All
| TITLE | Supreme Court Decision 2015Da24904, 24911, 24928, 24935 Decided January 25, 2018【Damages (Etc.); Damages (Etc.); Damages (Etc.); Damages (Etc.)】 [full Text] |
|---|---|
| Summary | |
|
[1] Standard for determining whether a provider of information and communications services breached a legal or contractual duty to take necessary protective measures to ensure the safety of personal information as defined under Article 28(1) of the former Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., or stipulated in an information and communications service contract [2] If a provider of information and communications services took necessary technical and administrative measures under the Standard on Technical and Administrative Protective Measures for Personal Information (Korea Communications Commission Notice No. 2011-1), whether said provider may be deemed to have breached his/her legal or contractual duty to take necessary protective measures to ensure the safety of personal information (negative in principle) Albeit an information and communications service provider took necessary protective measures, as mentioned above, cases where the measures taken are assessed as an illegal act or where the provider is held liable pursuant to Article 760(3) of the Civil Act [3] In a case where: (a) an online portal service operated by Company A was hacked, resulting in the leakage of members’ personal information; and (b) service users, including Party A, consequentially sought compensation for damages against Company A, the case holding that, although an information and communications service provider’s duty to protect includes having personal information controllers log out after browsing the information processing system, Company A is not liable for compensation given that proximate causation is not recognized between the failure to completely perform necessary protective measures and the hacking incident |
|
