【Holding】
[1] Meaning of "provision to a third party" of personal information under the former Personal Information Protection Act, and whether it is distinguished from a personal information controller's internal use of personal information for its own business and interests while retaining control and management of the personal information (affirmative) / Whether the same applies where a "person who has received personal information from a personal information controller" under Article 19 of the same Act provides the received personal information again to a third party (affirmative)
[2] Meaning of "the purpose for which the personal information was provided" under Article 19 of the former Personal Information Protection Act
[3] Method of determining whether a person who received personal information from a personal information controller used it "for any purpose other than the intended purpose," in relation to the establishment of the crime of violating Articles 71 subparag. 2 and 19 of the former Personal Information Protection Act
[4] In a case where the defendant, who registered as a candidate for union president in an election of officers of a housing redevelopment project association, received from the association an electoral roll containing members' personal information for the purpose of election campaigning and then provided part of the electoral roll to an election worker so that the worker could campaign by telephone, and was indicted on the charge of providing personal information received from a personal information controller to a third party for an improper election campaign, which is a purpose other than that for which it was provided, the Court held that the lower court erred in its misapprehension of legal principles by reaching a contrary conclusion, even though the defendant's act of merely handing the electoral roll to an election worker for the purpose of election campaigning could hardly be regarded as using it for a purpose other than that for which it was provided
【Summary of Decision】
[1] Article 19 of the former Personal Information Protection Act (before being amended by Act No. 19234, Mar. 14, 2023) provides that a person who has received personal information from a personal information controller shall not use the personal information for any purpose other than the intended purpose for which it was provided, or provide it to a third party, except where separate consent is obtained from the data subject or where other Acts specially provide otherwise, and Article 71 subparag. 2 provides for the punishment of a person who uses personal information or provides it to a third party in violation of Article 19.
"Provision to a third party" of personal information means that control and management of the personal information are transferred, beyond the scope of the original purpose of collection and use, for the business and interests of the person receiving the information, and it is distinguished from a personal information controller's internal use of personal information for its own business and interests while retaining control and management of the personal information. The same applies where a "person who has received personal information from a personal information controller" under Article 19 of the same Act provides the received personal information again to a third party.
[2] The former Personal Information Protection Act (before being amended by Act No. 19234, Mar. 14, 2023; hereinafter the same) provides for the collection and use of personal information by personal information controllers in Articles 15 and 16, provides for the cases in which a personal information controller may provide collected personal information to a third party in each subparagraph of Article 17(1) and Article 17(3), and provides for the cases in which a personal information controller may use personal information for a purpose other than the intended purpose or provide it to a third party in each subparagraph of Article 18(2). Article 19, addressed to a "person who has received personal information from a personal information controller," provides that such person shall not use the personal information for any purpose other than the intended purpose for which it was provided, or provide it to a third party, except where separate consent is obtained from the data subject or where other Acts specially provide otherwise. Considering the structure and wording of these provisions as a whole, "the purpose for which the personal information was provided" under Article 19 of the former Personal Information Protection Act should be understood as "a purpose related to the cases in which personal information may be provided to a third party" as prescribed in each subparagraph of Article 17(1), Article 17(3), and each subparagraph of Article 18(2) of the same Act, and not as a subjective and unilateral purpose held by the recipient unrelated thereto. This is because, where a personal information controller collects personal information and then provides it to a third party, thereby transferring control and management of the personal information, the personal information must be used in a manner consistent with the reason or intent of such provision.
[3] In determining whether a person who received personal information from a personal information controller used it "for any purpose other than the intended purpose" in relation to the establishment of the crime of violating Articles 71 subparag. 2 and 19 of the former Personal Information Protection Act (before being amended by Act No. 19234, Mar. 14, 2023; hereinafter the same), the scope of the "purpose" should be reasonably determined by comprehensively considering the original purpose of collecting the personal information and the scope of the third party's purpose of use to which the data subject consented, the content of the relevant provision where the personal information controller provides personal information pursuant to a special provision of another Act, the specific content of the expressions of intent regarding the provision of personal information exchanged between the personal information controller and the recipient, and the content of the relevant guidelines or rules internally established by the personal information controller or the recipient regarding the provision of personal information. Furthermore, unless the right to informational self-determination is unduly infringed beyond the scope reasonably foreseeable from the standpoint of the data subject and the personal information controller, the recipient's use of personal information should not readily be concluded to be use "for a purpose other than the intended purpose" under Article 19 of the former Personal Information Protection Act merely because it violates some agreement with the personal information controller or their internal rules that are not directly related to infringement of the right to informational self-determination.
[4] In a case where the defendant, who registered as a candidate for union president in an election of officers of a housing redevelopment project association, received from the association, for the purpose of election campaigning, an electoral roll containing personal information of members such as their names, addresses, telephone numbers, and dates of birth, and then, in violation of the restriction on campaign methods allowing only the candidate himself or herself to campaign by telephone, provided part of the electoral roll to an election worker so that the worker could campaign by telephone, and was indicted on the charge of providing personal information received from a personal information controller to a third party for an improper election campaign, which is a purpose other than that for which it was provided, the Court held as follows: the "application for inspection and copying of documents" that the defendant submitted to the association to obtain the electoral roll merely stated "election campaign" in the column for use and purpose without any other specific statement; the association's rules merely provided that "the finalized electoral roll may be provided to candidates, and candidates shall not use it for 'purposes other than the election,'" and imposed no other specific restrictions on the purpose of providing and using the electoral roll, which constitutes personal information; when the association's election management rules are examined as a whole, they are interpreted as permitting election workers to perform factual acts assisting a candidate's election campaign; even from the standpoint of the data subjects who provided the personal information in the electoral roll and the association as the personal information controller, it is within a reasonably foreseeable range that a candidate who received the electoral roll would use it together with election workers in the course of election campaigning; and it is difficult to conclude that the defendant's violation of the restriction on campaign methods by instructing an election worker to campaign by telephone, in itself, constitutes use "for a purpose other than the intended purpose" to the extent of unduly infringing the data subjects' right to informational self-determination. Considering these circumstances comprehensively, the defendant's act of merely handing the electoral roll to an election worker for the purpose of election campaigning could hardly be regarded as using it for a purpose other than that for which it was provided, and the lower court's judgment, which held otherwise, was erroneous in its misapprehension of legal principles.
【Referenced Statutes】
[1] Articles 19 and 71 subparag. 2 of the former Personal Information Protection Act (before being amended by Act No. 19234, Mar. 14, 2023) [2] Articles 15, 16, 17(1) and (3), 18(2), and 19 of the former Personal Information Protection Act (before being amended by Act No. 19234, Mar. 14, 2023) [3] Articles 19 and 71 subparag. 2 of the former Personal Information Protection Act (before being amended by Act No. 19234, Mar. 14, 2023) [4] Articles 15, 16, 17(1) and (3), 18(2), 19, and 71 subparag. 2 of the former Personal Information Protection Act (before being amended by Act No. 19234, Mar. 14, 2023)
【Referenced Precedents】
[1] Supreme Court Decision 2020Do14713, February 13, 2025 (Gong2025Sang, 576)
[2] Supreme Court Decision 2023Do8339, January 8, 2026 (Gong2026Sang, 470)
(Source: Supreme Court Decision 2024Do17852, July 16, 2026 | Judicial Information Disclosure Portal, Precedents)
2026. 10. 14. · By Attorney Dongwoo Shin
Call
KakaoTalk
E-mail