Heat High Communications Co., Ltd. (Law Firm Squa, Attorneys Jeong Young-hun et al., Counsel for the defendant-appellant)

Korea Communications Commission (Law Firm, Kim & Lee LLC, Attorneys Jeon-tae et al., Counsel for the defendant-appellant)

November 28, 2013

Seoul Administrative Court Decision 2012Guhap21154 decided May 2, 2013

1. The plaintiff's appeal is dismissed.

2. The costs of appeal shall be borne by the Plaintiff.

1. Purport of claim

The imposition of penalty surcharges, corrective measures, and publication order stated in [attached Form] to the Plaintiff on June 19, 2012 shall be revoked, respectively.

2. Purport of appeal

The part against the plaintiff in the judgment of the first instance shall be revoked. The defendant shall revoke the corrective measures and publication order stated in [attached Form] to the plaintiff on June 19, 2012, respectively.

1. The part citing the judgment of the court of first instance

In the reasoning of the judgment of this court, the part of the reasoning of the judgment of the court of first instance is identical to that of the above part (except for the part concerning imposition of penalty surcharges corresponding to the part against the defendant among the judgment of the court of first instance, excluding the part concerning imposition of penalty surcharges corresponding to the part against the defendant among the judgment of the court of first instance), and thus, it is cited in accordance with Article 8(2) of the Administrative Litigation Act and the main sentence of Article 420 of the Civil Procedure Act.

2. Parts to be dried;

A. Article 64(4) of the Information and Communications Network Act provides that “The information and communications service provider who violated the Information and Communications Network Act has received corrective measures and corrective measures necessary to correct the violation,” and Article 64(4) of the Act on Information and Communications Network Utilization and Information Protection, which provides that “The content of the Measures to be taken and the content of the Measures to be taken and the content of the underlying Act and the relevant Act and subordinate statutes have taken each disposition in the column of the Act on Information and Communications Network Utilization and Information Protection.”

B. The fifth to sixteen parts of the judgment of the court of first instance are as follows.

D. In addition, the Plaintiff posted a notice of the completion of prior consultation with the Defendant on the first page of the Internet homepage between June 6, 2013 and June 7, 2013, and posted it on the first page of the Internet homepage, and implemented the instant order for publication by inserting it for one day on the “Cultural”, which is a central daily newspaper distributed nationwide.

(c) Nos. 1, 16, and 17 of the first instance court’s fifth 20th 20th s. “Evidences. 1, 16, 17, and 32-1, 2 of the first instance court’s 5th 20th s.

D. On July 4, 2011, part of the first instance court’s first instance court’s decision that “it was erroneous on the premise of an erroneous fact (hereinafter “the assertion of an erroneous fact”) was unlawful since it was based on the premise of an erroneous fact.” Even if it is deemed otherwise, in the case of the event screen produced and posted before July 4, 201, the Defendant used not only the agreement pumps that make it possible for the Plaintiff to clearly recognize the fact that the information collected by the Plaintiff was “personal information” and the fact that the Plaintiff collected personal information and provided personal information to a third party, but also, without providing separate commodities, posted the information entry under the Information and Communications Network Act without providing personal information. Accordingly, the part that the Plaintiff obtained consent from the user on the collection and provision of personal information through the event screen produced and posted before July 4, 2011 is legitimate, each of the instant dispositions should be revoked (hereinafter “the allegation”).

E. Article 18-19 of the first instance judgment provides that “The consent to collect personal information and the consent to provide information to a third party are made in a separate process” (after July 4, 2011, following the amendment of the Information and Communications Network Act, the consent to collect personal information and the consent to provide information to a third party are made in a separate process).”

F. No. 10-12 of the judgment of the court of the first instance is the same as indicated on the 10-12 screen of this case which the Defendant deemed unlawful at the time of each disposition of this case (hereinafter referred to as “the 10-10-10-12 screen of this case”) that “The 10-10-10-10-12 screen of this case (hereinafter referred to as “the 10-10-10-7 screen”) is identical to the following: (a) the 10-10-10-10-2 screen of this case which the Defendant determined to be unlawful at the time of each disposition of this case (hereinafter referred to as “the 10-10-10-100-7 screen”) is different from the type of the open market on which it was posted; (b) the 10-10-7-10-10-10-200-2 screen of this case’s screen which is more than the 10-7-10-100-2-2-10000-2 screen screen.

(g)No. 1 of the 11th decision of the first instance court added “The 1-1>> under the following:

A person shall be appointed.

(h) Part 5 to 7 of the decision of the court of first instance shall be followed as follows.

On or after July 4, 2011, the table of pop-up shop published in the main text: ① “At the time of obtaining a premium in a scop-up shop, it shall be selected to confirm the consent to the information collection and utilization at the bottom if it is intended to participate in scop-up, ② “At the time of participation in the scop-up shop, it shall be selected to confirm the consent to the information collection and utilization at the bottom; ③ “at the time of consent, it is possible to open the premium by drawing,” and “I agree to the collection and utilization of personal information at the bottom if I wish to participate in the scop-up shop” before July 4, 2011. “At the time of consent, I shall choose to do so.”

3. Judgment on the plaintiff's assertion

A. Judgment on the assertion of mistake of fact

(1) Relevant legal principles

Article 10 of the Constitution of the Republic of Korea provides for human dignity and value, the right to pursue happiness, and Article 17 of the Constitution of the Republic of Korea’s freedom of privacy. The above provisions also provide for the purpose of guaranteeing an active right to control an individual’s personal information autonomously in the modern society with high-level informatization (see Supreme Court Decision 96Da42789, Jul. 24, 1998). Based on the above provisions, an individual’s right to decide to what extent his/her personal information should be disclosed and used by anyone, i.e., the right to self-determination (personal information) to decide on the disclosure and use of personal information by an individual who is an owner of information, and to obtain consent from the user of information and communications services (see, e.g., Constitutional Court Decision 9Hun-Ma513, 2004Hun-Ma190, May 26, 2005). In order for the provider to obtain consent from the user of information and communications services, the provider should obtain consent from the user of information and communications services.

With the above purport and content of the relevant laws and regulations, the modern society, along with the development of information and communications technology, increases the risk of using or disclosing personal information or various information in life, regardless of the intention of the subject of information, and the consent to collect and provide personal information to a third party is deemed important to protect the freedom of decision-making of the subject of information since the relevant subject of information clearly recognizes the reason or impact of collecting and providing personal information to a third party and it constitutes waiver or restriction of the right to self-determination of personal information. In light of the fact that the relevant subject of information and communications services is deemed important to protect the freedom of decision-making of the subject of information, the user of information and communications services, who is the subject of information, has the right to decide and control the disclosure and use of personal information. As a process of realizing such right, the collection and use of personal information and the consent to provide information to a third party should be supported by the realization of the right to self-determination of personal information guaranteed by the user of information and communications services.

Ultimately, in full view of the above-mentioned circumstances, in order for the user’s consent necessary for collecting and using personal information and for providing a third party’s personal information as prescribed by the Information and Communications Network Act to obtain explicit consent, it is not sufficient to simply give the user awareness of the fact that the information and communications service provider seeks consent to collect and use personal information, and the notification matters as prescribed by the Information and Communications Network Act (hereinafter “legal notification matters”) to be notified in advance to obtain such consent, and it should be deemed that the user has made a determination and decision on whether to give consent according to the user’s voluntary consent under clearly recognizing and confirming the fact that the provider seeks consent to collect and use personal information, obtain consent to provide a third party’s personal information, and the legal notification matters. Furthermore, if such user’s consent is deemed to be a substantial consent without the formal consent, it is easy to understand the “U.S.” legal notification matters by clearly expressing it to the user and obtaining consent from the user.

(2) Determination

In full view of the following circumstances in light of the above legal principles and the facts cited earlier, it is reasonable to view that the instant event screen produced and posted by the Plaintiff was not clearly indicated in advance the statutory notice matters, and that, from the user of the instant event screen, it does not seem to have selected the “verification” tag located below the instant pop-up shop text indicated on the instant event screen while clearly recognizing and confirming the legal notice necessary for the user’s consent to collect and provide a third party personal information in the process of using the screen. Therefore, it is reasonable to view that the Plaintiff did not obtain the user’s express consent necessary for collecting and providing personal information as prescribed by the Information and Communications Network Act in collecting personal information of the user through the instant event screen. Ultimately, this part of the Plaintiff’s assertion on the premise that the user’s consent was legally obtained.

(3) As long as it is difficult to readily conclude that the Plaintiff’s intent to participate in the display of e-mail at least 7 e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail (this case’s e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail) is included in the display of e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail (this case’s e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail e-mail).

(B) The following circumstances revealed by the facts cited above and evidence, i.e., (i) the Plaintiff posted this case’s screen on the open market rather than for the purpose of providing discount coupons, etc. to traders, including insurance companies that have concluded a commercial contract with the Plaintiff, etc. with respect to personal information collected or collected from the participants. (ii) The content that this case’s screen provides discount coupons, etc. to the participants, etc. is cut short on the upper part of the screen and is so big as to indicate the purpose of collecting and providing personal information to third parties on the screen, and the contents of this case’s screen are indicated relatively small letters at the bottom of the above screen. (iii) The content of this case’s screen is not easily identified by the Plaintiff that the user could not remove the screen screen so that it can not be seen as below the display board, and the content of this case’s screen that the Plaintiff would not have agreed to the display of personal information on the screen without the Plaintiff’s consent to the display of the 3rd party’s personal information on the screen.

(C) In addition, even if the method of consent by the pop-up shop itself is permitted with respect to the pop-up shop appearing in the event that the participants in the event through the instant event want to participate in the event without any body straw, the consent can be deemed lawful under the sufficiently secured condition that the participants have a clear possibility of collecting and providing personal information to a third party. However, the phrase of the pop-up shop of this case does not include the content of collecting and providing personal information by itself, or does not include the above contents of collecting and providing personal information in light of the type of the instant event screen or specific contents, etc., the subject of collecting and providing personal information is “personal information” and it cannot be deemed that the location of the personal information is an insurance company with a third party. ② In addition, if the pop-up shop of this case selects the opportunity to consider the “sop-up shop” under the phrase of this case, the method of providing personal information should be clearly explained to the Plaintiff without the consent of the participants in the instant procedure.

(D) Furthermore, based on the facts cited earlier and evidence, etc., ① the above 3 pop-up screen consisting of: (i) the above 2nd son> the 3nd son 2nd son 3nd > the above 3nd son 3nd son 4nd son 4nd Professor, etc., and there is a way to display the physical cop-up screen of this case easily and clearly indicating the contents of the cop-up screen, but the Plaintiff posted the legal cop-up screen without sufficient guidance on the collection of personal information on the original cop-up advertisement or the above screen; and (ii) the Plaintiff produced and posted this case’s cop-up screen for the purpose of collecting personal information from the insurance company to the maximum extent possible; and (iii) the Plaintiff’s cop-up screen is no more likely to use the cop-up screen to present the contents of the cop-up screen to the maximum extent possible after collecting and posting the personal information in this case’s cop-up.

(E) Meanwhile, the Plaintiff asserts to the effect that, in cases of other providers of information and communications services than the Plaintiff, as long as the legal notice necessary for the collection, etc. of personal information is not immediately placed under the personal information entry column, it cannot be deemed unlawful, inasmuch as the link is simply provided or the legal notice to use the screen is made within the same page. However, according to the evidence cited earlier, the Plaintiff’s website, etc. of the provider of information and communications services cited by the Plaintiff as the subject of comparison with the screen of the instant event cannot be deemed unlawful. However, unlike the instant event screen, on the Internet page, etc. of the provider of information and communications services, the Plaintiff organized the provision of personal information after obtaining the user’s consent on the legal notice and the collection, etc. of personal information prior to the entry of the user’s personal information, and even if using the screen tower, there is a significant difference in the composition of the screen by concurrently posting the consent screen on the collection of personal information, etc., and the specific process of providing and collecting personal information also differs from the screen of this case for the purpose of collecting and providing personal information.

B. Determination on the assertion of violation of the principle of trust protection

(1) Relevant legal principles

In general, in administrative legal relations, in order to apply the principle of trust protection to an act of an administrative agency, first, an administrative agency must issue an official opinion that is the subject of trust to an individual, second, there should be no reason attributable to the individual when the statement of opinion of an administrative agency is well-grounded. Third, an individual should have trusted that the statement of opinion is well-grounded, and third, an administrative agency should have conducted any act against the above statement of opinion. Fourth, an administrative disposition against the above statement of opinion would result in an infringement on the individual's interest in trust. If a certain administrative disposition satisfies these requirements, an act against the principle of trust protection (see Supreme Court Decision 2004Du46, Jun. 9, 2006, etc.) is unlawful unless it is likely to seriously undermine the public interest or a third party's legitimate interest (see Supreme Court Decision 2004Du96, Jun. 9, 200). In determining whether there is a public opinion opinion of an administrative agency, in principle, it should be reasonable to determine that it is against the person who is an administrative organization's official authority.

(2) Determination

(A) Comprehensively considering the facts cited earlier and the purport of the entire pleadings, the Plaintiff asked the employees to question how to constitute the Plaintiff’s ec.g., “request for review of the consent to the propagation of the event” in the Defendant’s Internet homepage’s civil petition for grievance on April 26, 2010, along with the documents attached thereto. The materials attached by the Plaintiff were included in the ec.g. 5 Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec. Ec.

Article 24-2 of the Information and Communications Network Act provides that a person who receives personal information shall be notified of the purpose of the use of the personal information of the recipient, 3) item of the personal information provided by the recipient, 4) personal information retention and use period of the recipient’s personal information. Thus, if the recipient complies with the above matters, he/she shall be deemed to have received the consent of the user. 2. 3. It guarantees the user’s right to control personal information when providing a third party with personal information in the Information and Communications Network Act. Thus, it is necessary to ensure that the user’s consent is obtained at the time of providing a third party’s personal information. If an association for events is conducted, the user shall be notified of the four matters listed in Article 24-2 of the Information and Communications Network Act and advise the user to obtain the consent of the user. In addition, the method of obtaining the user’s consent by posting the information and communications service to the user or by sending the information and communications service to the user, and the method of obtaining the user’s consent shall be specified in the following:

(B) According to the above facts, it appears that the above response by the defendant was close to a general theoretical opinion that the defendant's person responsible for the defendant's oral response was made in the process of dialogueing the plaintiff's civil petition for grievance received through the "civil petition for grievance" which can be raised by many unspecified persons on the defendant's website in the form of telephone counseling with the plaintiff's side, and the contents of the response are "legal if the information and communications network law has been complied with" as a whole. In addition, the above response by the defendant merely indicates an abstract judgment by the defendant within the scope of the plaintiff's unilateral data submitted by the plaintiff on the basis of only the data submitted by the plaintiff, and it is merely a provisional response based only on the data provided by the plaintiff at the time of the above response without an investigation, such as facts by the defendant's side, etc. before the above response, and considering the contents and form of the plaintiff's questioning, etc., even if all of the evidence and its arguments submitted by the plaintiff were presented by the plaintiff, the defendant's general opinion as to the plaintiff's explanation cannot be acknowledged as a public opinion.

(C) Ultimately, this part of the Plaintiff’s assertion based on such different premise cannot be accepted without further review (On the other hand, the Plaintiff appears to have asserted that each of the instant dispositions violates the principle of trust protection on the grounds of “public prosecutor’s non-prosecution disposition” or “a reply to civil petition at the Seoul Regional Fair Trade Office” as cited earlier, but it is difficult for the prosecutor, etc. to assert a violation of the principle of trust protection on the ground of the aforementioned non-prosecution disposition, etc. on the ground that it constitutes a separate government agency separate from the Defendant, which is the disposition authority of each of the instant dispositions, as it constitutes a separate government agency separate from the Defendant. Furthermore, according to the facts cited earlier, it is difficult for the prosecutor, etc. to assert a violation of the principle of trust protection on the grounds of the aforementioned non-prosecution disposition or the reply to civil petition. Furthermore, according to the aforementioned facts cited earlier, it is not

C. Determination on the assertion of deviation or abuse of discretionary power

The reasoning for this part of the judgment is as follows. This part of the corresponding part of the judgment of the court of first instance (as stated below, No. 11 to 31 of the judgment of the court of first instance) is the same as the above part, and therefore, it shall be cited in accordance with Article 8(2) of the Administrative Litigation Act and Article 420 of the Civil Procedure Act.

(1) On the other hand, Article 22(1), Article 24-2(1), and Article 31(1) of the Information and Communications Network Act provides that “The violation of the Information and Communications Network Act, which is in violation of the Information and Communications Network Act, is different from the Plaintiff’s violation of the Information and Communications Network Act, which is the subject of each disposition of this case, is basically the subject of the determination whether it constitutes the collection of another person’s information by using “a method of speed” as provided by Article 49-2(1) of the Information and Communications Network Act. However, the Plaintiff’s violation subject to each disposition of this case is clearly different from the instant case.”

(2) The following is added between 31 and 7-8 of the first instance judgment.

(1) Each of the dispositions of this case at an appellate court asserted that the disposition of this case is unlawful because it constitutes deviation or abuse of discretionary power due to sanctions taken based on the interpretation of analogy or expansion of the defendant's relevant provisions without any clear provision. However, as seen earlier, each of the dispositions of this case is a ground for the disposition that the plaintiff's consent was not obtained from the user based on Articles 22(1), 24-2(1), 26-2, and 31(1) of the Information and Communications Network Act, and Article 12 of the Enforcement Decree of the Information and Communications Network Act. Thus, it cannot be deemed that the above disposition was made without any legal basis. Furthermore, in general, an individual provision of any statute can be seen as having generality or abstract, in light of the contents and legislative intent of the superior law, and if the meaning of the individual provision can be reasonably predicted by examining the whole contents of the statute, etc., the meaning of each of the above individual provision does not seem to be somewhat meaningful, and it cannot be concluded that the legislative purport of the Act on the collection of personal information and its own consent.

4. Judgment on the plaintiff's additional argument in the appellate court

A. Summary of the plaintiff's assertion

(1) Articles 22(1) and 24-2(1) of the Information and Communications Network Act, which are the laws based on each of the dispositions of this case, applies to cases where “information and communications service providers” collect, use, and provide third parties personal information of “user”. Here, “user” refers to a person using information and communications services provided by a provider of information and communications services. However, a subject of information participating in the event of this case does not receive direct information and communications services from the Plaintiff after participating in the event, and does not constitute the Plaintiff’s user. Rather, considering that the Personal Information Protection Act, which is a general legal entity for the protection of personal information, was enacted on September 30, 201, and thus does not have practical benefits to widely interpret the concept of user, each of the dispositions of this case on the screen of this case after September 30, 2011, is unlawful without legal basis.

(2) Even if the Information and Communications Network Act still applies to each disposition of this case, Article 15(1)4 of the Personal Information Protection Act allows the collection and use of personal information without consent, “where inevitable to enter into and implement a contract with the information subject,” and the Personal Information Protection Act of a general corporation applies complementaryly to the Information and Communications Network Act. In addition, according to the Elimination of Personal Information Protection Act published by the Information and Communications Network Act, the implementation of the said contract is also included in the “performance of the said contract.” Therefore, the part subject to consent to collect and use of personal information for free delivery after September 30, 201, when the Personal Information Protection Act enters into force, shall be an exception without consent of the information subject. Ultimately, Article 15(1)4 of the Personal Information Protection Act, which is a general law, provides that Article 15(1)4 of the Information and Communications Network Act and Article 22(1)4 of the Information and Communications Network Act shall apply to the collection and use of personal information without consent of the user.

B. Determination

(1) Determination on the first argument

(A) According to Article 2(1)2 of the Information and Communications Network Act, the term “information and communications services” means telecommunications services under Article 2 subparag. 6 of the Telecommunications Business Act and providing or mediating the provision of information using telecommunications services. Article 2(1)3 of the same Act provides that “A provider of information and communications services” means a telecommunications business operator under Article 2 subparag. 8 of the Telecommunications Business Act and a person who provides or arranges the provision of information using telecommunications services by a telecommunications business operator for profit.” Article 2(1)4 of the same Act provides that “user” means a person who uses information and communications services provided by a provider of information and communications services.”

(B) According to the facts cited earlier and evidence, etc., the Plaintiff entered into a contract on the provision of personal information and the progress of events with a trader, such as an insurance company, etc. for telemarketing business. At the request of the trader, the Plaintiff may establish that the trader, by planning the event, produced the event page by providing discount coupons, etc. to the party participating in the event, and then operated the business of providing the event to the trader that requested the event. Thus, the Plaintiff is deemed to fall under an “information and communications service provider” as a person who provides or arranges the provision of the information and communications services using the telecommunications services of the telecommunications business operator for profit-making purposes. Moreover, even if the Plaintiff participated in the event that the Plaintiff provided the personal information and communications services on the screen of this case, the Plaintiff’s use of the information and communications services of this case does not constitute “the Plaintiff’s use of the information and communications services” of this case on the screen, the Plaintiff’s use of the personal information and communications services of this case does not constitute the Plaintiff’s use of the information and communications services.

(C) Ultimately, this part of the Plaintiff’s assertion asserted on a different premise is without any need to further examine it (On the other hand, the “Supreme Court Decision 2012Do4387 Decided October 17, 2013,” cited by the Plaintiff, is merely collecting the phone numbers of telephone subscribers who access to and manage another person’s communications networks managed by the Defendant, and thus, there is no clear relation between the Defendant and the above telephone subscribers, and thus, it cannot be concluded that each of the dispositions of this case is unlawful on the grounds of the judgment in the above judgment).

(2) Judgment on the second argument

(A) According to Article 2 subparag. 5 of the Personal Information Protection Act (amended by Act No. 10465, Mar. 29, 201; Act No. 10465, Sept. 30, 201; hereinafter “Personal Information Protection Act”), a person who is subject to the said Act, is clearly distinguishable from “information and communications services provider”, who is a criminal offender of the Information and Communications Network Act, as a “personal information manager,” who manages personal information directly or through another person for the purpose of operating personal information files for business purposes. Furthermore, Article 6 of the Personal Information Protection Act provides that “Although there are special provisions regarding the protection of personal information, the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., and Credit Information Use and Protection Act, it shall be governed by this Act, unless otherwise stipulated in other Acts, such as the said Act, and Article 2 subparag. 15 of the Information Protection Act, which provides that the Plaintiff’s consent cannot be applied to the collection and use of personal information by the said provider of information and communications services, etc.”

(B) Ultimately, we cannot accept the Plaintiff’s assertion on a different premise.

5. Conclusion

Therefore, the plaintiff's claim seeking the cancellation of corrective measures and publication order among the dispositions of this case is dismissed as it is without merit, and the judgment of the court of first instance on this point is just as above. Thus, the plaintiff's appeal is dismissed.

[Attachment]

Judges Lee Tae-tae (Presiding Judge)