Supreme Court: "Saemaeul Geumgo Staff Are Not 'Third Parties' Under Personal Information Law"...Case Remanded for Acquittal

Misinterpretation of Legal Scope of Punishable Violations under the Personal Information Protection Act
The Supreme Court: "Internal Executives and Employees Are Not Subject to This Provision"
First and Second Instance Guilty Verdicts Overturned and Case Remanded

The Supreme Court has remanded the case of the chairman and staff of Saemaeul Geumgo, who had provided the financial transaction records of dismissed workers to a lawyer without consent and used them in litigation to respond to a lawsuit, with a view to acquittal. The court held that internal executives and employees do not fall under a "third party who received personal data" subject to punishment under the Personal Information Protection Act.

The Supreme Court in Seocho District, Seoul. Yonhap News

According to the legal community on the 16th, the Second Division of the Supreme Court (Presiding Justice Noh Taeak) overturned the lower court ruling that had imposed fines on former chairman A of Seoincheon Saemaeul Geumgo, deputy department head B, and lawyer C, who had been indicted on charges including violation of the Personal Information Protection Act, and remanded the case to the Incheon District Court.

A and B were indicted on charges of having, in August 2019, unlawfully used workers' financial information to respond to an application for a provisional disposition for wage payment filed by seven workers who had been dismissed for disciplinary reasons. They printed out documents such as a "Comprehensive Certificate of Members' Transaction History," which contained the workers' deposit balances and amounts available for payment, and sent them by fax and email to their litigation representative, lawyer C, without the workers' consent. Lawyer C then submitted these documents to the court as supporting evidence.

The prosecution brought them to trial on charges of violating former Article 19 of the Personal Information Protection Act. This provision prohibits any person who has received personal data from a personal information controller from providing it to a third party or using it for other purposes without the data subject's consent.

The first-instance court found them guilty. The court stated that they "disclosed personal data without the data subjects' consent and submitted it as litigation materials," and sentenced A to a fine of 7 million won, and B and lawyer C to fines of 3 million won each. The appellate court upheld the first-instance judgment.

The Supreme Court, however, reached a different conclusion. The bench held that the defendants did not fall under "a person who has received personal data from a personal information controller," which is the category of persons subject to punishment under Article 19.

The court stated, "When a 'personal information handler,' such as an executive or employee who processes personal data under the direction and supervision of a personal information controller (Saemaeul Geumgo), receives personal data for the performance of their work, this does not constitute a 'person who has received personal data' as defined by law." In other words, A and B were internal handlers within Saemaeul Geumgo, and it was not the case that they had received information as external third parties.

The court went on to point out, "Even if a personal information controller provides information in violation of the law and can be punished under other provisions, internal executives and employees cannot be punished for violating Article 19." As the guilty portion was thus overturned, the Supreme Court ordered a new trial on the remaining charges as well, for which a single sentence had been imposed in conjunction with the Article 19 violation.