2018No556 Violation of the Personal Information Protection Act

A

Defendant

Authorized Dacida (prosecutions) and Machania (Trial)

Attorney Park Jae-hwan

Seoul Western District Court Decision 2018 Godan50 Decided April 10, 2018

February 14, 2019:

The judgment of the court below is reversed.

The defendant shall be innocent.

The summary of this decision shall be published.

1. Summary of the grounds for appeal (the mistake of facts and misapprehension of legal principles);

A. The consent of the subject of information under Article 15(1)1 of the Personal Information Protection Act includes an implied consent or duty under the good faith principle between the subject of information is not detrimental to the interest of the personal information manager. Therefore, if the subject of information violates it, the subject of information can use the personal information pursuant to Article 15(1)1 or 6 of the same Act, and it should be interpreted that the subject of information can use the personal information collected pursuant to Article 15(1)6 of the same Act for the interest of the personal information manager. Therefore, the Defendant’s act of using the personal information in this case constitutes a legitimate use pursuant to Article 18(1)6 of the same Act, and it does not constitute a use for purposes other than the purpose under Article 1

B. At the time of using personal information of the complainant, the Defendant continued to post a statement that slanders the Defendant on the radio program bulletin board of the Defendant’s production, and the Defendant’s act of using personal information in this case was in the presence of an infringement of the complainant by failing to delete the existing notice. As such, the Defendant’s act of using personal information in this case constitutes self-defense or legitimate act. Moreover, the Defendant’s act of sending content certification by using personal information of the complainant is deemed an act that has no possibility of expectation of illegality and lawful act.

C. Despite the above circumstances, the lower court erred by misapprehending the facts and misapprehending the legal doctrine, which found the Defendant guilty of the instant facts charged.

2. Determination

A. Summary of the facts charged in this case

A personal information controller may not use personal information for any purpose other than its original purpose or provide it to a third party without the consent of the subject of information. From around 2010 to managing the personal information of a radio listener while the Defendant was working as the author of B’s “C”, the listener, who won the given-up of the given-up program, continuously posted a written objection to the Defendant on the program bulletin board, national newspaper, etc. from October 2016, and had the listener in the given-up of the given-up program, and had the intent to send a certificate of contents requesting the suspension of the above act to the said D. On February 2, 2017, the Defendant used the personal information for any purpose other than its original purpose by issuing D’s address and contact to the G lawyer of F law firm, who represented the Defendant in the complaint case against D without the consent of D, the subject of information, or the personal information protection Act.

B. The judgment of the court below

The lower court found the Defendant guilty of the instant facts charged by comprehensively taking account of the following circumstances recognized by its adopted evidence:

1) Article 15(1) of the Personal Information Protection Act provides for a limited case where a personal information manager can collect personal information pursuant to such case, and stipulates that a personal information manager may use such personal information only within the scope of the intended purpose of collection, and Articles 71 subparag. 2 and 18(1) provide that a personal information manager shall punish a person who uses such collected personal information in excess of the scope of the intended purpose of collection. The Defendant collected personal information with his/her consent to deliver the information to a complainant who participated in a radio premium program that he/she produced, which constitutes a case where the personal information is collected with the consent of the complainant who is the subject of information pursuant to Article 15(1) subparag. 1 of the same Act, and otherwise, collected the personal information pursuant to Article 15(1)6 of the same Act. Accordingly, the Defendant should have used the personal information of the complainant only for the purpose of collection, i.e., free gift delivery for which the complainant consented, but the Defendant used the content certification to send it to the complainant beyond the prohibited scope.

2) The time when the defendant used personal information of the complainant was closed after the complainant's completion of a notice of a article that slanders the defendant on the radio program bulletin board of the defendant production, and even if the notice that the complainant prepared was continuously posted on the Internet bulletin board, the defendant's act does not constitute self-defense as provided in Article 21 of the Criminal Act, considering the fact that the complainant's personal information was used for the purpose other than the complainant's personal information, and even if the notice that the complainant prepared was able to escape from the infringement due to the complainant's request for deletion of the notice, etc., the defendant selected the method of sending content certification to the complainant, etc.

3) Also, in light of the circumstances such as the above 2-mentioned, even though it was necessary to send or file a complaint with respect to content certification, as long as the notice prepared by the complainant was still posted on the Internet bulletin even though the complainant did not use the complainant's personal information for the purpose other than its original purpose, the Defendant appears to have no particular difficulty in identifying the complainant's personal information through an investigation by the investigative agency after the complainant filed the complaint. In addition, it is difficult to deem that there was no other means or methods to prevent infringement of the legal interests of the Defendant, other than the use of the complainant's personal information for the purpose other than that of the purpose, the Defendant's act does not constitute a justifiable act as provided in

C. Judgment of the court below

However, the above determination by the court below is difficult to accept for the following reasons.

1) A prosecutor prosecuted the Defendant by applying Article 71 subparag. 2 and Article 18(1) of the Personal Information Protection Act. Article 71 subparag. 2 of the Personal Information Protection Act provides that “a person who uses or provides a third party with personal information in violation of Article 18(1) and a person who knowingly receives personal information for profit or for an illegal purpose” shall be punished. Article 18(1) of the same Act provides that “the personal information manager shall not use personal information beyond the scope under Article 15(1) or provide a third party with personal information beyond the scope under Article 17(1) and (3).”

2) As above, Article 18(1) of the Personal Information Protection Act provides that "personal information manager" is an act. Thus, prior to the judgment on the grounds for appeal by the defendant, prior to the judgment on the grounds for appeal by the defendant, we will first examine whether the defendant is a "personal information manager".

Pursuant to Article 2 subparagraph 5 of the Personal Information Protection Act, "personal information manager" means a public institution, corporation, organization, individual, etc. that processes personal information on his/her own or through another person in order to manage personal information files for business purposes. Among them, "personal information file" is defined as "the aggregate of personal information systematically arranged or organized in accordance with certain rules so that it can easily search the personal information" under subparagraph 4 of the same Article, and "personal information" is defined as "information that can identify an individual through the name, resident registration number, image, etc. of an individual" under subparagraph 1 of the same Article, and "management" is defined as "the collection, creation, linkage, linkage, recording, storage, holding, processing, editing, searching, printing, printing, correcting, using, disclosing, destroying, and other similar acts."

Based on the above provisions, the court below and the court below duly adopted and examined the evidence revealed that if B radio writers notify the listener's telephone number determined as the recipient of goods to B radio team, they received the consent from each listener to use of personal information, etc., and then deliver the above personal information to the product delivery company to the above company, and deliver the gift through the above company, and the defendant can receive the listener's address, etc. in order to solve the non-receiving civil petition if the giveer's gift to the listener is not delivered to B radio, the defendant can receive the listener's address, etc. at the request of B radio team, but there is no evidence to acknowledge whether the defendant constructed or operated a search system systematically arranged or organized in accordance with the rules so that he can easily search the personal information collection of goods at the time of the instant case.

In light of the concept of personal information controllers, the prosecutor asserts that the defendant should be deemed personal information controllers in this respect since he/she had access authority over the personal information database prepared by B radio. However, in light of the above concept of personal information controllers, it is difficult to immediately deem the defendant as personal information controllers just because he/she has access authority over other personal information files operated by the defendant. Rather, the public sector in relation to protection of personal information was regulated by the Act on the Promotion of Information and Communications Network Utilization and Information Protection, Etc., and the private sector in relation to the improvement of the information society and the increase in economic value of personal information, and thus, the income and use of personal information in all areas of society is becoming easy, while the law on the protection of personal information has not been established, it is difficult to interpret the law on the protection of personal information as it goes beyond the scope of protection of personal information as stated above, and thus, it is difficult to interpret the law on the protection of personal information by strengthening the scope of protection of personal information rights and interests of the public (such as personal information fraud and abuse of personal information).

In full view of the above circumstances, the evidence submitted by the prosecutor alone cannot be deemed as proved without reasonable doubt that the Defendant was in the status of the 'personal information manager’s identity, who is the subject of the act under Article 18(1) of the Personal Information Protection Act at the time of the instant case.

3) While the prosecutor indicted the Defendant on the name of the party’s seat with the intention of personal information controller, the prosecutor also asserts that Article 18(1) of the Personal Information Protection Act can be applied because the Defendant is clearly identified as “a person who manages or was in charge of personal information” under the Personal Information Protection Act. The prosecutor’s assertion that “a person who manages or was in charge of the foregoing personal information” is not clearly defined, but refers to the subject of the prohibited act stipulated in Article 59 of the same Act.

Article 59 of the Personal Information Protection Act provides that a person who manages or has processed personal information shall not engage in any act falling under any of the following subparagraphs, subparagraph 1 provides that "the act of acquiring personal information or obtaining consent to the management thereof by fraud or other improper means," subparagraph 2 provides that "the act of disclosing personal information known to him/her or providing such information to another person without due authority," subparagraph 3 provides that "the act of destroying, destroying, altering, forging or divulging other person's personal information without due authority or beyond the permitted authority."

While the Personal Information Protection Act regulates "personal information manager" as a person who is responsible for the management of personal information under Chapter VIII general rule, it regulates "person who manages or has managed such information" as stated above, it seems that the legislative purpose of the Personal Information Protection Act is to be achieved by preventing harm caused by infringement of personal information by a person other than the personal information manager. Therefore, the "person who manages or has managed such information" is not limited to "personal information manager", "public institution, corporation, organization, or individual who processes such personal information by himself/herself or through another person for the purpose of his/her business," and "management or processing of such information" under Article 2 subparagraph 1 of the Personal Information Protection Act as stated in Article 2 subparagraph 2 of the Act (see Supreme Court Decision 2015Do876, Mar. 10, 2016). Thus, there is no further need to include the scope of each prohibited act under Article 58 of the Act as the scope of each of the above prohibited act (see Supreme Court Decision 2015Do8766, Mar. 10, 2019).

Therefore, it is difficult to view the prosecutor's above assertion as belonging to the original scope of prosecution.

In addition, the prosecutor's above assertion can be deemed to be premised on the premise that the defendant is a person who operates, manages, or was processed by, B radio personal information files. However, even based on the evidence submitted by the prosecutor, B radio is merely a database that stores, stores, and uses personal information collected for the purpose of delivering goods to audience, and such fact alone cannot be readily concluded that B radio is systematically equipped with a convenient search system that allows search based on personal information beyond the mere storage of personal information, such as a list of delivery service providers, and there is no other evidence to deem otherwise. Therefore, it is difficult to view that B radio was operating a personal information file at the time of the instant case, and thus, the prosecutor's above assertion is acceptable.

4) Therefore, without considering the grounds for appeal by the defendant, the facts charged in this case constitute a case where there is no evidence of crime, and thus, the defendant must be acquitted pursuant to the latter part of Article 325 of the Criminal Procedure Act. Nevertheless, the judgment of the court below which recognized the charge of violation of Article 71 subparagraph 2 of the Personal Information Protection Act by applying Article 18 (1) of the same Act under the premise that the defendant is a "personal information manager" at the time of entering the facts charged in this case, is erroneous in

3. Sick:

Therefore, the judgment of the court below is reversed in accordance with Article 364(2) of the Criminal Procedure Act on the ground that the above ground for ex officio reversal is justified, and it is again decided as follows.

[Grounds for another judgment]

The summary of the facts charged in this case is as stated in the above 2. A. C. as seen in the above 2.C., since the facts charged in this case constitutes a case where there is no proof of crime, the defendant is acquitted pursuant to the latter part of Article 325 of the Criminal Procedure Act, and the summary of this judgment is to be published in accordance with Article 58(2) of the Criminal Act. It is so decided as per Disposition.

Within the presiding judge;

Judges Ori-hee

Judges Song-sung et al.