What Was Stolen Was 'Weight,' What Came Back Was a 'Coupon'... The Issues in the Ttareungi Information Leak Incident

The information of about 4.62 million members was leaked through a hacking of Seoul's public bicycle Ttareungi system. Although the actually leaked items differ by member, it was confirmed to include not only IDs and mobile phone numbers but also date of birth, gender, address, and even "weight." In response, the Seoul Facilities Corporation on the 30th offered a season pass (worth about 5,000 won) as compensation. Amid growing public anger, this matter is becoming an important test bed for examining the value of personal information and the legal principles of damages beyond an emotional debate.

What makes this matter show a different aspect from existing data leak incidents is the leak of customers' weight. Weight falls under "sensitive information" under the Personal Information Protection Act and is protected more strictly than general personal information. In particular, the core of this case lies in the "combination of information": for example, if information such as a name or ID, mobile phone number, or address is combined with weight and leaked, it becomes possible to profile a specific individual rather than being just a single number, so the sensitivity of the information grows exponentially.

Then, does the "voucher worth about 5,000 won" offered by the corporation end the compensation for damages? The voucher the corporation pays based on ordinances and the like is merely its own "damage relief measure" and must not be equated with civil damages under the Personal Information Protection Act. In other words, receiving the corporation's own compensation does not mean the legal right to claim damages is immediately waived.

Also, can victims receive compensation even without specific secondary damage (identity theft, financial fraud, etc.)? The circumstance that specific secondary damage has not been confirmed can be an important factor in judging the occurrence and scope of damage, but it is difficult to regard it as an absolute requirement for damages. This is because the emotional/mental damage caused by the personal information leak itself and the "property/additional privacy damage" arising from secondary damage must be clearly distinguished.

For this, Article 39-2 of the Personal Information Protection Act provides a "statutory damages" system. This is a system that eases the burden of proving the specific amount of damage, allowing a claim for a substantial amount of damages within a range of up to 3 million won. However, rather than a concept of automatically receiving 3 million won just for the fact of a leak, the compensation amount is calculated by breaking down factors such as whether there was a mere leak, the possibility of privacy infringement given the nature of the information, and how serious the business operator's management negligence is.

Daeryun LLC Attorney Kim Hyung-jin said, "At this point, the most significant legal issue of this Ttareungi case emerges: the problem of 'response after recognizing the incident.' The mere fact that it is a service operated by a public institution does not exempt it from civil liability, and the act of neglecting the duty of post-incident response as a personal information controller will inevitably be evaluated as serious management negligence on the part of the business operator in future damages litigation." He added, "However, since litigation against a public institution is more complex in procedure than litigation against a general private company and the court's scope of recognizing damage may be limited, it is not too late to make a judgment after sufficiently considering these points."

[Read Full Article]
What Was Stolen Was 'Weight,' What Came Back Was a 'Coupon'... The Issues in the Ttareungi Information Leak Incident (Go to Link)