[Invest&Law] Supreme Court: "Victim Must Prove Personal Data Leakage to Receive Compensation"

Lawsuit Against Homeplus for Selling Personal Information to Insurance Company

The Supreme Court has ruled that consumers must specifically and individually prove the violation of the Personal Information Protection Act in order to receive compensation for damages caused by the leakage of personal information by a company.

The Civil Division 2 of the Supreme Court (Presiding Justice Shin Sook-hee) on the 17th upheld the lower court's partial ruling in favor of the plaintiffs in the appeal trial of a damages claim lawsuit filed by 283 consumers including Mr. A against Homeplus.

Homeplus.

Homeplus sold the personal information of family membership card members who did not consent to the provision of personal information to third parties during the subscription process to insurance companies through a consignment company. The insurance companies analyzed customer information and conducted so-called "filtering work" to exclude customers who did not want to receive calls for insurance product explanations, and only paid Homeplus for the personal information of the remaining customers after this filtering.

However, since there were few customers remaining after the filtering work and profitability was not high, Homeplus obtained consent for third-party information provision from customers selected by the insurance companies. To do this, the list of customers who did not consent to information provision was passed on to the insurance companies.

The Personal Information Protection Act stipulates that if a personal information handler violates the law and the information subject suffers damage, the information subject can claim damages from the personal information handler. The first trial partially recognized Homeplus's liability for compensation.

However, the appellate court ruled that consumers must prove that their personal information was provided. Therefore, it judged that Homeplus did not need to compensate consumers who failed to prove this. The Supreme Court also upheld this appellate court ruling as is. The court stated, "The fact that the personal information handler violated the law itself must be claimed and proven by the information subject."

On the same day, the Civil Division 2 of the Supreme Court (Presiding Justice Kim Sang-hwan) reached the same conclusion in another case involving Homeplus with the same issue.

Meanwhile, Homeplus was prosecuted for violating the Personal Information Protection Act and was fined 75 million won in August 2019.

Reporter Han Soo-hyun, Law Times

※This article is based on content supplied by Law Times.

This content was produced with the assistance of AI translation services.