What Punishments Do Sellers of 'Corona Myeongbu' Face... Up to 10 Years Imprisonment for Hacking

'Corona Myeongbu' Sale, Personal Information Protection Act Violation Regardless of Authenticity
If Information Theft by Hacking is Confirmed, Up to 10 Years Imprisonment or Fine Up to 100 Million Won
If Fake Bank Accounts Were Used, Electronic Financial Transactions Act Violation Charges Also Applied
Infection Disease Prevention Act Violation Charges Likely Difficult to Apply

[Asia Economy Reporters Seungyun Song, Jeongyun Lee] As the police investigate the distribution case of the personal information database (DB) known as the so-called 'Corona List,' attention is focused on the level of punishment that the seller will face.

Experts believe that a violation of the Personal Information Protection Act can be applied first. The Personal Information Protection Act stipulates punishment for those who disclose personal information learned through work or provide it for use by others without authorization. Violating the Personal Information Protection Act can result in imprisonment for up to 5 years or a fine of up to 50 million KRW. Regardless of the authenticity of the list, the act of creating a DB of personal information and distributing or selling it without the consent of the parties involved is punishable.

If it is confirmed that the information was obtained through hacking, the penalty can be imprisonment for up to 10 years or a fine of up to 100 million KRW. Additionally, charges under the Information and Communications Network Act are expected to be applied. There is also a possibility of additional charges for obstruction of business. Attorney Taean Koo of Law Firm Lin stated, "If it is true that government agencies such as the Korea Disease Control and Prevention Agency or the Ministry of Health and Welfare were hacked, violations of Article 48, Paragraph 1 of the Information and Communications Network Act, as well as crimes of breach of confidentiality and obstruction of business, can be applied." If a forged bank account was used in the process of selling personal information and receiving payment, both the transferor and transferee may face charges under the Electronic Financial Transactions Act.

The Chungnam Provincial Police Agency, which is investigating this case, recently obtained a search warrant for the bank account used by an unidentified seller who created and sold the Corona List to receive transaction payments, and confirmed the identity of the account holder. Based on this, the police are tracking the seller. The police will also review the authenticity of the list. For now, the government agencies targeted for hacking have denied any hacking incidents due to external access.

However, even if the Corona List was actually hacked and distributed or arbitrarily combined into a DB and distributed under the name 'Corona List,' the legal consensus is that this act is unlikely to directly violate the Infectious Disease Control and Prevention Act. Attorney Sungmin Park of Law Firm Saram explained, "The only possible consideration is a violation of Article 13, Paragraph 3 of the Infectious Disease Control and Prevention Act for obstructing epidemiological investigations," but added, "However, it is questionable whether this act can be directly seen as obstructing quarantine activities or epidemiological investigations."

This content was produced with the assistance of AI translation services.