Can I be punished for the crime of leaking personal information?

Where personal information is accessed without authorization or leaked externally, this constitutes the crime of leaking personal information and a clear violation of the Personal Information Protection Act, and it can be subject to criminal punishment and administrative sanctions.

In particular, if an employee accesses, without consent, customer information learned in the course of their work, or if circumstances confirming that they leaked it externally are established, the employee can be punished under Article 71 of the Personal Information Protection Act by imprisonment for not more than five years or a fine of not more than 50 million won.

If the leak was carried out for the purpose of profit, imprisonment for not more than 10 years or a fine of not more than 100 million won may apply, and where personal information handled in the course of one's duties is leaked, aggravated punishment may apply.

In addition, a personal information controller (such as a company or business operator) must report a personal information leak to the Personal Information Protection Commission or the Korea Internet and Security Agency (KISA) within 72 hours of becoming aware of it.

Along with this, the affected data subjects must be notified without delay of matters such as the items leaked, the time, and the circumstances. (Article 34 of the Personal Information Protection Act, Article 40 of the Enforcement Decree)

If this is violated, under Article 75(2)18 of the same Act, an administrative fine of not more than 30 million won may also be imposed on the company.

Furthermore, if the company has failed to implement technical and administrative protective measures for personal information protection, such as internal security measures, access control, and log records, legal liability arising from negligent supervision may also arise.

In other words, in addition to the possibility of criminal punishment for the employee in question, the company itself may also bear punishment or civil liability for damages on the ground of its management responsibility.

Therefore, if you have become involved in the crime of leaking personal information, we recommend organizing the facts as quickly as possible and responding with the assistance of a legal expert.