When you may need advice
- An audit found that I used the company system to look up an acquaintance's address for someone
- I was sued for taking a file of customer contacts with me when I left the company
- I think a hospital or government office employee gave my information to someone else
- I posted residents' information I received while managing an apartment complex in a group chat
- I am being investigated over a personal data leak at the company level
Relevant laws
Personal Information Protection Act (개인정보 보호법) Article 59 (Prohibited Acts)
A person who handles or has handled personal information must not obtain personal information by improper means, disclose personal information learned through work, or use or leak another person's personal information without authorization.
Personal Information Protection Act Article 71 (Penalties)
A person who discloses personal information learned through work, provides it for others to use without authorization, or uses or leaks another person's personal information without authorization is punishable by up to 5 years in prison or a fine of up to KRW 50 million (Items 9 and 10).
Personal Information Protection Act Article 72 (Penalties)
A person who obtains personal information by deception or other improper means is punishable by up to 3 years in prison or a fine of up to KRW 30 million (Item 2).
Statutes are summarized. The official Korean text is available at the Korea Law Information Center (law.go.kr).
Individual employees can also be punished
Many duties under the Personal Information Protection Act are placed on personal information controllers, meaning institutions and companies that operate personal data files for business purposes. However, Article 59 applies to anyone who handles or has handled personal information.
The Supreme Court has also held that this provision is not limited to personal information controllers but includes anyone who has handled personal information learned through work (Supreme Court Decision 2015도8766, March 10, 2016). So even when a customer service agent or staff member takes information for personal reasons, they can be punished directly.
What matters is whether you only looked it up, and to whom you passed it
Using or leaking another person's personal information without authorization carries up to 5 years in prison or a fine of up to KRW 50 million. In practice, investigators check one by one how many lookups appear in the access logs, who received the information and whether you were paid for it.
Whether you looked it up because your work required it or out of personal curiosity is also disputed. Matching the access records with the duties you had at the time can sometimes explain part of what happened.
Sharing private screenshots raises other laws
The general view is that the Personal Information Protection Act is hard to apply to sharing unrelated to work, such as posting a contact number or conversation you received from a friend in a group chat. In such cases, whether it amounts to defamation or a breach of secrets under Article 49 of the Information and Communications Network Act (정보통신망법) is examined separately.
On the other hand, information received while performing a role, such as a club organizer or a building management office, is more likely to be treated as information learned through work. You first need to clarify in what capacity you received the information.
Factors that affect the outcome and sentence
Factors that work against you
- · Passing on information in exchange for payment
- · Many lookups or leaks over a long period
- · Secondary harm from the leaked information, such as stalking or fraud
- · Unique identifiers such as resident registration numbers, or health information, were included
Factors that work in your favor
- · The lookup was related to your work
- · Only a narrow scope was passed on, and it was promptly retrieved or deleted
- · You apologized to the victim and made up for the harm
- · You have already been disciplined through the company's internal process
How our Criminal Law Center handles your case
- 1
Establish the facts
Based on the access records, your duties at the time and your relationship with the person who received the information, we determine which provisions are at issue.
- 2
Digital forensics response
If your phone or work computer was seized, we apply to take part in the forensic examination so that data unrelated to the case is not handed over with it.
- 3
Attend questioning
We attend questioning that goes through the access records one by one, and raise objections so the facts are not recorded inaccurately.
- 4
Submit a legal opinion
At the decision stage, we submit an opinion setting out the connection to your work, the scope of the leak and your efforts to make up for the harm.
Lawyers handling these cases
Hansol Kim Managing Partner
Former prosecutor at the Incheon District Prosecutors' Office, the Ansan Branch of the Suwon District Prosecutors' Office and the Hongseong Branch of the Daejeon District Prosecutors' Office
View profile →
Bonwoo Koo Managing Partner
Economic criminal cases such as Capital Markets Act violations, investment fraud, embezzlement and breach of trust
View profile →
Frequently asked questions
Will the company also be punished?
If an employee commits a crime under Articles 71 to 73 in connection with the company's business, the company can also be fined under the same provision (Article 74(2)). The company can avoid this if it exercised due care and supervision to prevent the violation.
Can I be punished for giving out an address just once because an acquaintance asked?
Passing information learned through work to someone else without authorization can fall under Article 71 even if it happened only once. However, the outcome varies greatly depending on the number of cases, the circumstances and whether secondary harm occurred.
Is it a problem if I take client contacts with me when I leave the company?
Taking the contact details of client staff you received for work without the company's permission and using them for other purposes can raise issues under the Personal Information Protection Act, and people are sometimes also sued for trade secret infringement or breach of trust in the course of business (업무상배임). You first need to check what kind of data you took.