Supreme Court Confirms Innocence of Police Officer Who Obtained Phone Numbers of 22 Fellow Officers via Internal Network and Included Them in Complaint

The acquittal of a police officer who sued fellow officers for critical comments on internal police network posts related to himself, and who listed mobile phone numbers obtained through an employee inquiry program in the complaint, has been confirmed.

The reason is that he cannot be regarded as a person engaged in information processing work subject to the Personal Information Protection Act, and that listing mobile phone numbers obtained through an internal system accessible to any police officer to look up contact information of colleagues when submitting a complaint to investigative agencies constitutes a lawful act that does not violate social norms, thus illegality cannot be recognized.

Supreme Court, Seocho-dong, Seoul.

The Supreme Court's 2nd Division (Presiding Justice Lee Dong-won) announced on the 7th that it upheld the lower court's acquittal of police officer A, who was indicted for violating the Personal Information Protection Act.

Officer A was indicted on charges of listing the mobile phone numbers of 22 police officers in a complaint accusing them of defamation or insult against himself, numbers he identified through the internal computer system during the process of filing the complaint in February 2018.

At that time, Officer A sued a total of 30 people, including 27 police officers and 2 journalists who mentioned incidents related to him. The Personal Information Protection Act violation charges applied only to those police officers whose mobile phone numbers were newly obtained by querying the internal network, excluding those whose numbers A already knew.

The police officers sued by A had posted critical comments about him on the internal bulletin board (Polnet) on January 8, 2018, under the post titled "News about a solo protest by a female officer at Gimhae Western Police Station," and on February 12, 2018, under the post titled "The tremendous things that happened to me after interviewing a female officer who was sexually harassed..."

Officer A judged that the comments they wrote defamed or insulted him and decided to file a complaint with investigative agencies. He accessed the Police Agency's standard personnel system called 'e-Saram' from a work computer at the police station district office where he worked, used the 'Employee Inquiry' section to find their mobile phone numbers, and listed these numbers in the complaint without their consent, submitting the complaints to five investigative agencies including the Jeonju District Prosecutors' Office between July and August 2018.

The first trial acquitted Officer A.

In court, Officer A's side admitted all the facts contained in the prosecution's charges but argued that ▲ Officer A was not a personal information processor, ▲ listing mobile phone numbers in the complaint could not be considered 'disclosure' or 'leakage' of personal information, and ▲ Officer A's actions were lawful acts under criminal law that did not violate social norms and thus were not illegal.

On the other hand, the prosecutor argued that ▲ Officer A was a person who processed personal information in the work-related computer system and thus subject to punishment, ▲ listing phone numbers registered in the internal system in the complaint for private purposes constituted leakage or disclosure of personal information, and ▲ the act did not qualify as a lawful act.

The court sided with Officer A's argument.

First, the court cited a previous ruling by the Seoul High Court regarding the meaning of 'personal information learned in the course of work' under the Personal Information Protection Act.

In 2019, the Seoul High Court ruled, "The 'personal information' as defined in Article 2, Clause 1 of the Act, which is learned in the course of work, refers only to personal information that a 'person who processes or has processed personal information' learns in relation to the work of processing personal information, and does not mean all personal information learned in the course of any work handled by such a person unrelated to personal information processing." This ruling was upheld by the Supreme Court as is.

In other words, the Personal Information Protection Act punishes disclosure or leakage of personal information only when the personal information processor learns the information in the course of processing personal information, and does not include personal information learned in the course of other work.

The court stated, "The 'Employee Inquiry' system of 'e-Saram' used by Officer A is freely accessible to any police officer to find colleagues, and mobile phone numbers are searchable only if the employee has allowed disclosure. It is acknowledged that the defendant was not directly responsible for this internal employee search work."

In fact, the 'Employee Inquiry' function of 'e-Saram' displays the employee's affiliation, rank, and office phone number when the employee's name is entered, and mobile phone numbers are shown only if the employee has permitted disclosure; if set to private, it appears as 'Private.' At the bottom of the employee inquiry screen, the phrase 'No private use of internal employee personal information!' is displayed.

The court noted that since this system is accessible without restriction to all police officers, it should be distinguished from the investigation target inquiry system.

The court said, "Although the inquiry screen displays a warning 'No private use of internal employee personal information,' employees could use it without particular restrictions when they needed colleagues' contact information for work or personal reasons. Unlike the 'online inquiry' system used by police to check information about the general public or investigation targets for police work, this employee search system allows broad access and use."

It concluded, "In this case, the defendant listed the mobile phone numbers obtained as above in the complaint against colleagues for defamation, and it is difficult to regard this as personal information learned 'in relation to the work of processing personal information' by the defendant."

The court also pointed out, "It is acknowledged that the defendant was not directly responsible for internal employee search work."

Officer A worked as a patrol officer at B Police Station C District Unit from May 11, 2017, to May 31, 2018, and from June 1, 2018, worked as a patrol officer at another police station district unit.

Finally, considering the exceptions to punishment under the Personal Information Protection Act, the court judged that Officer A's actions could not be regarded as 'disclosure' of personal information.

The court explained, "The Personal Information Protection Act prohibits the leakage of information that can identify an individual, but Article 18, Paragraph 2 of the Act provides exceptions even for personal information processors, allowing use or provision of personal information for purposes other than the original one unless there is an undue infringement on the interests of the data subject or a third party. It specifically lists exceptions such as 'when necessary for investigation, prosecution, and maintenance of criminal cases (Clause 7)' and 'when necessary for the court's judicial work (Clause 8).'"

It added, "When submitting a complaint to the court, the parties must be specified according to Article 249 of the Civil Procedure Act (matters to be stated in the complaint), and when filing a criminal complaint, information identifying the parties must be stated according to relevant laws. Therefore, submission to courts and investigative agencies under criminal and civil procedures is lawful, and such personal information is strictly managed by the state, preventing access by third parties. Hence, it cannot be regarded as 'disclosure' of personal information."

However, the court acknowledged that Officer A's actions had some inappropriate aspects. Nevertheless, while internal disciplinary action could be taken, it concluded that the actions were not punishable under the Personal Information Protection Act.

The court stated, "In this case, the defendant sued 30 people, including 27 police officers and 2 journalists, for defamation because they mentioned incidents related to him. Although it is difficult to say that the defamation was established in some parts, and the defendant's indiscriminate complaints and listing of contact information found on the internal network are not appropriate, imposing disciplinary measures such as punishment for violating internal regulations is one matter, but such acts cannot generally be considered punishable personal information disclosure."

It added, "Expanding the scope of punishment to acts of listing necessary information for complaints to investigative agencies and lawsuits to courts would restrict the legitimate exercise of individual rights such as complaints, accusations, and lawsuits by aggrieved parties, which would contradict the purpose of the Personal Information Protection Act to 'protect individual freedom and rights and further realize individual dignity and value.'"

The second trial also found no problem with the first trial's judgment.

The Supreme Court dismissed the appeal, stating that although some parts of the lower court's reasoning were inappropriate, the conclusion of acquittal was valid.

The Supreme Court explained the dismissal of the appeal, saying, "Although there are inappropriate parts in the lower court's reasoning, there is no error in the lower court's judgment that violates the rules of logic and experience, exceeds the limits of free evaluation of evidence, or misinterprets the law regarding the establishment of the crime of violating the Personal Information Protection Act by disclosure of personal information, which would affect the judgment."

Although the court did not specify detailed reasons, considering precedents where the Supreme Court judged that listing personal information in complaints constituted disclosure or leakage of personal information, the second trial's view that it did not constitute disclosure or leakage was mistaken. However, since the defendant was not a personal information processor and thus could not be the subject of the crime, or the act was a lawful act without illegality, the conclusion of acquittal is reasonable.

This content was produced with the assistance of AI translation services.