A public official was found not guilty of unauthorized access to ex-lover's family information in Busan... why?

Personal information was accessed without permission 52 times through the social information security system.
Court: “It is an abuse of power, but there is no legal punishment”

A public official in Busan was put on trial on charges of accessing information about her ex-boyfriend's family without permission through an internal system, but was ultimately acquitted. The court ruled that although the actions of public officials may be grounds for disciplinary action, there is no legal basis for punishment.

According to the legal community on the 8th, the first division of the Supreme Court (Chief Justice Seo Kyung-hwan) confirmed the lower court's decision to acquit A (30s, female), a civil servant at a district office in Busan, who was indicted on charges of violating the Personal Information Protection Act.

Person A, who worked at an administrative welfare center in Busan, was indicted on charges of unauthorized access to the personal information of three people, including his ex-lover, Mr. B, and Mr. B's father and younger brother, through the social security information system on a total of 52 occasions between April and June 2022.

It is known that Mr. A was in a relationship with Mr. B from 2021 to May 2022.

The Social Security Information System was established by the government to manage welfare recipients, and Mr. A confirmed the name, date of birth, address, and phone number of Mr. B's family through this system.

Mr. A was in charge of social welfare work and had comprehensive authority to view personal information. However, during the viewing process, there was no consent from Mr. B, and when Mr. B found out about this fact, he filed a complaint and the investigation began.

The prosecution determined that Mr. A violated Article 59 (1) and Article 72 (2) of the Personal Information Protection Act because he acquired information without the consent of B's ​​father and without due process.

Article 59 of the Personal Information Protection Act prohibits a person who processes or has processed personal information from ‘obtaining personal information or obtaining consent for processing by false or other illegal means or methods.’ Article 72 punishes ‘a person who obtains personal information through lies or other illegal means or methods.’

The first trial court ruled that a crime can only be established if Mr. A not only abuses the authority given to him in accordance with the relevant provisions, but also obtains personal information through 'unfair means or methods.'

However, in order to view the personal information of Person B's family, Mr. A logged into the social security information system using his own ID and password, and in reality, there were no additional procedures to protect personal information, such as entering additional reasons or receiving approval from a superior every time personal information was viewed at the time.

Accordingly, the trial court of the first trial said, "It is difficult to say that Mr. A is committing 'false or other unfair means or methods' simply because he did not obtain the consent of the information subject or go through other legitimate procedures," and concluded, "In the process of actually viewing personal information, Mr. A needs a reason, such as a written or oral request from the complainant. If unauthorized viewing is made without such reason, it is an abuse of authority or exceeding the inherent limits of authority, and may be grounds for disciplinary action according to internal rules."

In addition, the ruling said, "Although Mr. A did not do anything wrong, it is difficult to say that the provisions raised by the prosecution were proven beyond reasonable doubt. Although Mr. A obtained information beyond his authority, he did not neutralize security procedures or provide false reasons, so he is acquitted."

The appellate court also dismissed the prosecution's appeal, saying, "When we review the original trial's judgment by comparing it with the records, the original trial's judgment is justified, and it cannot be said that there is an illegal misconception of facts."

The Supreme Court dismissed the prosecution's appeal, saying, "If we look at the reasons for the original trial's decision in light of the relevant legal principles and records, the original trial's judgment did not violate the rules of logic and experience, exceeded the limits of free deliberation, or misunderstood the legal principles regarding the establishment of a violation of the Personal Information Protection Act."

In other words, the judiciary decided that although Ms. A's act of viewing the personal information of her ex-boyfriend and his family without permission was an "abuse of her authority," she could not be criminally punished because there were no provisions to punish this.

In addition, in order to be punished for violating the Personal Information Protection Act, Mr. A must go beyond abuse of authority and use 'illegal means and methods'. However, since Mr. A only accessed the social security information system with his own ID and did not have any illicit means or methods, the court declared him not guilty.

In response to this, lawyer Jeong Sa-bong of Daeryun Law Firm (Limited) emphasized, "Until the law is revised, it is important to prepare self-help measures at the administrative level in order to fill the legal gaps related to personal information protection. In other words, it is necessary to prevent unauthorized viewing of personal information through self-help measures such as strengthening security through technical means, and to strengthen discipline and manage authority for inappropriate information viewing by public officials."

In fact, since last year, the Ministry of the Interior and Safety has reflected the 'Guidelines for Disciplinary Action for Violation of Personal Information Protection Laws', which states that public officials who inquire or leak personal information without permission may be dismissed or dismissed, in the 'Disciplinary Service Regulations and Manual'.

Regarding this, Attorney Jeong said, "This guideline only stipulates cases of 'serious harm to the information subject', such as cases of 'abuse for various crimes,' but it is difficult to evaluate it as a self-rescue measure to prevent simple harm to ordinary citizens," and suggested, "In order to recover from damage to citizens who have had unauthorized access, when the executive branch and local governments decide to take disciplinary action against unauthorized access to personal information, the minimum solution would be to reflect whether or not there has been an agreement with the victim in the standards for disciplinary action."

[View full article]
Public official not guilty of unauthorized access to ex-lover's family information in Busan... why? (Shortcut)