Supreme Court: "No Liability for Data Breach if No Damages Are Proven"

HappyCampus Data Breach Lawsuit
Supreme Court Upholds Lower Courts' Dismissal

The Supreme Court has ruled that if a company can prove that a data breach did not cause sufficient emotional distress to warrant compensation, it is not liable for statutory damages to customers.

Supreme Court, Seocho-gu, Seoul. Photo by Yonhap News

According to the legal community on January 14, the Supreme Court's Second Division (Presiding Justice Oh Kyungmi) upheld the lower court's ruling against the plaintiff in a damages lawsuit filed by user A against HappyCampus, an operator of a knowledge trading service.

In September 2021, a hacking incident at HappyCampus resulted in the personal information of approximately 403,000 individuals, including the plaintiff, being leaked. The plaintiff's encrypted password and email address were among the compromised data. The plaintiff argued that HappyCampus had been negligent in controlling external access, leading to the data breach, and claimed 300,000 won in damages, citing emotional distress due to concerns over receiving spam emails and the risk of secondary damage such as voice phishing.

Both the first and second trial courts dismissed the plaintiff's claims. While the courts acknowledged that A may have experienced anxiety or discomfort due to the data breach, they determined that this did not constitute emotional distress severe enough to warrant compensation.

The Supreme Court concurred and dismissed the final appeal, thereby confirming the lower court's ruling against the plaintiff. The Supreme Court stated, "In order to claim statutory damages under the Personal Information Protection Act, a data subject only needs to allege and prove that their personal information was lost, stolen, leaked, forged, altered, or damaged, without the need to specifically prove the occurrence of damage."

However, the Court added, "It is not the intent of the Personal Information Protection Act to impose liability for damages in cases where it is clear that no harm has occurred. If a data subject claims compensation for emotional distress, the data controller can avoid statutory liability by proving that the data subject did not suffer emotional distress sufficient to warrant compensation." Regarding the HappyCampus case, the Court concluded, "It is difficult to recognize emotional distress severe enough to warrant compensation," and affirmed the lower court's ruling against A.