개인정보의 기술적·관리적 보호조치에 대한 고찰 -대법원 2021. 8. 19. 선고 2018두56404 판결-

Abstract

Information and communications services provide significant benefits to users, but behind them, there is a risk of computer security incident(ex. leakage of personal information). If the user's personal information is leaked in large quantities by so-called hacking, the biggest issue is whether the service provider complies with technical and managerial protection measures. This decision determined whether the Plaintiff, the provider of information and communications services, violates the duty of protection measures of personal information by law. In this regard, it is necessary to make a detailed judgment on whether the installation and operation of a system to prevent illegal access and infringement accidents were appropriate and whether the duty of protective measures to prevent disclosure or leakage of personal information was fulfilled. Since the criteria for protection measures is used the basis for administrative sanctions, the clarity and strict interpretation principles are applied, and accordingly, the violation of the duty of protective measures is passively interpreted, and the liability of the business is eased. On the other hand, it should be reviewed whether it is reasonable that the notice in this case, which has the form of administrative rules, has the nature of a legal order as a guideline for sanctions, and there is room for violation of the comprehensive commission support rule in light of the regulatory system and scope of delegation of the notice. And as a detailed issue, it is necessary to check whether a web server or web page is included in the personal information processing system, and how to determine the criteria for intrusion prevention and intrusion detection functions to be included in the interpretation of laws and regulations. As the guideline of protection measures set by the notice of this case falls under the sanctions standard and the strict interpretation principle is applied, it may be pointed out that the court may make a too passive judgment to exempt service providers and give them a false perception that it is not a legal problem even with minimal protection measures. In particular, when comparing changes in the legal system, which is actively using personal information due to the revision of the three data laws, the trend of overseas laws such as GDPR and CPRA, and the degree of administrative orders for violations, it is necessary to consider in depth.