All appeals are dismissed.

The costs of appeal are assessed against the Defendants.

The grounds of appeal are examined.

1. As to the ground of appeal No. 7 by Defendant M& corporation (hereinafter “Defendant M”)

A. The Act on Promotion of Information and Communications Network Utilization and Information Protection (hereinafter “Information and Communications Network Act”) was enacted for the protection of personal information in the field of information and communications, and the provision on personal information protection is basically intended to protect the subject of information as the other party using information and communications services provided by information and communications service providers

Article 28(1) of the Information and Communications Network Act provides that providers of information and communications services shall take technical and administrative measures necessary to ensure the safety of personal information when they handle personal information of users.

It is not necessarily necessary to collect personal information that a provider of information and communications services manages from the subject of information for the first time.

However, the obligation of a provider of information and communications services to take protective measures pursuant to Article 28(1) of the Information and Communications Network Act is not premised on the collection and use of an unspecified number of personal information, but is related to the handling of personal information by users using the relevant information and communications services. Here, information and communications services refer to the act of directly providing a series of information, such as posting, transmitting, lending, sharing, etc. of various information provided through an information and communications network,

In addition, in the modern society where information and communication means are highly developed, most of the personal information processing is carried out through information and communication network and information transmission occurs frequently, including the Personal Information Protection Act.