Open Decision Ledger · Criminal law
Prior consent of the data subject to a charge of leakage
Supreme Court, Oct. 30, 2025, 2024Do19539 (judgment)
Case name: 개인정보보호법위반
Official text on the National Law Information Center
Question
Where a person, having received residents' personal information in the course of business, posted their names and apartment numbers in a KakaoTalk group chat room, does the prior consent of those data subjects defeat a charge of leakage under Article 59(ii) and the penalty under Article 71(v) of the former Personal Information Protection Act?
Holding
The Court answered yes. It held that the words of Article 59(ii) and Article 71(v) of the former Act, read with the Act's legislative purpose and the meaning of the right to self-determination over personal information, mean that a person may not be punished where the data subject consented in advance. It then found from the consent forms, the notice presented with them and the conduct of the other residents that all participants in the group chat room had agreed in advance to the use of their names and apartment numbers there, so that the posting of them to rebut opposing opinions could not be punished because the data subjects had consented in advance.
Summary of the holding, verbatim
이러한 구 개인정보 보호법 제59조 제2호 및 제71조 제5호의 문언, 개인정보 보호법의 입법 목적과 취지, 개인정보자기결정권의 의미 등을 종합하면, 구 개인정보 보호법 제59조 제2호에서 금지하는 개인정보의 누설에 관하여 정보주체의 사전 동의가 있는 경우에는 피고인을 벌할 수 없다고 봄이 타당하다.
Unofficial English translation
Considering in combination the text of Article 59 subparagraph 2 and Article 71 subparagraph 5 of the former Personal Information Protection Act, the purpose and intent of the legislation of the Personal Information Protection Act, the meaning of the right to self-determination regarding personal information, etc., where there is prior consent of the information subject with respect to the disclosure of personal information prohibited under Article 59 subparagraph 2 of the former Personal Information Protection Act, it is reasonable to hold that the defendant cannot be punished.
Disposition
Reversed and remanded Stated in the decision
원심판결을 파기하고, 사건을 서울중앙지방법원에 환송한다.
Unofficial English translation
The judgment of the court below is reversed, and the case is remanded to the Seoul Central District Court.
Form of the test
Elements stated Stated in the decision
구 개인정보 보호법 제59조 제2호에서 금지하는 개인정보의 누설에 관하여 정보주체의 사전 동의가 있는 경우에는 피고인을 벌할 수 없다고 봄이 타당하다.
Unofficial English translation
Where there is prior consent of the information subject with respect to the disclosure of personal information prohibited under Article 59 subparagraph 2 of the former Personal Information Protection Act, it is reasonable to hold that the defendant cannot be punished.
Factors
- 구 개인정보 보호법 제59조 제2호 및 제71조 제5호의 문언
- 개인정보 보호법의 입법 목적과 취지
- 개인정보자기결정권의 의미
- 대법원은 ‘누설’을 ‘아직 개인정보를 알지 못하는 타인에게 알려주는 일체의 행위’로 해석하여 왔다
- 자신에 관한 정보가 언제 누구에게 어느 범위까지 알려지고 또 이용되도록 할 것인지를 그 정보주체가 스스로 결정할 수 있는 권리이다
Unofficial English translation
• The text of Article 59 subparagraph 2 and Article 71 subparagraph 5 of the former Personal Information Protection Act
• The purpose and intent of the legislation of the Personal Information Protection Act
• The meaning of the right to self-determination regarding personal information
• The Supreme Court has construed "disclosure" as "any act of informing a third party who does not yet know the personal information"
• The right whereby the information subject may decide for himself or herself when, to whom, and to what extent information about himself or herself is made known and used
Relation to precedent
Follows earlier decisions Stated in the decision
대법원 2014. 7. 24. 선고 2012다49933 판결(공2014하, 1646)
Unofficial English translation
Supreme Court Decision 2012Da49933 decided July 24, 2014 (Gong 2014 Ha, 1646)
Decisions referred to
대법원 2014. 7. 24. 선고 2012다49933 판결(공2014하, 1646), 대법원 2015. 7. 9. 선고 2013도13070 판결, 대법원 2022. 11. 10. 선고 2018도1966 판결(공2023상, 80), 대법원 2025. 6. 26. 선고 2025도3153 판결(공2025하, 1371)
Burden of proof
Not addressed Not in the decision
Open question and revisit condition
Where the data subject consented, may not only the person who disclosed the information but also one who received it knowing the circumstances, for gain or an improper purpose, be left unpunished?
The retrial judgment of the Seoul Central District Court will show how the scope of the residents' consent is applied on this record. Any later decision on whether a recipient acting for gain or an improper purpose may also rely on the data subject's consent, or any amendment to Article 71 of the Personal Information Protection Act, would require this entry to be read again.
Cross-family AI independent reading & axis check
7 of 8 axes matched GPT-6 Astra (OpenAI, codex CLI) · 2026-10-24
A reader from another model family (GPT-6 Astra), given the official text but not the primary reading, agreed on 7 of the 8 axes; the readings differed on axis 8 (open question and revisit condition).
Axis 8 (Open question and revisit condition): Primary “Where the data subject consented, may not only the person who disclosed the information but also one who received it knowing the circumstances, for gain or an improper purpose, be left unpunished?” vs Independent “What requirements concerning the form, specificity, and scope of prior consent must be met for it to preclude punishment?”
The primary reading asks whether a recipient who knew the circumstances and acted for gain or an improper purpose is also unpunished. The independent reading asks what form, specificity, and scope prior consent must have.
이러한 구 개인정보 보호법 제59조 제2호 및 제71조 제5호의 문언, 개인정보 보호법의 입법 목적과 취지, 개인정보자기결정권의 의미 등을 종합하면, 구 개인정보 보호법 제59조 제2호에서 금지하는 개인정보의 누설에 관하여 정보주체의 사전 동의가 있는 경우에는 피고인을 벌할 수 없다고 봄이 타당하다.Raw responses and comparison record: Protocol · Blind readings (JSONL) · Axis comparison (JSONL) · SHA-256 (JSON)
Lower-court contrast & scope of application
Lower-court reading vs. Supreme Court holding
Lower-court context: The Seoul Central District Court, in its judgment of 29 November 2024 (2024No852), convicted the defendant. It read the notice and the consent forms as covering use of the residents' names and apartment numbers only for the compensation work described there, so posting them to rebut opinions opposing the defendant was outside the scope of the consent. It also held that some residents identifying themselves or naming others could not show a general consent by the participants to unlimited disclosure of their details.
Supreme Court standard: The Supreme Court held that the consent forms filled in with names, apartment numbers and telephone numbers, the notice stating that telephone numbers were requested to open the chat room and that names, addresses and contact details were collected and used for submission to the Central Environmental Dispute Adjustment Committee and for use in the chat room, and the fact that other residents had already revealed their names and apartment numbers and that donors' details were public, showed advance consent to the use of the details in that chat room. A personal motive in the way the defendant posted did not warrant a different view. It held that the court below had misread the law on leakage under Article 59(ii) and had failed to examine what it needed to, reversed the judgment and remanded the case to the same court, leaving the remaining grounds of appeal undecided.
Distinguishing conditions
- A disclosure to persons who did not consent, since the ruling turns on the data subject's advance consent.
- A use whose purpose falls entirely outside what the consent documents cover, which is the reading the court below applied to the notice.
- Personal information not learned in the course of business, since Article 59(ii) covers information a person learns through that business.
Record verification notes
Set the consent forms and the notice against the use alleged: the purpose stated, the recipients and the means. Then check who the recipients were, whether they were residents who had signed the consents or had themselves published their details, and whether any recipient obtained the information for gain or an improper purpose, which Article 71(v) names separately. Note also that the official text cross-refers to Article 71(ix) of the current Act for the former Article 71(v).
From the official text
Points at issue
업무상 알게 된 개인정보의 누설행위 등을 금지·처벌하는 구 개인정보 보호법 제59조 제2호, 제71조 제5호에서 ‘누설’의 의미 / 개인정보 보호법의 보호법익(=정보주체의 개인정보자기결정권) 및 이때 ‘개인정보자기결정권’의 의미 / 구 개인정보 보호법 제59조 제2호에서 금지하는 개인정보의 누설에 관하여 정보주체의 사전 동의가 있는 경우, 개인정보를 누설한 자를 같은 법 제71조 제5호에 의하여 처벌할 수 있는지 여부(소극)
Unofficial English translation
The meaning of "disclosure" in Article 59 subparagraph 2 and Article 71 subparagraph 5 of the former Personal Information Protection Act, which prohibit and punish acts such as the disclosure of personal information learned in the course of one's duties / The protected legal interest of the Personal Information Protection Act (= the information subject's right to self-determination regarding personal information) and the meaning of the "right to self-determination regarding personal information" in that context / Whether, where there is prior consent of the information subject with respect to the disclosure of personal information prohibited under Article 59 subparagraph 2 of the former Personal Information Protection Act, a person who has disclosed personal information may be punished pursuant to Article 71 subparagraph 5 of the same Act (negative)
Summary of the holding
구 개인정보 보호법(2023. 3. 14. 법률 제19234호로 개정되기 전의 것, 이하 같다) 제59조는 ‘개인정보를 처리하거나 처리하였던 자는 다음 각 호의 어느 하나에 해당하는 행위를 하여서는 아니 된다.’고 규정하면서 제2호에서 ‘업무상 알게 된 개인정보를 누설하거나 권한 없이 다른 사람이 이용하도록 제공하는 행위’를 규정하고 있고, 제71조 제5호는 ‘제59조 제2호를 위반하여 업무상 알게 된 개인정보를 누설하거나 권한 없이 다른 사람이 이용하도록 제공한 자 및 그 사정을 알면서도 영리 또는 부정한 목적으로 개인정보를 제공받은 자’를 처벌하도록 규정하고 있다. 이때 ‘누설’의 사전적 의미는 ‘비밀이 새어 나감 또는 그렇게 함’이고 ‘비밀’의 사전적 의미는 ‘숨기어 남에게 드러내거나 알리지 말아야 할 일’이며, 대법원은 ‘누설’을 ‘아직 개인정보를 알지 못하는 타인에게 알려주는 일체의 행위’로 해석하여 왔다. 개인정보 보호법은 개인정보의 처리 및 보호에 관한 사항을 정함으로써 개인의 자유와 권리를 보호하고 나아가 개인의 존엄과 가치를 구현함을 목적으로 하고(제1조), 정보주체의 개인정보자기결정권을 그 보호법익으로 한다. 여기에서 개인정보자기결정권은 인간의 존엄과 가치, 행복추구권을 규정한 헌법 제10조 제1문에서 도출되는 일반적 인격권 및 헌법 제17조의 사생활의 비밀과 자유에 의하여 보장되는 것으로, 자신에 관한 정보가 언제 누구에게 어느 범위까지 알려지고 또 이용되도록 할 것인지를 그 정보주체가 스스로 결정할 수 있는 권리이다. 이러한 구 개인정보 보호법 제59조 제2호 및 제71조 제5호의 문언, 개인정보 보호법의 입법 목적과 취지, 개인정보자기결정권의 의미 등을 종합하면, 구 개인정보 보호법 제59조 제2호에서 금지하는 개인정보의 누설에 관하여 정보주체의 사전 동의가 있는 경우에는 피고인을 벌할 수 없다고 봄이 타당하다.
Order
원심판결을 파기하고, 사건을 서울중앙지방법원에 환송한다.
Unofficial English translation
The judgment of the court below is reversed, and the case is remanded to the Seoul Central District Court.
Provisions referred to
헌법 제10조, 제17조, 구 개인정보 보호법(2023. 3. 14. 법률 제19234호로 개정되기 전의 것) 제59조 제2호, 제71조 제5호(현행 제71조 제9호 참조), 개인정보 보호법 제1조
Read 2026-10-24 · Cross-read 2026-10-24. All quotes matched against the official text. The Chinese-character placeholders the court used for anonymised parties are given in their Korean readings, and parenthetical Chinese-character glosses are omitted.
Every entry is published only after all quotes have been matched character by character against the official text, and audited by an independent second reading from a different model family across all eight axes. Both agreed axes and text-grounded interpretive divergences are recorded openly. The ledger is a research record, not an assessment of the court or advice on any matter.
Back to the ledger