Kakao Loses Lawsuit Challenging Fine for 'Personal Information Leak'... Court: "Failure to Notify Authorities and Users Is Illegal"

Kakao, which was fined 15.1 billion won for leaking personal information, filed an appeal but lost the case.

On January 15, the Seoul Administrative Court's 14th Division for Administrative Cases (Presiding Judge Lee Sangdeok) ruled against the plaintiff in a lawsuit filed by Kakao seeking to overturn the imposition of fines and corrective orders by the Personal Information Protection Commission (PIPC).

In 2023, following media reports that personal information of KakaoTalk Open Chat users was being illegally traded, the PIPC investigated whether Kakao had violated the Personal Information Protection Act. The investigation revealed that Kakao had inadequately managed member data, resulting in the leak of approximately 65,000 records. In May 2024, the PIPC imposed a record-high fine of over 15.1 billion won for violating safety management obligations. In November of the same year, Kakao filed an administrative lawsuit, claiming the penalty was unjust.

However, the court found the PIPC's imposition of the fine to be lawful. The court explained, "The Open Chat database, which combined mobile phone numbers, profile names, names of participating Open Chat rooms, and corresponding Open Chat room profiles, was disclosed and sold online, constituting a personal information leak. Kakao's failure to report or notify authorities and users about the leak was illegal."

The court also pointed out that, given Kakao only implemented encryption for newly created Open Chat rooms from August 5, 2020, the company either recognized, or at the very least should have recognized, the reality of security risks or the potential for personal information leaks, yet failed to take further corrective action. The court also deemed the scale of the fine appropriate based on the calculation standards.