closely related to the privacy of the individual, and it can be abused for the second crime using it. In light of the circumstances stated in its reasoning, since the plaintiff's customer information leaked due to the divulgence of customer information of this case is highly likely to be perused or perused by a third party during the process of dissemination and propagation, it is reasonable to view that the plaintiff actually suffered mental damage due to the divulgence of customer information of this case by social norms.

Then, in consideration of various circumstances, the Defendants jointly determined the above materials to be compensated for the Plaintiff as KRW 100,000.

C. Examining the aforementioned legal principles and records, the above determination by the court below is just, and the amount of consolation money set by the court below does not exceed the bounds of discretion against the principle of equity. Therefore, the court below did not err in its judgment by exceeding the bounds of the principle of free evaluation of evidence against logical and empirical rules, or by misapprehending the legal principles on the scope of liability for damages and the occurrence of mental damage, or omitting judgment, contrary to what is alleged in the Defendants’ grounds of appeal.

4. Conclusion

Therefore, all appeals are dismissed, and the costs of appeal are assessed against the losing party. It is so decided as per Disposition by the assent of all participating Justices on the bench.

Justices Kwon Soon-il

Justices Lee Dong-won

Justices Park Jung-hwa-hwa

Justices Kim Gin-soo