Supreme Court Confirms Cancellation of 70 Million KRW Fine Imposed on KT for Customer Personal Information Leak

[Asia Economy Reporter Kim Daehyun] The Supreme Court has ruled that the Korea Communications Commission's imposition of a 70 million won fine on KT for leaking customer personal information due to a website hacking incident was unjust and should be canceled.

On the 13th, the Supreme Court's 3rd Division (Presiding Justice Ahn Cheolsang) announced that it upheld the lower court's ruling in favor of KT in the appeal case filed against the Korea Communications Commission's fine imposition.

Previously, from August 2013 to February 2014, KT's websites such as 'My Olleh' and 'Olleh Club' were hacked. At that time, hackers illegally accessed billing statements on the websites and used retired employees' IDs, resulting in the leakage of a total of approximately 11.7 million pieces of personal information, including the names and resident registration numbers of 9.8 million KT customers.

In response, the Korea Communications Commission imposed a fine of 70 million won on KT for failing to properly protect personal information. However, KT filed an administrative lawsuit, claiming that it had taken all measures according to the Commission's personal information protection standards.

The first and second trials ruled in favor of the plaintiff. Although it was acknowledged that KT provided an opportunity for hacking by not deleting retired employees' IDs, the courts judged that sufficient measures were taken, such as installing firewalls and intrusion detection systems and regularly conducting simulated hacking tests.

The Supreme Court also agreed with this judgment. The court stated, "It is difficult to conclude that the plaintiff failed to take technical protective measures to prevent leakage of personal information handled by itself due to hacking, as stipulated in Article 4, Paragraph 9 of the Korea Communications Commission's notice," and added, "The defendant's assessment of the plaintiff's violation as a 'serious violation' and the calculation of the fine constitute an abuse of discretion."

Furthermore, the court dismissed the Commission's appeal, stating, "The lower court did not err in its legal reasoning regarding the abuse of discretion in calculating the fine."