Open Decision Ledger · Constitutional, administrative & state liability
Personal information processing system and the scope of leak-prevention duties
Supreme Court, Sept. 30, 2021, 2020Du55220 (judgment)
Case name: 시정조치등취소청구
Official text on the National Law Information Center
Question
Under the former Broadcasting and Communications Commission Notice on technical and management safeguards for personal information, does Article 4(5)'s term 'personal information processing system' include application programmes linked to a database and taking part in processing, and does Article 4(9) require measures against leaks caused not only by internal carelessness but also by unlawful external access?
Holding
It includes them. Reading the structure and legislative purpose of the related provisions, and the fact that Article 15(2)(i) of the former Enforcement Decree and Article 2(iv) of the Notice both define the term as a database system organised to process personal information, the Court held that Article 4(5) means the database system as a whole across generation, recording, storage, retrieval and use, and covers application programmes linked to a database and taking part in processing. Article 4(9), for its part, must be read to require measures preventing leaks not only from internal carelessness but also from unlawful external access such as hacking, because the enabling Act and Decree both regulate access-control devices such as intrusion prevention systems.
Summary of the holding, verbatim
위 보호조치 기준 제4조 제5항의 ‘개인정보처리시스템’은 개인정보의 생성, 기록, 저장, 검색, 이용과정 등 데이터베이스시스템(DBS) 전체를 의미하는 것으로, 데이터베이스(DB)와 연동되어 개인정보의 처리 과정에 관여하는 응용프로그램 등을 포함한다.
Unofficial English translation
The term 'personal information processing system' in paragraph (5) of Article 4 of the Standards for Protection Measures means the entire database system (DBS) including the processes of creation, recording, storage, retrieval, and use of personal information, and includes application programs, etc. that are interlinked with a database (DB) and involved in the processing of personal information.
Disposition
Dismissed Stated in the decision
상고를 모두 기각한다. 상고비용 중 원고의 상고로 인한 부분은 원고가, 피고의 상고로 인한 부분은 피고가 각각 부담한다.
Unofficial English translation
All appeals are dismissed. As to the costs of final appeal, the plaintiff shall bear the portion attributable to the plaintiff's final appeal, and the defendant shall bear the portion attributable to the defendant's final appeal, respectively.
Form of the test
Elements stated Stated in the decision
구 정보통신망법 시행령 제15조 제2항 제1호와 구 개인정보의 기술적·관리적 보호조치 기준(2020. 1. 2. 방송통신위원회 고시 제2019-13호로 개정되기 전의 것, 이하 ‘보호조치 기준’이라 한다) 제2조 제4호에서 모두 ‘개인정보처리시스템’을 ‘개인정보를 처리할 수 있도록 체계적으로 구성한 데이터베이스시스템’으로 정의하고 있는 점 등에 비추어 볼 때
Unofficial English translation
considering the fact that both Article 15 (2) subparagraph 1 of the former Enforcement Decree of the Act on Promotion of Information and Communications Network Utilization and Information Protection and subparagraph 4 of Article 2 of the former Standards for Technical and Administrative Protection Measures for Personal Information (as in effect prior to its amendment by Notification No. 2019-13 of the Korea Communications Commission on January 2, 2020; hereinafter referred to as the 'Standards for Protection Measures') define 'personal information processing system' as 'a database system systematically configured to process personal information', and the like,
Factors
- 관련 규정의 체계와 입법 목적 및 구 정보통신망법 시행령 제15조 제2항 제1호와
- ‘개인정보처리시스템’을 ‘개인정보를 처리할 수 있도록 체계적으로 구성한 데이터베이스시스템’으로 정의하고 있는 점 등에 비추어 볼 때
- 개인정보의 생성, 기록, 저장, 검색, 이용과정 등 데이터베이스시스템(DBS) 전체를 의미하는 것으로
- 개인정보에 대한 불법적인 접근을 차단하기 위한 침입차단시스템 등 접근 통제장치의 설치·운영에 관하여 규정하고 있는 점 등에 비추어 보면
- 정보통신서비스 제공자 등이 기술적 보호조치를 충분히 다하지 못하여 해킹과 같이 외부로부터의 불법적인 접근에 의해 개인정보가 외부로 유출되는 사고도 방지하려는 것으로 보아야 한다
Unofficial English translation
• the framework of the relevant provisions and their legislative purpose, and Article 15 (2) subparagraph 1 of the former Enforcement Decree of the Act on Promotion of Information and Communications Network Utilization and Information Protection, and
• considering the fact that it defines 'personal information processing system' as 'a database system systematically configured to process personal information', and the like,
• meaning the entire database system (DBS) including the processes of creation, recording, storage, retrieval, and use of personal information, and
• considering the fact that it provides for the installation and operation of access control devices such as intrusion blocking systems to block unauthorized access to personal information, and the like,
• it must be regarded as intending to prevent even accidents in which personal information is leaked outside due to unauthorized access from outside, such as hacking, where information and communications service providers, etc. have failed to fully take technical protection measures
Relation to precedent
Follows earlier decisions Stated in the decision
대법원 2021. 8. 19. 선고 2018두56404 판결(공2021하, 1724)
Unofficial English translation
Supreme Court Decision 2018Du56404 decided August 19, 2021 (Gong 2021 Ha, 1724)
Decisions referred to
[1][2] 대법원 2021. 8. 19. 선고 2018두56404 판결(공2021하, 1724)
Burden of proof
Not addressed Not in the decision
Open question and revisit condition
What technical safeguards are sufficient under Article 4(9) to prevent a leak through unlawful external access such as hacking, given that the decision fixed the provision's scope but not the adequacy of the measures?
A later decision stating what measures satisfy Article 4(9) would settle how the provision applies to a given system. Any amendment to Article 28(1)(ii) of the Act on Promotion of Information and Communications Network Utilisation and Information Protection, its Enforcement Decree, or the safeguards Notice would also call for this entry to be read again.
Cross-family AI independent reading & axis check
8 of 8 axes matched GPT-6 Astra (OpenAI, codex CLI) · 2026-10-25
A reader from another model family (GPT-6 Astra), given the official text but not the primary reading, agreed on all 8 axes.
Raw responses and comparison record: Protocol · Blind readings (JSONL) · Axis comparison (JSONL) · SHA-256 (JSON)
Lower-court contrast & scope of application
Lower-court reading vs. Supreme Court holding
Lower-court context: The Seoul High Court, in its judgment of 4 November 2020 (2019Nu43964), held that the Altools (Altoolbar) programme the plaintiff gave users was connected to the database holding their personal information, so that a user with proper authority could call up and view that information through the programme; the programme was therefore a personal information processing system under Article 4(5). On that basis it found that the plaintiff had neglected the duty under Article 4(5) to operate a system restricting unauthorised access and detecting attempts to leak personal information unlawfully through the network. It also held, however, that the plaintiff had not breached the duty to install an intrusion prevention and detection system under Article 28(1)(ii) of the former Act on Promotion of Information and Communications Network Utilisation and Information Protection and Article 15(2)(ii) of its Enforcement Decree, so that the factual basis for the exercise of discretion behind the fine payment order was flawed and the fine order was unlawful as an abuse of discretion.
Supreme Court standard: The Supreme Court found no error in either direction. On the plaintiff's appeal it held that the reading of 'personal information processing system' and of the scope of Article 4(9) adopted below matched the correct legal principle, and that the court below had not misread the Notice. On the defendant's appeal it held that the finding of no breach of the intrusion prevention and detection duty was proper on the record, and that the conclusion that the fine order rested on an erroneous factual basis was likewise correct. All appeals were dismissed unanimously.
Distinguishing conditions
- An application programme that takes part in the processing of personal information but is not linked to a database, so that it is not part of the database system within Article 4(5).
- A dispute over the duty to install an intrusion prevention and detection system under Article 28(1)(ii) of the former Act and Article 15(2)(ii) of its Enforcement Decree itself, which the Court kept separate from the duties under the Notice and found not breached here.
- A measure taken under the Notice as amended by Broadcasting and Communications Commission Notice No. 2019-13 of 2 January 2020, since the decision applied the earlier version.
Record verification notes
Identify the version of the Notice and of the Enforcement Decree in force when the measure was taken, since the whole reasoning runs on the pre-amendment texts. Then separate the ground the authority relied on: whether it is the Article 4(5) safeguard duty, the Article 4(9) duty, or the Article 28(1)(ii) installation duty, because the court below found a breach of the first and not of the third, and the fine's unlawfulness followed from that gap. Finally, check the file for how the programme in fact connects to the database and what access controls exist.
From the official text
Points at issue
[1] 방송통신위원회 고시인 구 개인정보의 기술적·관리적 보호조치 기준 제4조 제5항의 ‘개인정보처리시스템’의 의미 및 개인정보처리시스템에 데이터베이스(DB)와 연동되어 개인정보의 처리 과정에 관여하는 응용프로그램 등이 포함되는지 여부(적극) [2] 방송통신위원회 고시인 구 개인정보의 기술적·관리적 보호조치 기준 제4조 제9항이 내부적인 부주의로 개인정보가 외부로 유출되는 사고뿐 아니라 외부로부터의 불법적인 접근에 따른 개인정보 유출 방지를 위한 조치의무까지 포함하는지 여부(적극)
Unofficial English translation
[1] Meaning of 'personal information processing system' in paragraph (5) of Article 4 of the former Standards for Technical and Administrative Protection Measures for Personal Information, a notification of the Korea Communications Commission, and whether it includes application programs, etc. that are interlinked with a database (DB) and involved in the processing of personal information (affirmative) [2] Whether paragraph (9) of Article 4 of the former Standards for Technical and Administrative Protection Measures for Personal Information, a notification of the Korea Communications Commission, covers not only accidents in which personal information is leaked outside due to internal carelessness but also the duty to take measures to prevent the leakage of personal information caused by unauthorized access from outside (affirmative)
Summary of the holding
[1] 구 정보통신망 이용촉진 및 정보보호 등에 관한 법률(2018. 9. 18. 법률 제15751호로 개정되기 전의 것) 제28조 제1항 제2호, 구 정보통신망 이용촉진 및 정보보호 등에 관한 법률 시행령(2020. 8. 4. 대통령령 제30894호로 개정되기 전의 것, 이하 ‘구 정보통신망법 시행령’이라 한다) 제15조 제2항 등 관련 규정의 체계와 입법 목적 및 구 정보통신망법 시행령 제15조 제2항 제1호와 구 개인정보의 기술적·관리적 보호조치 기준(2020. 1. 2. 방송통신위원회 고시 제2019-13호로 개정되기 전의 것, 이하 ‘보호조치 기준’이라 한다) 제2조 제4호에서 모두 ‘개인정보처리시스템’을 ‘개인정보를 처리할 수 있도록 체계적으로 구성한 데이터베이스시스템’으로 정의하고 있는 점 등에 비추어 볼 때, 위 보호조치 기준 제4조 제5항의 ‘개인정보처리시스템’은 개인정보의 생성, 기록, 저장, 검색, 이용과정 등 데이터베이스시스템(DBS) 전체를 의미하는 것으로, 데이터베이스(DB)와 연동되어 개인정보의 처리 과정에 관여하는 응용프로그램 등을 포함한다. [2] 구 개인정보의 기술적·관리적 보호조치 기준(2020. 1. 2. 방송통신위원회 고시 제2019-13호로 개정되기 전의 것, 이하 ‘보호조치 기준’이라 한다) 제4조 제9항은 “정보통신서비스 제공자 등은 취급 중인 개인정보가 인터넷 홈페이지, P2P, 공유설정 등을 통하여 열람권한이 없는 자에게 공개되거나 외부에 유출되지 않도록 개인정보처리시스템 및 개인정보취급자의 컴퓨터와 모바일 기기에 조치를 취하여야 한다.”라고 규정하고 있다. 위 보호조치 기준을 마련하도록 위임한 구 정보통신망 이용촉진 및 정보보호 등에 관한 법률(2018. 9. 18. 법률 제15751호로 개정되기 전의 것) 제28조 제1항 제2호와 구 정보통신망 이용촉진 및 정보보호 등에 관한 법률 시행령(2020. 8. 4. 대통령령 제30894호로 개정되기 전의 것) 제15조 제2항 제2호가 모두 개인정보에 대한 불법적인 접근을 차단하기 위한 침입차단시스템 등 접근 통제장치의 설치·운영에 관하여 규정하고 있는 점 등에 비추어 보면, 위 보호조치 기준 제4조 제9항은 정보통신서비스 제공자 등의 내부적인 부주의로 개인정보가 외부로 유출되는 사고뿐만 아니라 정보통신서비스 제공자 등이 기술적 보호조치를 충분히 다하지 못하여 해킹과 같이 외부로부터의 불법적인 접근에 의해 개인정보가 외부로 유출되는 사고도 방지하려는 것으로 보아야 한다.
Order
상고를 모두 기각한다. 상고비용 중 원고의 상고로 인한 부분은 원고가, 피고의 상고로 인한 부분은 피고가 각각 부담한다.
Unofficial English translation
All appeals are dismissed. As to the costs of final appeal, the plaintiff shall bear the portion attributable to the plaintiff's final appeal, and the defendant shall bear the portion attributable to the defendant's final appeal, respectively.
Provisions referred to
[1] 구 정보통신망 이용촉진 및 정보보호 등에 관한 법률(2018. 9. 18. 법률 제15751호로 개정되기 전의 것) 제28조 제1항 제2호, 구 정보통신망 이용촉진 및 정보보호 등에 관한 법률 시행령(2020. 8. 4. 대통령령 제30894호로 개정되기 전의 것) 제15조 제2항, 제6항 [2] 구 정보통신망 이용촉진 및 정보보호 등에 관한 법률(2018. 9. 18. 법률 제15751호로 개정되기 전의 것) 제28조 제1항 제2호, 구 정보통신망 이용촉진 및 정보보호 등에 관한 법률 시행령(2020. 8. 4. 대통령령 제30894호로 개정되기 전의 것) 제15조 제2항 제2호
Read 2026-10-25 · Cross-read 2026-10-25. All quotes matched against the official text. The Chinese-character placeholders the court used for anonymised parties are given in their Korean readings, and parenthetical Chinese-character glosses are omitted.
Every entry is published only after all quotes have been matched character by character against the official text, and audited by an independent second reading from a different model family across all eight axes. Both agreed axes and text-grounded interpretive divergences are recorded openly. The ledger is a research record, not an assessment of the court or advice on any matter.
Back to the ledger