The Supreme Court has ruled that individuals who illegally acquire personal data for their own business purposes can still be classified as data processors under the data protection law, even if the acquisition process was unlawful. This decision aims to prevent gaps in victim protection that could arise if illegal acquirers were excluded from liability.
According to legal sources on May 31, the Supreme Court's first division, led by Justice Seo Kyung-hwan, upheld a lower court's one-year prison sentence for a 40-year-old man identified only as Lee, who was charged with operating a gambling site and violating the data protection law.
Prosecutors found that Lee illegally obtained the names, account numbers, and phone numbers of over 790 members from another site while establishing his gambling platform in 2024. He used this information to register unauthorized members to ensure the site's deposit and gaming functions operated correctly.
Additionally, it was revealed that Lee's accomplice intended to create a site where numerous users could deposit betting money, recharge game currency, and withdraw winnings based on betting outcomes. Ultimately, prosecutors brought Lee to trial for operating a gambling site and violating the data protection law.
The key issue during the trial was whether Lee could be considered a 'data processor' under the data protection law despite obtaining the information illegally. Lee's defense argued that since the data was acquired unlawfully, he did not qualify as an official data processor as defined by law.
The first trial court found Lee guilty and sentenced him to one year in prison. However, it classified him as a handler rather than a processor, applying only the charge of 'unauthorized use.'
The second trial maintained the one-year sentence but, unlike the first trial, recognized Lee as a 'data processor' who directly handled personal data, applying the violation of unauthorized use under Article 71, Item 10 of the data protection law.
The Supreme Court affirmed the second trial's ruling, stating, "Even if personal data is acquired illegally, if it is used for business purposes, it should be regarded as being processed by a data processor."
The court emphasized, "Excluding illegal acquirers from being classified as data processors would not only contradict the intent of the data protection law but could also create significant gaps in victim protection."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.