2017Do13793 Violation of the Personal Information Protection Act

1. A;

2. B stock company:

3. C.

4. Daehan:

Prosecutor (Defendants)

Law Firm LLC (For Defendants A and B)

Attorney Lee Tae-tae, Attorneys Lee Jae-chul, Lee Jae-hoon, Hun-hoon, Hun-tae, Lee Jin

Attorney crude crude, Seogm, Kim Jong-sung, Kang Jung-sung, Kang Jung-tae, Kim Jong-so (Defendant C and D shares)

For the Company:

Seoul Central District Court Decision 2017No712 Decided August 18, 2017

March 12, 2020

All appeals are dismissed.

The grounds of appeal are examined.

Article 17(1)1 of the Personal Information Protection Act provides that a person who provides a third party with personal information without the consent of the subject of information, in violation of Article 17(1)1 of the Personal Information Protection Act. Article 71(1)1 of the same Act provides that a person who provides a third party with personal information without the consent of the subject of information and a person who is aware of such fact shall be punished. Meanwhile, Article 26 of the Personal Information Protection Act provides for matters concerning the entrustment of the management of personal information by a person who provides a third party,

In light of the language and purport of the above provision of the Act, the provision of personal information to a third party under Article 17 of the Personal Information Protection Act is a case where personal information is transferred for business affairs and interests of the recipient beyond the scope of original purpose of collection and use of personal information, and the "entrustment of management of personal information" under Article 26 of the Personal Information Protection Act refers to a case where personal information is transferred for business affairs and interests of the truster himself/herself related to the purpose of collection and use of personal information. In the entrustment of management of personal information, the trustee does not have an independent interest in the management of personal information, except for the payment for entrusted business affairs by the truster, and the handling of personal information is limited to the scope entrusted under the management and supervision of the provider of information. Thus

Whether an act constitutes provision or entrustment of management of personal information shall be determined by comprehensively taking account of the purpose and method of acquisition of personal information, whether to give or receive consideration, whether to actually manage or supervise a trustee, the impact on the necessity of protecting personal information of an owner of information or a user, and the actual identity of a person who needs to use such personal information (see Supreme Court Decision 2016Do13263, Apr. 7, 2017).

Based on its stated reasoning, the lower court determined that Defendant A and C’s transfer of personal information to the Jart Business Headquarters Co., Ltd. by customers who concluded an insurance contract for the purpose of accumulating S Points constitutes “entrustment of Management of Personal Information” as stipulated in Article 26 of the Personal Information Protection Act, and reversed the first instance judgment convicting the Defendants of the facts charged and acquitted the Defendants.

Examining the reasoning of the lower judgment in light of the aforementioned legal doctrine and the record, the lower court did not err in its judgment by exceeding the bounds of the principle of free evaluation of evidence against logical and empirical rules, or by misapprehending the legal doctrine on “the provision of personal information to a third party” and “the provision of

Therefore, all appeals are dismissed. It is so decided as per Disposition by the assent of all participating Justices on the bench.

Justices Kim Jong-hwan

Justices Park Sang-ok

Justices Ansan-chul et al.

Justices Noh Jeong-hee