beta
Text
All appeals are dismissed.
The costs of appeal are assessed against the Defendants.
Reasons
The grounds of appeal are examined.
1. As to the ground of appeal No. 1 of Defendant KB Card, the lower court acknowledged facts as indicated in its reasoning, and determined that Defendant KB Card Co., Ltd. (hereinafter “Defendant NB Card”) bears the duty to take measures necessary to ensure the safety of personal information or to protect user information as prescribed by the former Personal Information Protection Act (Amended by Act No. 13423, Jul. 24, 2015) or the former Electronic Financial Transactions Act (Amended by Act No. 11814, May 22, 2013); and that it bears the duty to take measures necessary to protect user information, such as the personal information manager prescribed by the former Personal Information Protection Act (Amended by Act No. 11814, May 22,
In addition, in the process that Defendant A Co., Ltd. (hereinafter “Defendant A”) entered into a development service agreement related to the card accident analysis system (FDS), and Defendant A’s development personnel provide a card customer’s personal information to the development personnel and handle the personal information, Defendant A did not fulfill the duty of installation and management of security programs in violation of the above statutes, the duty of management and supervision of documents regarding technical and administrative measures when entrusting the management of personal information, the duty of provision of encrypted card customer information, the duty of not sharing and sharing user information on the device, and the duty of taking security measures such as restriction on access authority, and thus, Defendant A was held liable to compensate the Plaintiffs from whom personal information has been leaked for damages incurred therefrom.
In light of the relevant legal principles and records, the lower court did not err by misapprehending the legal doctrine regarding the establishment of liability for damages by erroneously interpreting the standards for measures to ensure the safety of personal information, or by failing to exhaust all necessary deliberations accordingly, contrary to what is alleged in the grounds of appeal.
2. Defendant A’s ground of appeal.