Personal data breaches are increasingly common, raising concerns about how leaked information might be used, even if no immediate financial loss occurs. This leads to the question: can individuals seek compensation for the anxiety caused by such breaches without losing money?
The short answer is yes, individuals can file for damages even without direct financial loss, but compensation is not automatically granted just because a data breach occurred. According to Article 39-2 of the Personal Information Protection Act, victims can claim statutory damages of up to 3 million won without needing to prove specific financial losses. The decision on compensation and its amount depends on the nature of the leaked information and the extent of the damage suffered.
Court rulings regarding compensation for data breaches have varied. A notable case occurred in December 2022 when the Supreme Court rejected a compensation claim from a victim of the Happy Campus hacking incident. In 2021, the online knowledge-sharing platform suffered a breach that exposed the email addresses and encrypted passwords of over 403,000 members. One victim claimed 300,000 won in damages, citing mental distress from the risk of spam and voice phishing.
The Supreme Court ruled that while the victim did not need to prove specific financial losses due to the data breach, the court found it difficult to establish that significant mental distress had occurred, considering the type of leaked information and the likelihood of third-party access and further dissemination. The court emphasized that compensation could not be imposed in cases where no clear damage was evident.
In contrast, the Supreme Court recognized liability in the KB Kookmin Card data breach case. In 2019, the court upheld a ruling requiring KB Kookmin Card and a credit information agency to pay 100,000 won to each of the 584 affected customers. The leaked information included names, resident registration numbers, addresses, phone numbers, and employment details. The court determined that the nature of the leaked data, which could identify individuals, and the high risk of third-party access warranted compensation for mental distress.
Ultimately, the distinction between these two rulings hinged on the specifics of the leaked information and the potential for further harm due to its exposure.
The recent series of data breaches in the financial sector follows a similar pattern. Banks have stated they will fully compensate customers for any losses resulting from these breaches, but actual compensation will depend on the type of leaked information, the extent of exposure, and whether any damage occurred.
If secondary damages, such as voice phishing, arise, it is essential to establish a causal link between the breach and the harm suffered. Evidence such as breach notifications, communications from scammers, and transaction records can be utilized. However, consumers may find it challenging to confirm and prove whether the leaked information was used for criminal purposes. The speed and adequacy of the financial institution's response to prevent further harm will also be considered in determining liability.
Regardless of compensation, consumers should take preventive measures to mitigate additional risks. Financial authorities recommend enrolling in services like the 'Financial Transaction Safety Block Service' and registering with the 'Personal Information Exposure Prevention System' to protect against loan and account opening fraud. They also advise against clicking on links in suspicious messages and to delete them immediately. It is safest to verify any potential data breach directly through the official website or app of the financial institution or by contacting their customer service hotline.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.