[Column] What should be done to take action to leakage of personal information?

The Supreme Court has attracted keen attention regarding its final decisions on two lawsuits claiming damages related to leakage of personal information (2017Da207994, 2017Da256910) in December of 2018, saying that KT is not responsible for damages (hereafter "these decisions").

In these decisions, a Mr. Choi illegally acquired and leaked over 10 million cases of personal information of KT customers for five months by developing a hacking program in April 2012. In connection with this case, many victims of the personal information leakage (the claimants) filed a claim for damages against KT (the defendant), but the Supreme Court closed the case by turning down the claims from the claimants.

In this case, the Supreme Court inclusively examined whether KT had taken all possible protective measures reasonably expected of an ICT service provider based on common sense as of 2012 when this case took place. In particular, it determined whether KT faithfully took technical and administrative protective measures as provided under the statutes related to personal information.

The statutes before the amendment were applied to this decision, as this case of personal information leakage took place in 2012. The Korean statutes concerning the protection of personal information were amended extensively in and after 2012, newly inserting certain stringent punitive provisions on statutory damages, the recommendation of disciplinary punishment of the representatives, etc. Thus, businesses can no longer neglect their control of personal information following this decision.

Instead, a penalty of up to 3 million KRW per case may now be imposed for compensation of damages caused by leakage of personal information due to the amendment to the Personal Information Protection Act. Thus, the necessity has been further reinforced for the businesses to faithfully take measures to secure the safety of personal information and to perform the standards for the technical and administrative protective actions as required under the amended statutes.

VEAT Law Firm strives to provide the best services concerning personal information by deploying a personal information team consisting of lawyers responsible for cases related to legal counsel and consulting on the protection of personal information and crisis management. The personal information team of VEAT Law Firm, consisting of lawyers who majored in IT and other engineering subjects, has enjoyed a high reputation among clients as they have a high degree understanding of the IT systems that are employed to protect personal information, including precedents or authoritative interpretations of statutes related to the protection of personal information.

Those requiring legal counsel and consulting in connection with their actions to incidents involving leakage of personal information or deployment of a system for the protection of personal information are invited to contact VEAT Law Firm at their convenience.