2018Da21994 Compensation (as referred to)

2018Da22000 (Consolidation) Compensation for damages (a consolidation)

A person shall be appointed.

Attached Form 1 is as shown in the list of plaintiffs.

1. B

2. 코리아크레딧뷰로 주식회사

Seoul High Court Decision 2017Na200607, 2017Na2006014 decided January 31, 2018

(Consolidation) Judgment

December 13, 2018

All appeals are dismissed.

The costs of appeal are assessed against the Defendants.

The grounds of appeal are examined.

1. As to the ground of appeal No. 1 by Defendant B (hereinafter “Defendant B”)

A. For the following reasons, the lower court determined that Defendant B was liable for damages suffered by the Plaintiff, etc. due to the leakage of customer information of F’s card cards pursuant to Article 39 of the former Personal Information Protection Act (amended by Act No. 13423, Jul. 24, 2015; hereinafter “Personal Information Protection Act”), since Defendant B violated the legal obligations and obligations that the personal information manager should comply with for the protection of personal information, and the occurrence of the accident involving the personal information of the Plaintiff (designated parties) and the Plaintiffs (hereinafter “Plaintiff et al.”).

Defendant B is a personal information controller under the Personal Information Protection Act or the former Electronic Financial Transactions Act (hereinafter “Personal Information Protection Act”).

22. Any electronic financial business entity, as prescribed by this Act, is obligated to take measures necessary to ensure the safety of personal information or to protect user information as prescribed by relevant statutes, such as each Act and Enforcement Decree thereof, and public announcement (based on measures to ensure the safety of personal information).

그런데도 피고 B는 피고 코리아크레딧뷰로 주식회사 ( 이하 ' 피고 KCB ' 라 한다 ) 와 카드 사고분석시스템 ( Fraud Detection System, 이하 ' FDS ' 라 한다 ) 업그레이드 관련 개발용 역계약을 체결한 후 피고 KCB의 개발인력들에게 카드고객의 개인정보를 제공하여 취급하도록 하는 과정에서 위와 같은 법령들을 위반하여 보안프로그램 설치 및 관리 · 감독의무, 암호화된 카드고객정보 제공의무, 접근권한 제한 등 보안조치를 취할 의무, 개인정보 처리업무 위탁 시 기술적 · 관리적 보호조치에 관한 문서약정의무, 단말기에 이용자 정보를 보관 · 공유하지 않을 의무 등을 다하지 않았다 .

B. Examining the relevant statutes and the record, the lower court’s aforementioned determination is justifiable. In so doing, contrary to what is alleged in the grounds of appeal, the lower court did not err by exceeding the bounds of the principle of free evaluation of evidence inconsistent with logical and empirical rules, or by misapprehending the legal doctrine on the establishment of various duties of care and liability to compensate for damages

2. As to the grounds of appeal Nos. 1, 2, and 3 by Defendant KCB, the lower court, on the grounds as indicated in its reasoning, determined that Defendant KCB was liable to compensate the Plaintiff, etc. for damages caused by the divulgence of customer information to the Plaintiff, etc., on the ground that it is difficult to view that Defendant KCB’s employees disclosed the card customer information regarding the performance of its duties, and Defendant KCB’s direction and supervision over F, etc., and thus, Defendant KCB was jointly with Defendant B, as an employer, pursuant to Article 756(1) of the Civil Act.

In light of the relevant legal principles and records, the above determination by the court below is just, and contrary to the allegations in the grounds of appeal, the court below did not err by exceeding the bounds of the principle of free evaluation of evidence against logical and empirical rules, or by misapprehending the legal principles on the relationship with employer responsibility, exemption, and causation.

3. As to Defendant B’s ground of appeal Nos. 2 and Defendant KCB’s ground of appeal No. 4

A. In a case where the personal information collected by a person who manages the personal information was divulged against the intent of the subject of information, the determination should be made on a case-by-case basis, comprehensively taking into account the following: (a) the type and nature of the leaked personal information; (b) the type and nature of the leaked personal information; (c) the likelihood of perusal by the subject of information; (d) whether the leaked personal information was accessible or could be perused in the future; (e) the scope of the leaked personal information was spread; (e) whether there was additional infringement of legal interests; (e) the fact that the subject of information managed the personal information; and (e) what measures were taken to prevent the occurrence and spread of the leaked personal information (see, e.g., Supreme Court Decision 2011Da59834, Dec. 26, 2012). Moreover, with respect to the amount of consolation money for emotional distress inflicted on a tort, the fact-finding court may determine ex officio discretion, taking into account various circumstances into account.

B. In light of the circumstances stated in its holding, the lower court determined that it is reasonable to view that the Plaintiff, etc. actually suffered mental damage due to the divulgence of the card information by social norms, etc., since it is highly likely that the Plaintiff, etc., who was leaked by F, had already been perused by a third party during the propagation and dissemination process of the dissemination and dissemination of the card by the Plaintiff, etc., and that the Defendants jointly determined consolation money as KRW 100,000 for the Plaintiff

C. Examining the aforementioned legal principles and records, the above determination by the court below is just, and the amount of consolation money set by the court below does not exceed the bounds of discretion against the principle of equity. Therefore, the court below did not err in its judgment by exceeding the bounds of the principle of free evaluation of evidence against logical and empirical rules, or by misapprehending the legal principles on the scope of liability for damages and the occurrence of mental damage, or omitting judgment, contrary to what is alleged in the Defendants’ grounds of appeal.

4. Conclusion

Therefore, all appeals are dismissed, and the costs of appeal are assessed against the losing party. It is so decided as per Disposition by the assent of all participating Justices on the bench.

Justices Kwon Soon-il

Justices Lee Dong-won

Justices Park Jung-hwa

Justices Kim Gin-soo

A person shall be appointed.