The appeal is dismissed.

The costs of appeal are assessed against the Plaintiff.

The grounds of appeal are examined (to the extent of supplement in case of supplemental appellate briefs not timely filed).

1. As to the ground of appeal on damages claim part

A. Article 28(1) of the former Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (amended by Act No. 11322, Feb. 17, 2012; hereinafter “former Information and Communications Network Act”); Article 15 of the former Enforcement Decree of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (amended by Presidential Decree No. 23104, Aug. 29, 201; hereinafter “former Enforcement Decree of the Information and Communications Network Act”) provides for technical and administrative measures necessary to secure the safety of personal information to be taken by information and communications service providers to prevent the loss, theft, leakage, alteration or damage of personal information when handling personal information.

Therefore, the provider of information and communications services is legally obligated to take technical and administrative measures necessary to ensure the safety of personal information as stipulated in Article 28(1) of the former Information and Communications Network Act.

Furthermore, if a provider of information and communications services collected personal information, including personal information, from a user who intends to use information and communications services upon request through the terms and conditions of use, etc., the provider of information and communications services is obligated under the information and communications services contract to take necessary protective measures to prevent loss, theft, leakage, alteration or damage of the user’s personal information collected as above.

Therefore, the provider of information and communications services should take necessary protective measures to ensure the safety of personal information under Article 28(1) of the former Information and Communications Network Act or information and communications service contract.