Defendant 1 and eight others

Prosecutor

The number of static minerals, cluorites, knife and cluorites, and cluorites;

Attorney Kim Sung-chul et al.

Seoul Central District Court Decision 2015Ma510 Decided January 8, 2016

All appeals filed by the prosecutor against the Defendants are dismissed.

1. Summary of grounds for appeal;

A. As to the violation of the Personal Information Protection Act relating to the acquisition of personal information by unlawful means by Defendant 1, Defendant 2, Defendant 3, Defendant 4, Defendant 5, Defendant 6, and Defendant 9 Company (hereinafter “Defendant 9 Company”).

(i) misunderstanding of legal principles as to the relationship under Article 59(1), Article 15, and Section 17(1) of the Personal Information Protection Act (hereinafter referred to as the “Act”);

㈎ 이 부분 공소사실은 ‘피고인들이 개인정보보호법 제15조 에 의한 개인정보 수집에 관한 동의를 부정한 방법으로 받았다’는 것이지, 법 제17조 에서 규정한 ‘개인정보의 제3자 제공에 관한 정보주체의 동의를 부정한 방법으로 받았다’는 것이 아니다. 따라서 피고인들은 법 제15조 제2항 에 따라 응모자인 정보주체에게 이 사건 경품행사에 따른 실제 ‘개인정보의 수집·이용목적’인 ‘개인정보의 판매’ 사실을 고지할 의무가 있다. 그럼에도 불구하고 제1심은 법 제17조 에서 개인정보처리자가 개인정보를 제3자에게 제공함에 있어 정보주체의 동의를 받아야 할 사항에 ‘그 개인정보를 제3자에게 유상으로 제공하는지 여부’를 고지하도록 규정하고 있지 않다는 이유로 피고인들이 정보주체에게 이 사건 경품행사를 통하여 취득한 개인정보를 제3자에게 유상으로 제공한다는 사실을 고지할 법적인 의무가 없다고 판단하였다.

㈏ 또한, 제1심은 개인정보의 제3자에 대한 유상제공 사실을 고지할 법적인 의무가 없다고 판단하였으나, 피고인들이 이 사건 경품행사를 통한 개인정보의 수집·이용 목적에 관한 사정, 즉 경품행사의 실제 목적이 개인정보를 제3자에게 판매하기 위한 것이라는 점을 고지하였다면 정보주체가 개인정보의 수집에 동의하지 않았을 것이 경험칙상 명백하므로, 피고인들이 이러한 사정을 고지하지 아니한 것은 법 제59조 제1호 의 ‘거짓이나 그 밖의 부정한 수단이나 방법’에 해당한다.

㈐ 한편, ‘거짓이나 그 밖의 부정한 수단이나 방법’은 위계 기타 사회통념상 부정한 방법으로 정보주체의 의사결정에 영향을 끼쳐 동의를 받는 것을 의미하고, 정보처리자가 정상적인 절차에 의하여 개인정보를 취득하거나 처리에 관한 동의를 받을 수 없음에도 의사결정에 영향을 미칠 수 있는 행위로 개인정보를 취득하거나 처리에 관한 동의를 받은 경우에는 명시적인 금지 규정이 없더라도 이에 해당한다.

㈑ 따라서 명시적인 금지규정이 없다면 처벌할 수 없다는 취지로 이 부분 공소사실에 대하여 무죄를 선고한 제1심 판결에는 법 제59조 제1호 와 제15조 , 제17조 의 관계 및 기망에 관한 법리 등을 오해하여 판결 결과에 영향을 미친 위법이 있다.

Do Governor's misunderstanding of facts against the intent of information

In the investigative agency, more than 20 persons among the subscribers for the instant premium events were heard a telephone statement, and the above subscribers stated that they would not subscribe to the premium event if they had known that they sold the personal information acquired through the premium event. Nevertheless, the first instance court recognized that their personal information would be used for the business of the insurance company in order to obtain an opportunity for winning in the premium from the standpoint of the subscribers by misunderstanding the intention of the information subjects, and that the first instance court consented to such offer.

Article 12-2(1) of the Act provides that matters concerning the consent shall be stated in 1mm and shall not be read.

At the time of the instant gift event, the Defendants’ attaching an extended photograph of the right to subscribe was only the purpose to show the example to the subscribers in order to obtain more subscriptions, and did not aim to enable the subject of information to properly read the contents thereof. In addition, in the description of the right to subscribe, the Defendants emphasized and indicated the part of the consent to be obtained by the Defendants, and made it difficult for the subject of information to read it properly by stating that it is only one meter for the third party, the purpose of provision, etc., which is an important content in the consent. Accordingly, the Defendants’ act constitutes “false or other unlawful means or methods.”

x. Legal principles concerning the act of obtaining consent to unnecessary information, such as date of birth and number of children, in addition to the name and contact point of the subscriber customer necessary for sending the prizes;

In collecting personal information pursuant to Article 16 of the Act, a personal information manager shall collect the minimum personal information necessary for the purpose of the collection of personal information, and the purpose of social social norms is to publicize the manager and to exercise his/her will against customers. Thus, the purpose of collecting personal information should be limited to the dispatch of free gifts from free winners, and the Defendants collected unnecessary information, such as the date of birth or the number of children of the subscribers in violation of this provision. This part of the facts charged is not about the provision of personal information to a third party, but about the collection of personal information by the Defendants. In so doing, the first instance court erred by misapprehending the legal doctrine that “the purpose of offering the information to a third party,” which states that “the purpose of offering the information to a third party is to use it as data for insurance marketing, such as life and non-life insurance products,” and determined that the date of birth, number of children, etc. of the subscribers as information within the scope necessary for marketing of insurance for the purpose of providing the information to a third party.”

(v)misunderstanding of facts or misunderstanding of legal principles concerning unpaid premiums;

Under the contact details of the subscription form of this case, the Defendants: (a) stated, “I will accurately write the winning lot in Sms.”; and (b) stated the subscriber’s phone number and mobile phone number, the Defendants treated that I would not pay premiums without properly communicating with the winning winners in accordance with the policy to maximize the company’s operating profit. Accordingly, the Defendants’ failure to pay premiums was not once, but continued to pay premiums. Accordingly, even if there were circumstances after the collection of personal information, the Defendants’ failure to pay premiums at the first instance court’s judgment was known to the fact that the premiums were unpaid at the company level. Moreover, even based on the logic of the first instance court’s judgment, the Defendants’ failure to pay premiums was for the interests of Defendant Company 9, and thus, it was for the sake of maximizes the interests of Defendant Company 9, and thus, the Defendants are liable to Defendant Company 9 as an act related to the corporation’s business. The first instance court erred by misapprehending the facts or by misapprehending the legal principles.

⑹ 보험업법 규정을 위반하여 부정한 방법으로 개인정보 취득

In light of the relevant provisions of the Insurance Business Act, a person other than a legitimate insurance solicitor shall not receive any consideration at the time of the conclusion of an insurance contract, or arrange a large amount of personal information, which is likely to conclude an insurance contract, in a systematic and continuous manner, and shall not receive such consideration. Therefore, even though the Defendants’ act in this part of the facts charged constitutes a violation of the explicit provisions of the Insurance Business Act, the first instance court determined that the Defendants’ act did not constitute “any false or other unlawful means or methods” without making any judgment thereon.

⑺ 고객들을 기망한 일방적 사행행위

A subscriber of the gift event of this case without knowing the actual purpose of the said event, expected the winning of the gift in the name of a customer’s private event and offered his personal information without any awareness, and even if the winning of the gift does not have been returned to the original level, thereby resulting in the loss of providing personal information. Therefore, this constitutes a “speculative act” under the Act on Special Cases Concerning Regulation and Punishment of Speculative Acts, Etc., and the subscriber becomes a victim of the speculative act. This new form of “act with a large size and unilateral” is more severe than ordinary speculative acts, and is more severe than the victim’s number of million. However, the first instance court did not consider such fact.

B. As to Defendant 4, Defendant 5, Defendant 6, Defendant 7, Defendant 8, and Defendant 9’s violation of the Act on Promotion, etc. of Information and Communications Network Utilization and Information Protection (personal information leakage) and violation of the Act on Promotion, etc. of Utilization and Information Protection

(i) Note 2) misunderstanding of facts or misunderstanding of legal principles with respect to whom a “pre-writtening” is a person’s business.

In both “pre-coping” and “after-coping”, an insurance company is taking advantage of database (hereinafter “DB”) in which it owns personal information that it intends to purchase, and only an insurance company may engage. Therefore, it constitutes an insurance company’s business. Therefore, it cannot be deemed that Defendant Company entrusted part of its business for obtaining consent to the provision of personal information to a third party (hereinafter “concept”) to an insurance company.

d. Erroring of facts or misunderstanding of legal principles in relation to whom the “pre-writtening” is intended

The “pre-coping” is conducted through consultations between an insurance company, Defendant 9 company, and Nonindicted Co. 3 (hereinafter “Nonindicted Co. 3”) (hereinafter “Nonindicted Co. 3”) and Defendant Co., Ltd. (hereinafter “Nonindicted Co. 3”). In short, an insurance company and Defendant Co. 9 gain profits from both the insurance company and Defendant Co., Ltd., such as the selection of persons eligible for their own business and the provision of stable personal information DB, and Defendant Co. 9 and Nonindicted Co. 3 gain economic benefits from the reduction of persons eligible for the call.

Abstract Whether there is an agent or not, and whether there was a contract related to business entrustment

Defendant Company 9 did not conclude an entrustment contract with an insurance company, and stated the insurance company in its application for the destroyed cards as a trustee. ③ The insurance company did not conclude the entrustment contract with the insurance company, and ③ did not enter into the above entrustment contract with the insurance company, ④ the Internet, Official Gazette, etc., which was not a trustee of its business, and there was no fact that the insurance company provided education to prevent the personal information of the subject of information from being lost, stolen, leaked, altered, or damaged. ⑤ There was no fact that the insurance company inspected or supervised how the personal information of the subject of information is managed by the insurance company. Ultimately, Defendant Company 9 did not deal with or handle the insurance company as a trustee, and did not hold the personal information within the management scope. Thus, Defendant Company cannot be deemed to have entrusted the management of

2. Determination:

A. The judgment on the violation of the Personal Information Protection Act relating to the acquisition of personal information by the unlawful means of Defendant 1, Defendant 2, Defendant 3, Defendant 4, Defendant 5, Defendant 6, and Defendant 9

(i) Determination of misapprehension of the legal principles as to the relationship under Article 59(1) and Article 15 and Article 17 of the Personal Information Protection Act

㈎ 먼저 이 부분 공소사실 요지에 관하여 보건대, 이는 ‘피고인들이 공모하여 범죄일람표 1-1 내지 1-11 기재와 같이 거짓이나 그 밖의 부정한 수단이나 방법으로 개인정보를 취득하고 처리에 관한 동의(제3자 제공)를 받았다’는 것이고, 법 제59조 제1호 도 ‘거짓이나 그 밖의 부정한 수단이나 방법으로 개인정보를 취득하거나 처리에 관한 동의를 받는 행위’를 모두 규정하고 있는바, 결국 위 공소사실은 피고인들이 거짓이나 그 밖의 부정한 수단이나 방법으로 정보주체의 개인정보를 취득한 부분뿐만 아니라 제3자 제공이라는 처리에 관한 동의를 받은 부분도 모두 포함된 것으로 봄이 상당하다. 따라서 피고인들이 경품행사를 통하여 응모자의 개인정보를 취득하고, 이를 제3자인 보험회사에게 제공한다는 동의를 받음에 있어서 개인정보를 유상으로 제3자에게 제공한다는 사실을 고지할 의무가 있는지를 모두 살펴보아야 한다.

㈏ 개인정보처리자는 ① 법 제15조 제1항 에 따라 정보주체의 동의를 받은 경우 개인정보를 수집하여 그 수집목적의 범위에서 이용할 수 있고, 같은 조 제2항 에 따라 위와 같은 동의를 받을 때에는 정보주체에게 ‘1. 개인정보의 수집·이용 목적, 2. 수집하려는 개인정보의 항목, 3. 개인정보의 보유 및 이용 기간, 4. 동의를 거부할 권리가 있다는 사실 및 동의 거부에 따른 불이익이 있는 경우에는 그 불이익의 내용’을 알려야 하며, ② 법 제17조 제1항 에 따라 정보주체의 동의를 받은 경우 정보주체의 개인정보를 제3자에게 제공할 수 있는데, 그 경우 같은 조 제2항 에 따라 ‘1. 개인정보를 제공받는 자, 2. 개인정보를 제공받는 자의 개인정보 이용 목적, 3. 제공하는 개인정보의 항목, 4 개인정보를 제공받는 자의 개인정보 보유 및 이용 기간, 5. 동의를 거부할 권리가 있다는 사실 및 동의 거부에 따른 불이익이 있는 경우에는 그 불이익의 내용’을 알려야 한다.

According to the evidence duly adopted and examined by the first instance court and the appellate court, Defendant 9 commenced events on the gift of this case from around 2009. The main purpose of the events was to increase sales by inducing customers to visit, expect the winning prizes, and acquire personal information from the customers who subscribe to the event, and sell it for consideration to insurance companies. The Defendants stated “personal information for collection and handling, and consent to use,” as “collection/use” column for “collection/use” for “personal information for collection/use.” However, in the facts charged of this case, the Defendants stated “personal information for non-indicted 1” as “personal information for non-indicted 2” without providing information on the ticket of this case (“non-indicted 3” as “collection/use of personal information for non-indicted 1” as “personal information collected through this event.

On the other hand, inasmuch as the Defendants stated in the subscription form of this case not only “collection and delivery of light goods by drawing and delivery,” but also “providing information for insurance marketing” as “for the purpose of using personal information by a third party,” the Defendants notified the purpose of collecting and using personal information under Article 15(2)1 of the Act and “for the purpose of collecting and using personal information by a third party” under Article 17(2)2 of the Act, and “for the purpose of using personal information, such as telephone and sms for providing life, non-life insurance products, etc.,” the Defendants cannot be deemed to have a duty to notify the third party of the economic effect that Defendant Company 9 obtained through the collection and provision of personal information by a third party, including “for the purpose of collecting and using personal information,” and “for the purpose of providing personal information by a third party,” the details of “the third party’s consent” and “for the purpose of collecting and using personal information,” separately from the provision of personal information by a third party.

Meanwhile, among the gift events of this case, some of the expression "providing information for insurance marketing" was not indicated in the "purpose of collecting and using personal information" column, but even in that case, the phrase "the consent to provide personal information to an insurance company for marketing of the insurance company" stated in the "the third party's consent to provide the relevant information" and obtained the explicit consent of the subscriber. Thus, from the perspective of the subscriber who is the subject of information, the defendant company collected personal information by the defendant company to provide personal information to the insurance company for the purpose of using it for the insurance marketing" can be deemed to have consented to the collection of personal information by the defendant company.

Ultimately, even when considering both Articles 15 and 17 of the Act, the subject of information is not obliged to notify the subject of information of not only “the fact that personal information is provided to a third party” but also “the fact that Defendant Company obtains economic benefits (i.e., the fact that personal information is provided at a cost) by providing a third party” as alleged by the prosecutor.

㈐ 또한, 아래 “⑵ 정보주체의 의사에 대한 사실오인 주장에 관한 판단‘ 부분에서 보는 바와 같은 사정 및 이 사건 경품행사에 응모한 바 있는 공소외 12도 항소심 법정에 증인으로 출석하여 ‘개인정보가 보험회사에 유상이든 무상이든 제공된다는 사실을 알았다면 개인정보의 제3자 제공에 동의하지 않았을 것이다’라고 진술하는 등 피고인 9 회사가 이 사건 경품행사에서 수집한 개인정보를 제3자인 보험회사 등에게 제공한다는 사실 자체를 인식하지 못한 채 개인정보의 제3자 제공에 동의한 것을 문제로 삼고 있을 뿐, 그러한 제3자 제공이 유상인지 무상인지 여부는 개인정보의 수집 및 제3자 제공 동의에 관한 결정을 함에 있어 중요한 사항이 아니었다는 취지로 진술하고 있는 점, 결국 정보주체로서는 ‘자신의 개인정보가 마케팅 목적으로 보험회사에 제공된다’는 사실 등 법에 규정된 사항만 제대로 고지를 받는다면 자신의 개인정보의 수집이나 제3자 제공에 동의할지에 관한 의사 결정을 충분히 할 수 있을 것으로 보이고, 나아가 그 제3자 제공이 유상인지 또는 무상인지 여부는 그와 같은 의사 결정을 함에 있어서 영향을 미치는 핵심적인 사항이라고 보이지 아니하는 점 등에 비추어 보면, 피고인들이 개인정보를 제3자에게 판매한다는 사정을 고지하였다면 정보주체가 개인정보의 수집 등에 동의하지 않았을 것이 경험칙상 명백한 경우에 해당한다고 볼 수 없고, 달리 이를 인정할 증거가 없다.

㈑ 한편, 법 제59조 제1호 의 ‘거짓 그 밖의 부정한 수단이나 방법’이란 법에 따른 절차에 의해서는 정보주체로부터 그 개인정보를 취득하거나 처리에 관한 동의를 받을 수 없음에도 취득 또는 처리에 관한 동의를 받기 위하여 행하는 위계 기타 사회통념상 부정한 방법이라고 인정되는 것으로서 그 의사결정에 영향을 미칠 수 있는 적극적 및 소극적 행위를 뜻하고( 대법원 2014.02.27. 선고 2013도10461 판결 참조), 법상 개인정보의 수집이나 제3자 제공에 관한 동의 취득시 정보주체에게 고지하여야 할 사항을 누락한 경우 과태료 등의 행정제재만을 규정(즉, 법 제75조 제1항 은 ‘ 제15조 제1항 을 위반하여 개인정보를 수집한 자’에 대하여 5천만 원 이하의 과태료를 부과하고, 같은 조 제2항 은 ‘ 제15조 제2항 , 제17조 제2항 을 위반하여 정보주체에게 알려야 할 사항을 알리지 아니한 자’에 대하여 3천만 원 이하의 과태료를 부과한다고 규정하고 있을 뿐, 이에 대한 벌칙 규정을 두고 있지는 아니하다)하고 있는 점 등에 비추어 보면, 법상 명시적인 금지규정이 없다 할지라도 정보처리자가 정보주체에게 어떠한 사실을 고지하지 아니한 채 정보제공의 동의를 얻은 행위가 제59조 제1호 의 ‘거짓이나 그 밖의 부정한 수단이나 방법’에 해당하려면 정보처리자가 법에 따른 사항을 모두 고지하여서는 정보주체로부터 그 개인정보를 취득하거나 처리에 관한 동의를 받을 수 없는 경우로서 정보주체에게 이러한 사항을 단순히 미고지한 것에서 나아가 ‘위계 기타 사회통념상 부정한 방법이라고 인정되는 것으로서 그 의사결정에 영향을 미칠 수 있는 적극적 및 소극적 행위를 하였다’고 인정되어야 한다.

However, as seen earlier, the Defendants cannot be deemed to have an explicit or implied legal obligation to inform the information subject of the fact that the Defendants sold personal information collected in the instant gift event for consideration to an insurance company, etc., and inasmuch as the Defendants informed the information subject of the above subscription under the law, all other information provided under the law, the Defendants cannot be deemed to constitute a case where the information subject is unable to obtain or obtain consent to the management of such personal information. Furthermore, even if the Defendants’ obligation to notify the information subject of domestic affairs is recognized, it cannot be deemed that the Defendants merely notified the information subject of the fact that the Defendants merely failed to do so by means of deception or other unfair means under social norms, and the evidence submitted by the prosecutor alone is insufficient to acknowledge it, and there is no other evidence to acknowledge it.

㈒ 따라서 검사의 이 부분 법리오해 주장 등은 모두 이유 없다.

Do Governor's misunderstanding of facts as to the intent of data subjects

According to the evidence duly adopted and examined by the first instance court and the appellate court, it is recognized that the following participants stated that "the defendant company would not subscribe to the gift event if it was aware that the defendant company intended to sell the personal information acquired through the above gift event" as a result of hearing the telephone for 200 persons among the subscribers to the gift event of this case.

However, in light of the following circumstances acknowledged by each of the above evidence, i.e., giving the Defendants an opportunity to subscribe to the gift even to customers who did not purchase the goods on the online and off-line store; 2) the subscribers of the instant gift event could have confirmed the contents before making a physical display on their own in the consent column; and in the absence of knowledge or confirmation of the contents of the right to subscribe, it could not be given consent to the provision of personal information; 30% of them was in fact excluded from the subject of the gift by failing to consent to the provision of personal information to a third party; 3) the Defendants, Defendant 9 companies, or their employees did not interfere with the verification of the contents of the right to subscribe, and rather attached the 4 times expanded photographs to the subscribers, it is reasonable to view that the subscribers obtained the opportunity to receive the opportunity to receive the gift, without being aware or sufficiently aware of the fact that their information was provided for marketing purposes, and even if they did not obtain such consent, they did not have properly obtained such consent or consent.

The first instance court recognized the fact that its personal information will be used for the business of an insurance company and consented to such provision from the customer’s standpoint. However, it cannot be deemed that there was an error of law that affected the conclusion of the judgment. Thus, the prosecutor’s assertion on this part is not acceptable.

Article 12(1) of the Civil Act concerning the misunderstanding of facts or misunderstanding of legal principles concerning the act in which matters concerning the consent are stated by 1mm;

According to each evidence duly adopted and investigated by the first instance court and the appellate court, each of the following facts are stated in the paper of this case about a size of about 1m [the collection and handling of personal information, consent to use] and [the provision of personal information to a third party], and the indication of consent to these matters is recognized as being relatively large and relatively thick.

However, the following circumstances acknowledged by each of the above evidence, i.e., ① the size of letters written on the invitation of this case appears to have been widely used in various places, such as lottery tickets, quality labelling of industrial products, instructions on use of medicines, and various service terms and conditions, ② there were many subscribers who did not consent to the provision of information in the event of this case, and thus, they appears to have been able to fully read the matters regarding the consent to the provision of information, ③ the Defendants were able to attach an extended photograph of subscription right amounting to four times the subscription right at the time of the event of the event of the grant, ③ the Defendants were able to expand the contents of the subscription right on a computer screen, ④ even if the physical part on the consent to the invitation of this case is relatively larger than the notified contents, it is difficult to find that the Defendants did not have any other evidence to recognize that the above circumstances affected the disclosure of the consent of the subscription right of this case, making it difficult to recognize that the Defendants might not intentionally have any interference with the contents thereof more than one meter.

Therefore, the Defendants’ above acts cannot be deemed to constitute “any false or other unlawful means or methods,” and thus, the Prosecutor’s assertion on this part is without merit.

x) Judgment on the misapprehension of legal principles regarding the act of giving consent to unnecessary information, such as date of birth and number of children, in addition to the name and contact point of the subscribing customer necessary for sending the prizes;

According to each evidence duly adopted and examined by the first instance court and the appellate court, the defendants put the column to describe the subscriber's "date of birth", "child Number" or "weon" in the form of the subscription to this case in addition to the name and contact of the subscriber, and it is recognized that the defendants have written the phrase "not to be included in the items stated/ consented but to be excluded from the drawing upon omission of signature", and on the other hand, the defendants have carried out the gift event in this case for the purpose of providing personal information to the insurance company, etc., and the defendants have written the phrase "to be used as data for insurance marketing, such as telephone for guiding life, non-life insurance products, etc." in the form of the subscription to this case.

In light of the fact that: (a) a free event itself is not a collection of personal information through a right to subscribe but a non-conditioned customer; and (b) there is no ground to conclude that it is prohibited to collect personal information irrelevant to the issuance of free gifts; (c) the Defendant Company held a free event to provide personal information for marketing of insurance companies as well as customers; (d) as prescribed by the Act, the purpose of the event is to provide all information such as the date of birth, number of children, etc.; and (c) even if the Defendants violated the provision of Article 16(3) of the Act that the subject of information should not refuse the provision of goods or services on the ground that the subject of information would not consent to the collection of personal information other than the necessary minimum information; (c) in such a case, the Defendant Company may impose a fine for negligence not exceeding 30 million won pursuant to Article 75(2)2 of the Act, and there is no separate criminal punishment on the grounds that it does not constitute an unlawful means or other unlawful means other than the name, date of birth, and number of children or other information collected.

(v) Determination of misconception of facts or misapprehension of legal principles concerning unpaid premiums;

㈎ 이 사건 증거들을 기록에 비추어 면밀히 검토해 보면, 제1심이 그와 같은 증거판단을 토대로 피고인들이 이 사건 경품행사에 따른 경품을 제대로 지급하지 아니한 행위는 개인정보 수집 이후의 사정에 불과하므로 피고인들이 거짓이나 그 밖의 부정한 수단이나 방법으로 고객들로 하여금 개인정보 수집에 동의하도록 하였다는 공소사실과 무관하고, 검사가 제출한 증거만으로는 피고인들이 당첨자들에게 경품을 지급할 의사가 없는데도 마치 개인정보 제공에 동의하면 경품에 당첨될 기회가 주어지는 것처럼 경품행사에 응모하는 사람들을 기망하는 수법으로 고객정보를 수집하거나 제3자 제공에 동의를 받았다는 점을 인정하기에 부족하며, 달리 이를 인정할 증거가 없다고 판단한 조처는 정당한 것으로 수긍이 되므로, 제1심판결에 검사가 지적하는 바와 같은 사실오인 또는 법리오해의 위법이 있다고 판단되지 아니한다.

㈏ 또한 검사는, 설사 제1심 판결의 논리에 의하더라도 피고인 9 회사의 직원 공소외 5, 공소외 6이 경품을 미지급한 것은 피고인 9 회사의 이익 극대화를 위한 것이었으므로 피고인 9 회사의 직원인 공소외 5, 공소외 6의 경품 미지급 행위는 법인의 업무에 관한 행위로서 법인인 피고인 9 회사가 책임져야 한다고 주장한다.

According to each evidence duly adopted and investigated by the first instance court, the first instance court and the appellate court: Nonindicted 5 and Nonindicted 6 conspired to collect customer information or obtained consent to provide information to a third party on a different premise, and thus, it cannot be recognized that such act of Nonindicted 5 and Nonindicted 6 was committed for Defendant 9, even though they were punished due to such criminal facts (occupational breach of trust). In the case of the remaining give-out events, the evidence submitted by the prosecutor alone, as determined by the first instance court, cannot be acknowledged that Nonindicted 5 and Nonindicted 6, even though they did not have an intention to give a gift to the winner, are given the opportunity to give a gift if they agree to provide personal information. Accordingly, the first instance court’s aforementioned assertion on a different premise is without merit.

⑹ 보험업법 규정을 위반하여 부정한 방법으로 개인정보 취득 주장에 관한 판단

According to each evidence duly adopted and investigated by the first instance court and the appellate court, Defendant Company 9 held 11 times from December 201 to June 2014, and obtained the subscriber’s personal information (name, date of birth, cellphone number, number of children, etc.), 7,121,140 cases, and obtained consent to the disposal thereof (the provision of a third party), and received payment of KRW 1,980 per case by providing it to Nonindicted Company 1 and Nonindicted Company 2, and Nonindicted Company 1 and Nonindicted Company 2 are recognized as having used personal information acquired in the insurance business through telemarket marketing.

However, the Defendants provided their subscribers' personal information for marketing, and received the price for each case of personal information provided by an insurance company. This alone cannot be deemed to have been involved in the insurance solicitation itself in violation of the provisions of the Insurance Business Act, such as “insurance solicitation commission, remuneration, and other consideration in connection with the solicitation,” and there is no other evidence to acknowledge it.

In addition, even if the defendants violated the Insurance Business Act, it is apart from imposing sanctions against the defendants due to violations of the provisions of the Insurance Business Act, and solely on these circumstances, it is difficult to view the defendants' acquisition, etc. of personal information through the exercise of the gift in this case as constituting "any false or other unlawful means or methods" under Article 59 subparagraph 1 of the Act. Therefore, the prosecutor's assertion on this part is without merit.

⑺ 고객들을 기망한 일방적 사행행위 주장에 관한 판단

In addition, it is irrelevant to the facts charged in the instant case that the acquisition, etc. of personal information through the instant gift event constitutes a speculative act, and the “speculative act” refers to “the act of collecting goods or property from many people and determining the acquisition and loss of property by an incidental method,” and the instant gift event cannot be deemed as falling under such speculative act. Therefore, the Defendants’ acquisition, etc. of personal information cannot be deemed as “any false or other unlawful means or methods.” Therefore, the Prosecutor’s assertion on this part is without merit.

B. The judgment on the violation of the Act on Promotion, etc. of Information and Communications Network Utilization and Information Protection (personal information leakage, etc.) concerning the provision and receipt of unauthorized personal information by Defendant 4, Defendant 5, Defendant 6, Defendant 7, Defendant 8, and Defendant 9

(i)Judgment of mistake or misapprehension of legal principles as to whose business it pertains to;

In full view of the facts and circumstances revealed by the first instance court and the appellate court, and the following circumstances recognized by each evidence duly adopted and investigated by the first instance court and the appellate court, it is reasonable to deem “pre-writtening” as a business for the defendant company, not an insurance company, to be the business for the defendant company, and there is no error of misunderstanding of facts or misunderstanding of legal principles as pointed out by the prosecutor. Accordingly, this part of the prosecutor’s assertion is without merit.

㈎ 피고인 9 회사는 공소외 1 주식회사(이하 ‘공소외 1 회사’라고만 한다)와 2009. 1. 1. ‘업무제휴계약’을 체결한 후 같은 해 10. 1. 위 업무제휴계약을 보충하는 ‘업무제휴 부속계약’을 체결하고, 공소외 2 주식회사(이하 ‘공소외 2 회사’라고만 한다)와 2010. 6. 17. ‘업무제휴계약’을 체결한 후 2011. 6. 20. 위 업무제휴계약을 보충하는 ‘업무제휴계약 부속약정’을 체결하여 위 각 보험회사에 고객들의 개인정보를 제공하고 대가를 지급받아 왔다. 위 각 계약에 따르면, 피고인 9 회사의 멤버십 회원 중 제3자 제공에 동의하지 아니한 고객의 정보(이하 ‘미동의 FMC DB’라고만 한다)에 대하여는 피고인 9 회사가 퍼미션 콜을 하여 고객들로부터 제3자 제공 동의를 받은 후 이를 공소외 1 회사와 공소외 2 회사에 제공하기로 규정되어 있고, 이에 따라 피고인 9 회사의 수탁업체인 공소외 3 회사의 콜센터에서 전화를 통하여 고객들로부터 제3자 제공 동의를 얻은 후 이를 위 각 보험회사에 제공하여 왔다. 결국 위 각 계약의 내용상 퍼미션 콜 업무는 피고인 9 회사의 업무이고, ‘사전필터링’은 이러한 퍼미션 콜의 대상자를 선별하기 위하여 이루어지는 것으로서 퍼미션 콜 업무를 위한 부수절차에 해당하므로 이는 피고인 9 회사의 업무라고 봄이 상당하다.

㈏ 보험회사만이 ‘사전필터링’을 할 수 있다는 사정은 개인정보의 처리위탁과 제3자 제공을 구분하는 기준이 될 수 없을 뿐만 아니라, ‘사전필터링’을 함에 있어서는 보험회사가 가지고 있는 정보가 필요할 뿐 이를 이유로 ‘사전필터링’을 보험회사만이 할 수 있는 업무라고 볼 수는 없다. 위탁이란 위탁자가 자신의 업무와 관련된 업무의 일부를 타인으로 하여금 그 책임과 권한으로 행하도록 하는 것을 의미할 뿐이다. 즉, 위탁 대상 업무가 개인정보를 전달하는 자의 업무와 관련된 것인지, 전달받는 자의 업무와 관련된 것인지에 따라 개인정보 위탁 여부가 결정되는 것이지, “위탁자가 스스로 수행할 수 있는 업무”를 위탁한 경우만을 개인정보보호법상 “위탁”에 해당하는 것으로 볼 아무런 근거가 없다.

㈐ 피고인 9 회사(또는 공소외 3 회사)는 ‘사전필터링’ 대상 DB를 공소외 1 회사나 공소외 2 회사에 직접 송부 내지 전달한 것이 아니라, 피고인 9 회사가 직접 관리 및 감독하는 웹하드에 관련 DB를 업로드하면 각 보험회사에서 접근권한을 부여받은 실무 담당자가 위 웹하드에 접속하여 위 DB를 다운로드한 후 ‘사전필터링’ 절차를 거치는 형태로 진행하였다.

㈑ 공소외 1 회사나 공소외 2 회사는 피고인 9 회사로부터 영업에 활용할 목적이 아닌 단순히 ‘사전필터링’을 해주기 위한 용도로 이전받은 미동의 FMC DB 등을 ‘사전필터링’의 목적 범위 내에서 기계적으로 필터링 한 후 당초 이전받은 위 DB를 공소외 1 회사나 공소외 2 회사의 각 시스템에서 삭제하였을 뿐, 이를 '사전필터링' 이외 자신의 마케팅 목적으로 활용하거나 제3자에게 제공하는 등으로 이용할 권리가 없으며, 실제로 이를 구체적으로 열람하거나 마케팅 목적으로 이용하는 등의 행위로 나아간 사실도 없다. 따라서 ‘사전필터링’으로 인하여 각 보험회사와 미동의 FMC DB의 정보주체와 사이에 어떠한 관계도 설정되지 아니하였다(제1심 증인 공소외 9의 법정진술에 의하더라도, 공소외 3 회사는 피고인 9 회사로부터 제공받은 미동의 FMC DB를 ‘사전필터링’을 위하여 공소외 1 회사에게 전달할 때 피고인 9 회사의 직원인 공소외 6의 지시에 따라 주민등록번호만 기재해서 보내거나 일부 필드 값만 추출하여 보낸 적이 있고, 그 경우 고객의 전화번호가 없기 때문에 이를 이용하여 영업을 하는 것은 불가능하였던 사실이 인정된다).

D. Judgment on the misunderstanding of facts or misapprehension of legal principles in relation to whom the “pre-writtening” is intended

In full view of the facts and circumstances revealed by the first instance court and the appellate court, and the following circumstances recognized by each evidence duly adopted and investigated by the first instance court and the appellate court, it is reasonable to deem “pre-writtening” to aim at the interest of Defendant 9, not an insurance company, not an insurance company, and there is no error of misunderstanding of facts or misunderstanding of legal principles as pointed out by the prosecutor. Therefore, the prosecutor’s assertion on this part is without merit.

㈎ 피고인 9 회사의 퍼미션 콜 업무 수탁업체인 공소외 3 회사는 피고인 9 회사와 계약상으로는 제3자 제공 동의를 받은 DB 개당 1,700원을 지급받는 것으로 되어 있으나, 실제로는 이와 달리 제3자 제공 동의를 받은 DB 중 보험회사가 ‘사후필터링’을 통하여 인수한 유효한 DB에 대하여만 피고인 9 회사로부터 정산을 받았다. 따라서 공소외 3 회사로서는 유효한 DB로 인수되는 비율이 그 수익에 있어 매우 중요하였고, 이에 공소외 3 회사의 대표 공소외 10은 공소외 1 회사의 인수율이 충분히 높지 않다는 이유로 피고인 9 회사의 담당자인 공소외 5에게 DB의 단가를 인상하여 줄 것을 요청하였으나, 피고인 9 회사에서는 단가를 인상하는 대신 각 보험회사를 통하여 ‘사전필터링’을 하는 방법으로 비용을 절감하는 방법을 택하여 각 보험회사에 먼저 ‘사전필터링’을 제의하였다.

㈏ 공소외 1 회사와 공소외 2 회사는 미동의 FMC DB에 대하여 ‘사전필터링’을 실시하기 이전에도 ‘사후필터링’을 실시하였고, 그 경우에도 실제 ‘사후필터링’ 과정에서 제외되는 DB에 대해서는 피고인 9 회사에게 대가를 지급하지 아니하였다. 각 보험회사는 ‘사전필터링’이 시행되던 기간 동안에도 별도로 ‘사후필터링’을 하여 최종적으로 인수할 DB를 골라내어 이에 대하여만 피고인 9 회사에 대가를 지급하였다. 결국 ‘사전필터링’을 통해 피고인 9 회사는 퍼미션 콜을 할 때 발생하는 시간과 비용 및 노력을 줄일 수 있으나, 공소외 1 회사와 공소외 2 회사로서는 ‘사전필터링’을 하더라도 ‘사후필터링’을 생략하지 아니함으로써 당초 수행하던 ‘사후필터링’ 외에 ‘사전필터링’ 업무가 추가됨으로써 오히려 번거롭고 추가적인 시간과 노력을 기울이게 되었다.

㈐ 결국 ‘사전필터링’에 따른 실제적인 경제적 효과는 피고인 9 회사 및 퍼미션 콜 업무 수탁자인 공소외 3 회사에 귀속되고, 각 보험회사로서는 ‘사전필터링’을 수행하지 않더라도 ‘사후필터링’을 거치면 제공받을 수 있는 DB가 결국 동일하므로 인수되는 DB의 절대량을 늘리는 효과를 가져올 수 없다. 다만, ‘사전필터링’을 통하여 보험회사도 ‘신속하게 양질의 DB를 공급받아 안정적으로 영업을 할 수 있다’는 측면에서 경제적으로 환산할 수 없는 어느 정도의 이익이 있다고 할 수도 있으나, 이는 결국 피고인 9 회사의 각 보험회사에 대한 DB 공급이 원활하게 이루어진다는 것으로서 피고인 9 회사와 공소외 3 회사의 이익에 따라 발생하는 부수적·간접적 이익에 불과할 뿐, ‘사전필터링’을 위한 이 사건 개인정보 이전의 성격을 판단할 기준으로서의 가치를 지닐 정도에 이르는 이익으로 보기는 어렵다.

㈑ 검사는, 공소외 1 회사의 2010. 4. 29.자 ‘제휴마케팅/텔레마케팅 업무현황’의 주4) 기재내용’ 에서 적시하고 있는 ‘필터링’의 배경을 근거로 보험회사가 ‘사전필터링’에 따른 이익을 가진다는 취지로 주장하나, ‘사전필터링’이 이루어진 시기는 위 문서가 작성된 시기로부터 1년 8개월 가량 지난 2011. 12.경이라는 점에 비추어 보면, 이는 ‘사전필터링’이 아닌 ‘사후필터링’의 배경을 적시한 문건인 것으로 보인다.

【Judgment as to whether there is an intention of entrustment, and whether there was a contract related to business entrustment

㈎ 제1심 및 항소심이 적법하게 채택하여 조사한 각 증거에 의하면, 피고인 9 회사는 공소외 1 회사 및 공소외 2 회사와 각 문서에 의한 위수탁계약을 체결하거나 인터넷이나 관보 등에 위 각 보험회사가 자신의 업무 수탁자라고 게재한 바 없고, 멤버십 가입신청서에 위 각 보험회사를 수탁사로 기재하지 아니하였으며, 정보주체의 개인정보가 분실·도난·유출·변조 또는 훼손되지 아니하도록 위 각 보험회사를 교육하거나 위 각 보험회사가 ‘사전필터링’을 위하여 제공받은 정보를 실제 파기하는지 등에 관하여 확인한 바 없는 사실 등은 인정된다.

㈏ 그러나 한편, 위 각 증거에 의하여 인정되는 아래와 같은 사정 등에 비추어 보면, 앞서 인정한 사실만으로 ‘사전필터링’에 있어서 공소외 1 회사와 공소외 2 회사가 피고인 9 회사를 위하여 피고인 9 회사의 퍼미션 콜 업무의 일부를 수행하는 수탁자로서의 지위가 아니라 별개로 위 각 보험회사의 업무를 수행한 제3자로서의 지위를 가진다고 볼 수 없고, 달리 피고인들이 제3자에게 미동의 개인정보를 제공하였다는 점을 인정할 증거가 없다. 따라서 검사의 이 부분 주장도 이유 없다.

① In the instant case, all relevant persons recognized that personal information was transferred to Defendant 9 and Nonindicted Company 3 for the purpose of “pre-coping” for the extension of the FMC DB’s operations, and transferred the personal information according to mutual agreement to “pre-coping,” which would eventually be an agreement on the entrustment contract. Accordingly, the establishment of the above entrustment contract pursuant to such agreement cannot be denied on the ground that no express document was made.

② Article 26 subparag. 5 of the Act provides various procedural restrictions on the management of personal information following the entrustment of affairs. However, even if Defendant Company violated each of the obligations under Article 26 subparag. 1, 2, and 26 subparag. 3 of the Act in entrusting the management of personal information to Nonindicted Company 1 and Nonindicted Company 2, it is not subject to administrative fines under the Act, and if it violates the obligation under Article 26 subparag. 4 of the Act, it is not subject to administrative fines. Ultimately, the provision of personal information to a third party and the entrustment of the management of personal information to a third party is identical in terms of transfer of personal information to a third party. However, “the provision to a third party” of personal information is the provision of personal information for “the purpose of the recipient,” and “the entrustment of personal information to a third party” should be distinguished from “the handling of affairs of the person who provided” (see Supreme Court Decision 2011Do1960, Jul. 14, 2011).

③ The members of Defendant Company 9’s member with a separate agreement (i.e., a call call service) on the provision of personal information to a company for the introduction or partnership (insurance company, etc.) of partnership goods through an application for membership 6). Some members have been notified of the fact that the company entrusted the provision of personal information to a company for non-indicted 3, etc., and that some members have consented thereto. In light of the procedure and process of “prior call” as seen earlier, it is difficult to view that the transfer of personal information is outside the expected scope of the members notified that the personal information may be entrusted to the entrusted company for the propagation of partnership goods. Rather, it is reasonable to deem that the application of the provision for the provision for the provision of personal information to a third party is not consistent with the legislative purpose of a law, and thus, it is reasonable to deem that the provision for the provision for the provision of personal information to a third party is not possible.

④ The transfer of personal information for “pre-coping” is not aimed at distributing the pertinent personal information, but actually deleted all the DB subject to “pre-coping” after the “pre-coping.” In addition, as seen earlier, Defendant Company 9 (or Nonindicted Company 3) applied DB to Defendant Company 9’s web Having access to the “pre-coping” subject to “pre-coping,” and had each insurance company’s authority to control and confirm access to the pertinent DB by allowing each insurance company’s access to access by allowing each insurance company to control and confirm access to the pertinent DB.

3. Conclusion

Therefore, the appeal by the prosecutor against the defendants is without merit, and all of the appeals are dismissed in accordance with Article 364 (4) of the Criminal Procedure Act. It is so decided as per Disposition.

Judges Cho Il-il (Presiding Judge)

(1) Article 15 (Collection and Use of Personal Information) (1) of the Act (1) In any of the following cases, a personal information manager may collect and use personal information to the extent of the intended purpose of collection. 1. Where a personal information manager has obtained consent from a subject of information pursuant to paragraph (1) 1, he/she shall notify the subject of information of the following matters. 2. Where a personal information manager intends to obtain consent from a subject of information, he/she shall also obtain such consent.

Note 2) An insurance company analyzed the personal information provided by Defendant Company 9 and provided by Defendant Company to customers who do not want to receive a phone for the explanation of insurance products, customers who are already under an insurance contract, customers who have been engaged in telemarketing within the last six months or 12 months, and other clients who are listed on the black list (softing work) and paid compensation to Defendant Company 9 only for the remainder except for the part against the above customers. For convenience, the crying work conducted with respect to personal information provided by Defendant Company 9 after obtaining consent to the provision of personal information by a third party and the crying work conducted before the above consent is reached is called “pre-writtening.”

3) Meanwhile, Article 16(2) of the Act provides that “A personal information manager shall, if collecting personal information with the consent of a subject of information, specifically inform the subject of information that he/she may not consent to the collection of personal information other than the necessary minimum information and collect personal information.” However, the aforementioned provision was newly established by the amendment to Act No. 11990 on August 6, 2013, and was enforced one year after its promulgation, and was not applicable at the time of the instant gift event.

(4) 1) GET/Butild separate operation policy to maximize the productivity of the M Center - The Party is maintaining the separation policy of the GET and Butild Center to maximize the Center’s productivity. The occurrence of a sudden decline and productivity decline issue in the BL DB center at the time of failure to conduct the BL pening, ② the profitabilityization of the company’s profitability - BLB’s profitability maximizes the profitability by the loyalty customer group when using the BLDDB in the Part Butild Center in the Part Butild Center, and the occurrence of dualization of costs by the Company at the expense of the Company until BLD Co.

(5) Article 26 (Restrictions on Management of Personal Information Following Entrustment of Affairs) (1) of the Act (1) Where a personal information manager entrusts a third party with the management of personal information, he/she shall do so in writing, including the following matters: 1. Matters concerning prohibition on the management of personal information; 2. Other matters concerning the technical and managerial protection measures of personal information; 3. Other matters prescribed by Presidential Decree for the safe management of personal information; 2. A personal information manager who entrusts the management of personal information pursuant to paragraph (1) (hereinafter referred to as "trustee") shall disclose the details of entrusted affairs and the personal information management affairs to a person entrusted with the management of personal information (hereinafter referred to as "trustee") so that an owner of information can readily ascertain at any time.

Note 6) In other words, the duty of Defendant 9’s consent to the introduction and provision of information on partnership products and partnership companies, and the contents of the Trust Company 3 Co., Ltd. and Nonindicted Co. 11 Co., Ltd. are written and notified in the application form for accession.