[Personal Information] What are the countermeasures when a company leaks personal information?
Article posted in 2019-05-29 17:41:58 | VEAT
The Supreme Court has confirmed the ruling (2018 December) that KT was not liable for damages in two lawsuits (2017da207994, 2017da256910) related to a personal information leak incident that occurred in 2012, attracting considerable attention.
Examining the circumstances of the incident mentioned in this ruling, Mr. Choi and others developed a hacking program in April 2012 and illegally obtained and leaked over ten million customer personal information records from KT over a period of five months. (hereinafter referred to as “this case”) In connection with this case, a large number of personal information leak victims (plaintiffs) filed a lawsuit against KT (defendant) for damages, and the Supreme Court concluded the case with the plaintiff’s loss in this ruling.
In this ruling, the Supreme Court comprehensively examined whether KT, as an information and communication service provider, had taken all reasonably expected protective measures as of 2012, when this case occurred. In particular, it judged whether KT faithfully implemented technical and administrative protective measures stipulated in personal information-related laws.
This ruling pertains to a personal information leak incident that occurred in 2012, and the laws in effect prior to the amendments apply. Our personal information protection laws have undergone numerous amendments since 2012, and strong penalties such as statutory damages and recommendation of sanctions against representatives have been newly established; therefore, companies cannot neglect personal information management solely based on this precedent.
On the contrary, due to the personal information protection law amendment in 2016, damages can be imposed at a maximum of KRW 3 million per personal information record, so it is even more necessary for companies to faithfully implement safety assurance measures and technical and administrative protective measures for personal information before personal information leak incidents occur.
Law firm Veat has established a personal information team comprised of attorneys responsible for personal information protection consultation, consulting, and crisis response, and is striving to provide the optimal services related to personal information. The law firm’s personal information team, composed of attorneys with backgrounds in engineering and IT specialists, has been highly rated by clients for their high level of understanding of IT systems that implement personal information protection laws and relevant precedents and official interpretations.
If you need consulting regarding personal information leak incident response and personal information system establishment, please contact Law firm Veat.
Thank you.