In a case where the defendant, a police officer, was prosecuted for violating the Personal Information Protection Act on the ground that the comments written by 22 police officers, such as Gap, on the bulletin board "Ponet (POL NET)", a police integrated portal system inside the police, had access to the defendant's reputation and had access to the "E," a standard personnel system of the National Police Agency, and entered the above 22 cell phone numbers into the "Personnel Inquiry" and processed them by submitting them to the investigation agency, and entered them in the complaint and entered them in the investigation agency, and leaked personal information and leaked personal information without authority, the case holding that the defendant's act was not guilty on the ground that the disclosure

The Defendant, a police officer, was prosecuted for violating the Personal Information Protection Act (hereinafter referred to as the “Act”), on the ground that the comments written by 22 police officers, such as Gap, on the bulletin board “POL NET”, which is a police integrated portal system, had access to the Defendant’s reputation, had access to the “E” which is a standard personnel system of the National Police Agency, and had access to the “E”, and had access to the said 22 cell phone numbers entered and processed the said 22 cell phone numbers, and submitted them to five investigative agencies and entered them on the complaint, and had leaked personal information and leaked personal information without authority.

Article 71 Subparag. 5 of the Act provides that “disclosure of personal information that he/she has become aware of” under Article 59 Subparag. 2 of the Act or “Leakage of personal information” under Article 71 Subparag. 6 and Article 59 Subparag. 3 of the Act should be determined by comprehensively taking into account the contents of the relevant personal information and the extent to which the individual can be identified, the other party who disclosed or divulged such information, the necessity for the protection of personal information, and the balance between the legitimate interests to use such personal information, and the aforementioned “e person system” that the Defendant becomes aware of the numbers of police officers using the “Personnel Ma New,” can be freely used when the relevant police officers find such personal information, and the cell phone number is not allowed by the relevant investigation agency to disclose such information, and it is difficult to view that the Defendant’s act of disclosure of personal information constitutes “distinctive of personal information” under Article 70 of the Act or “distinctive of personal information available to the relevant investigation agency,” on the screen of the above inquiry as an “distinctive of personal information available to the police officer or personal information.”

Article 2 subparag. 1, Article 18(2)7, and 8 of the former Personal Information Protection Act (amended by Act No. 16930 of Feb. 4, 2020), Article 1, Article 2 subparag. 2, and 5, Article 19, Article 59 subparag. 2, 3, Article 71 subparag. 5, and 6 of the Personal Information Protection Act, Article 20 of the Criminal Act, Article 249 of the Civil Procedure Act, Article 325 of the Criminal Procedure Act

Defendant

Kim Sung-hun et al.

Attorney Kim Il-su

The defendant shall be innocent.

The summary of the judgment of innocence shall be published.

1. Facts charged;

【Maternal Facts】

On January 9, 2018 and the 10th day of the same month, police officers Nonindicted 1 and Nonindicted 2 read their comments on the “○○○○○○○○” bulletin board, which is the integrated police portal system, on the ○○○○○○○○○” bulletin, and respectively, write down comments on Nonindicted 3’s “(i omitted)” registered on January 8, 2018 by Nonindicted 3 of police officers belonging to the △△△ Police Station.

In addition, Nonindicted 4, Nonindicted 5, Nonindicted 6, Nonindicted 7, Nonindicted 8, Nonindicted 9, Nonindicted 10, Nonindicted 11, Nonindicted 12, Nonindicted 13, Nonindicted 14, Nonindicted 15, Nonindicted 16, Nonindicted 17, Nonindicted 18, Nonindicted 19, Nonindicted 20, Nonindicted 21, Nonindicted 22, and Nonindicted 23, who is a police official, written comments on the aforementioned bulletin board from February 12, 2018 to December 24, 2018, respectively.

The Defendant determined that comments written by 22 persons, such as Nonindicted Party 1, etc., of the above police officers harm the honor of the Defendant or insult the Defendant, and had the mind to file a complaint with the investigative agency with the said 22 persons.

【Criminal Facts】

No person who has managed or processed personal information shall divulge personal information he/she has become aware of in the course of performing his/her duties or provide it to any third person without due authority, and shall divulge another person's personal information without due authority or beyond the permitted authority.

When a police officer’s name is entered into “e” as a standard personnel system of the National Police Agency, a warning letter stating that “an employee inquiry is made available for viewing the department to which the subject belongs, mobile phone numbers, e-mail addresses, etc.” (However, mobile phone numbers are not visible if an individual was set non-disclosure).” At the bottom of the inquiry screen, the warning letter indicating “Prohibition of Private Use of Personal Information of Internal Employees”

On February 8, 2018, around 11:47, the Defendant entered Nonindicted Party 1’s personal information number (Omission) into the “E” system at the office of △△ Police Station located in Tong-si ( Address omitted), and then submitted to the investigation agency, such as the former Main District Prosecutors’ Office, from July 9, 201 to August 13, 2018, the Defendant entered Nonindicted Party 1’s personal information number (Omission) into the “E” system as indicated in the separate crime list, and identified the aforementioned 22 cell phone numbers from around that time to August 10, 2018, and submitted the aforementioned cell phone number to 22 persons without obtaining any separate consent from the said 22 persons, and from around July 9, 200 to August 13, 2013, the Defendant submitted to the investigation agency, such as the former Main District Prosecutors’ Office, as indicated in the separate crime list.

As a result, the Defendant, who managed or processed personal information, divulged 22 personal information such as Nonindicted 1, etc. that he/she became aware of in the course of performing his/her duties, provided it to another person without authority, and leaked 22 personal information such as Nonindicted 1, etc.

2. Defendant and his defense counsel’s assertion

While recognizing the above facts, the Defendant and his defense counsel asserted that the phone number of the volunteer staff disclosed from the portal system in the workplace was stated in the complaint only, and that the Defendant does not fall under “personal information manager”, and that the Defendant does not fall under “disclosure” or “discharge” by itself, and that the above act is not unlawful as “act that does not contravene social rules” under Article 20 of the Criminal Act.

In this regard, the prosecutor presents his opinion that the defendant is included in the subject of punishment as a person who has processed personal information in the business computer system, and that the phone number recorded in the system for private purposes is the leakage or leakage of personal information and does not constitute a legitimate act.

We examine the cases presented and cited by both parties below, and examine whether the defendant's liability is recognized in this case.

3. Determination

A. Relevant provisions

Article 71 Subparag. 5 and Article 59 Subparag. 2 of the Personal Information Protection Act (such as leakage of personal information that a person who has processed or processed the personal information) and Article 71 Subparag. 6 and Article 59 Subparag. 3 of the Personal Information Protection Act (such as leakage of personal information without authority of a person who has processed or processed the personal information) are stipulated as “a person who has processed or processed the personal information,” and the above mandatory subject is defined as “a person who has processed or processed the personal information.”

B. Legal principles

The Personal Information Protection Act limits the collection and use of personal information by “personal information manager” (Articles 15 through 18), and the act of “person who has received personal information from a personal information manager” (Article 19), and also limits the act of “person who has managed or processed personal information” (Article 59).

In this context, with respect to the interpretation of Article 71 subparag. 5 and Article 59 subparag. 2 of the Personal Information Protection Act, Supreme Court Decision 2015Do8766 Decided March 10, 2016 held that “a person who manages or processed personal information” under Article 59 subparag. 2, who is subject to Article 71 subparag. 5 of the Personal Information Protection Act, is not limited to “personal information manager” under Article 2 subparag. 5, that is, a person who processes or handled personal information directly or through another person for the purpose of operating personal information files, and includes “personal information” under Article 2 subparag. 1 of the Personal Information Protection Act, which includes “management” or “management” under Article 2 subparag. 2.

In this context, the Seoul High Court Decision 2018No2498 decided January 10, 2019 regarding the meaning of “personal information” under Article 2 subparag. 1, which was known in the course of performing duties, interpreted that “the person who manages or processed the personal information” means only the personal information he/she became aware of in the course of performing his/her duties, i.e., managing the personal information, and that it does not mean any personal information he/she has become aware of in the course of performing his/her duties without relation to the management of personal information.” The Supreme Court of final appeal (Supreme Court Decision 2019Do1143) has affirmed the conclusion of the court below without the legal reasoning.

In determining whether a person constitutes a “disclosure of personal information known to him/her in the course of performing his/her duties” under the above provision, the following should be comprehensively taken into account: (a) the content of the relevant personal information; (b) the extent to which the person can be identified; and (c) the other party, purpose, and circumstances that have divulged such information; and (d) the need to protect the personal information;

C. Review of the instant case

(1) Whether Article 71 Subparag. 5 and Article 59 Subparag. 2 of the Personal Information Protection Act (the disclosure, etc. of personal information that a person who manages or was managing the personal information) applies

According to the records, the Defendant, a police officer, became aware of the mobile phone numbers of the victims who are the same police officers using the "Personnel Ma New," which is the standard personnel management system of the National Police Agency, at the “solnet,” which is an internal integrated portal system of the police, using the National Police Agency, and any police officer can freely use the aforementioned system when searching for the members of the police officers, and the mobile phone number can be searched only when the relevant employee is allowed to disclose, and the Defendant may recognize the fact that he did not take direct charge of the internal employees search. In addition, in the above inquiry page, the warning letter stating “Prohibition of Private Use of Personal Information of Personnel,” but the employees could have used the same without any restriction if the contact of the members of the staff is necessary due to a work or personal day (see, e.g., system connection video that the police officer used on the third day during the third day. Unlike the "Online Inquiry" in which information about the general public or persons subject to investigation is sought).

However, in this case, the Defendant filed a complaint against the same person with an investigative agency as a crime of defamation, and entered the mobile phone numbers acquired as above in the column of contact address of the Defendant, and it is difficult to view the same as personal information that the Defendant came to know in relation to the management of personal information.

In addition, the defendant's complaint (Evidence Nos. 17, 215, 44 and 551 pages), the defendant's statement (Evidence Nos. 17, 215, and 444 pages, and the final resolution No. 551 pages) stated the defendant's name, occupation, office address, and office address, and only the mobile phone number is added as "non-personal information" as provided by Article 2 subparagraph 1 of the Personal Information Protection Act. Here, the name is directly related to "personal information" as provided by Article 2 subparagraph 1 of the Personal Information Protection Act, and it is a situation where the defendant's address is sufficiently specified, and it is not deemed that the mobile phone number is sufficiently specified. Further, the personal information to be protected under the Personal Information Protection Act is a separate personal information. This is because all personal information is not protected as personal information independently.

In addition, Article 18(2) of the Personal Information Protection Act prohibits the divulgence of information to identify individuals, but Article 18(2) of the said Act exceptionally provides that “personal information may be used for any purpose other than its original purpose or provided to a third party except where it is likely to unfairly infringe on the interests of the subject of information or a third party.” In addition, where it is necessary to investigate and prosecute a crime (Article 7) and where it is necessary for the court to conduct a trial (Article 8)” and “where it is necessary for the court to conduct a trial (Article 249(1) of the Civil Procedure Act). In addition, when submitting a complaint to the court, the parties should be specified in accordance with Article 249(1) of the said Act, and even when filing a complaint in accordance with the Criminal Procedure Act, the submission of personal information to the court and an investigative agency in accordance with the criminal and civil procedure is in accordance with due process, and the submitted personal information is strictly managed in the country, and thus another third party cannot be seen as “disclosure” of personal information.

Of course, it is also necessary to regulate the mobile phone numbers of those who share internally through the emergency contact network, etc. in cases where they are leaked to the outside by unlawful means and for other purposes. However, punishing all personal information that is likely to constitute personal information as "Leakage" without considering the purpose and process of the use thereof and the balance of related interests, does not accord with the Supreme Court Decision that “an interpretation of penalty law should be strict, and an excessively expanded interpretation or analogical interpretation of the meaning of penalty law in the direction unfavorable to the defendant is contrary to the principle of no punishment without law as provided by the Constitution.”

In this case, the Defendant filed a complaint with 11) on the ground that 30 persons including 27 police officers and 2 reporters referred to the case concerned. The part where actual defamation is difficult, and the Defendant’s act en bloc stating the contact details acquired from the inside network is appropriate. However, it is difficult to deem that such an act is generally subject to punishment as a leakage of personal information, regardless of the fact that the Defendant’s act constitutes a disciplinary action against violation of internal regulations. If the scope of punishment is extended to include information necessary for filing a complaint with an investigative agency and filing a lawsuit with a court, it is limited to the act of disclosing personal information, such as filing a complaint and accusation by the party who actually has prevented the exercise of individual rights, and rather, it is contrary to the purport of the Personal Information Protection Act, “for the purpose of protecting individual freedom and rights, and realizing individual dignity and value,” and it is also difficult to view that the Defendant’s act violates social rules under Article 20 of the Criminal Act, and it does not seem to have extended the scope of punishment by examining various issues regarding personal information.

(2) Whether Article 71 Subparag. 6 and Article 59 Subparag. 3 of the Personal Information Protection Act (the leakage, etc. of personal information by a person who manages or was managing the personal information) applies

In addition, this part also does not constitute the divulgence of personal information in full view of the contents of the relevant personal information and the extent to which the individual can be identified, the circumstances such as the party who leaked the personal information, the purpose and circumstances, and the need for the protection of personal information and the balance between the legitimate

4. Conclusion

Therefore, the facts charged in the instant case constitute a case where there is no proof of facts constituting the crime, and thus, the acquittal is pronounced in accordance with the latter part of Article 325 of the Criminal Procedure Act, and the summary of the judgment is publicly announced in accordance with Article

[Separate] Crime List: Omitted

Judges Kim Min-soo

1) The police had both authoritative interpretation and legal advice of the relevant agency. As a result of an inquiry into the Personal Information Protection Commission, the police decided that the act constitutes a prohibited act under Article 59 subparag. 2 and subparag. 3 of the Personal Information Protection Act (Evidence No. 298). However, as a result of legal advice from the Government Law Firm’s legal advice and consultation from the Gyeongnam Provincial Police Agency, “It is difficult to see the leakage of personal information as it is difficult to see that the disclosure of personal information is made with the implied consent of employees, and it is difficult to see that the prohibition of private use is a prohibition of unlawful use (Evidence No. 51, No. 153).”

2) A person who falls under any of the following subparagraphs shall be punished by imprisonment for not more than five years or by a fine not exceeding 50 million won. 5. A person who discloses personal information learned in the course of performing his/her duties in violation of subparagraph 2 of Article 59, or provides another person with such information without authority, and a person who knowingly receives such information for profit or for an illegal purpose; 6. A person who damages, destroys, alters, forges, or divulges another person's personal information in violation of subparagraph 3 of Article 59, or who processes or processes another person's personal information, in violation of subparagraph 3 of Article 59, shall not commit an act falling under any of the following subparagraphs:

3) Before remanding the instant Supreme Court case, the lower court found the Defendant not guilty on the ground that the Defendant, who is the managing body of the Housing Act, cannot be deemed a “personal information manager” who manages the personal information file, and thus, did not fall under Article 71 subparag. 5 and subparag. 2 of Article 59. However, the lower court reversed this part in the final appeal.

4) Based on the above higher judgment, the above higher court cited the following: (a) in interpreting “personal information known to the Defendant in the course of performing all duties” as all personal information known to the “person who manages or processed the personal information” under subparagraph 2, there is a risk of excessively expanding the scope of punishment for the act of divulging personal information to a person who holds the status of “a person who manages or processed the personal information”; and (b) in cases where a person who is not “a person who manages or handled the personal information” divulges personal information known to him/her in the course of performing duties, he/she does not comply with the rules of separate punishment and equity.” However, the above case is not guilty on the ground that the source of personal information listed in the A4 form at issue is unclear, and there is no evidence to regard it as personal information that the Defendant acquired the phone number from the occupational system.”

Note 5) The Defendant filed a complaint against a case involving comments on the internal bulletin board, and whether the actual crime of defamation is constituted is not directly related to the instant case, and thus, is omitted.

Note 6) The name and position of the accused accused are information already disclosed in the comments comments on the bulletin board, and it does not constitute personal information leakage but was not prosecuted in this case.

7) The definitions of the terms used in this Act are as follows: 1. Information pertaining to a living person, which falls under any of the following information. (a) The term “personal information” refers to information by which a person can be identified through his/her name, resident registration number, image, etc.; (b) information which does not by itself make it possible to identify a specific person but can be identified through simple combination with other information. In such cases, the time, expenses, skills, etc. required for the identification of an individual, such as the possibility of obtaining other information, must be reasonably taken into account. (c) whether a person can be easily combined. (a) or (b) by processing a pseudonym pursuant to subparagraph 1-2, thereby making it impossible to identify a specific person without the use or combination of additional information to restore the original state (hereinafter referred to as “personal information”).

8) The Supreme Court Decision 201Da24555, 24562 Decided May 16, 2014 held that “Leakage of personal information protected by the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.” refers to a situation in which personal information is leaked to a third party beyond the right to manage and control the relevant provider of information and communications services, and a third party becomes aware of its contents. If a certain personal information is under the management and control of the provider of information and communications services and is not actually perused or accessed to a third party, it is insufficient to take technical and administrative protective measures of the provider of information and communications services, even if it is in a situation in which the third party is accessible to the personal information kept by the provider of information and communications services through a specific website, it cannot be said that the personal information is in a situation in which the third party becomes aware of its contents beyond the right to manage and control of the provider of information and communications services, and the decision of the court below affirming the purport that “the disclosure of personal information is not yet disclosed to a third party’s personal information manager or its identity.”

9) A police officer’s representative may be found to have leaked information to an external business operator. In Daejeon High Court Decision 2019No189, the police taken photographs indicating the name, class, etc. of the police officer in charge of controlling sexual traffic establishments and provided them to the external business operator, the police officer found him/her guilty.

(10) Supreme Court Decision 2017Do7687 Decided September 21, 2017; Supreme Court Decision 2018Do3443 Decided July 24, 2018

Note 11) Except for those who had been already aware of the phone number among the persons accused by the Defendant, only those who have newly inquired of the mobile phone number in this case is prosecuted.

12) The purpose of this Act is to protect the freedom and rights of individuals and further to realize the dignity and value of individuals by prescribing matters concerning the management and protection of personal information.

(13) The Supreme Court Decision 2015Do13739 Decided November 26, 2015 (No plate) ruled that the defendant, the representative committee member of an aggregate building and the chairman of a shopping district revitalization promotion committee, are not guilty on the grounds that the name, resident registration number, address, etc. of the victim stated in the report on shop owners and shop occupants, and that the first and the second instance court did not constitute personal information controllers (However, in the second instance, it was added to the ancillary charges that the defendant was provided with personal information for an illegal purpose by the entrusted management company, and this became final and conclusive). The Supreme Court Decision 2014Do7598 Decided that the defendant was not guilty on the grounds that the defendant was not guilty of personal information collected and retained by the entrusted management company and stated a cell phone number, and that the appeal was final and conclusive on July 25, 2019 by the Supreme Court Decision 201Do3215 Decided June 25, 2019.