KLAWGURU.COM

Korean Law Demystified!

No Legal Personality, No Joint Liability: Supreme Court Blocks Privacy Law Prosecution of Fire Station Interviewer

By ,

A fire station interviewer who misused a job applicant’s personal information cannot be prosecuted under the Personal Information Protection Act’s dual liability provision — because the fire station itself, lacking independent legal personality, falls outside the provision’s scope. Here are the key points.

Issue

Can an employee of a public agency that lacks independent legal personality be prosecuted under the dual liability (양벌규정) provision of the Personal Information Protection Act, when that provision on its face applies only to corporations and individuals?

Facts

  • Interviewer B, serving on a hiring panel at Fire Station A, obtained a job applicant’s mobile phone number in the course of the interview process, retained it privately, and later called the applicant to make personal remarks.
  • B was charged with violating the Personal Information Protection Act.

Lower Court Decisions

  • Both the trial court and the appellate court convicted B and imposed a fine of ₩300,000.
  • The appellate court reasoned that Fire Station A qualified as a personal information controller under the Act, and that B, as the station’s employee, fell within the scope of the dual liability provision as the person who actually committed the violation.

Rule

  • The dual liability provision of the former Personal Information Protection Act extends criminal liability beyond the primary offender to the employing entity — and to employees acting on the entity’s behalf — where the entity is a corporation or an individual business operator.
  • Critically, the provision expressly limits its application to corporations or individuals. It does not explicitly address public agencies that lack independent legal personality.
  • Under the principle of legality (죄형법정주의) — the constitutional rule that criminal liability must be clearly established by statute — penal provisions cannot be extended by analogy to cover persons or entities not expressly included.

Supreme Court Decision

  • The Supreme Court (Criminal Division 2, presiding Justice Eom Sang-pil) reversed the appellate decision on March 12, 2026, and remanded the case to Seoul Eastern District Court.
  • Fire Station A is a direct subordinate organ of Gyeonggi Province — a public agency without independent legal personality. It is neither a corporation nor an individual, and the former Act contains no explicit provision bringing such agencies within the dual liability framework.
  • Because Fire Station A itself cannot be punished under the dual liability provision, B as its employee cannot be prosecuted under that provision either. The employee’s liability under the dual liability rule is derivative — it exists only where the employing entity is itself a covered party.

Key Takeaways

  • The dual liability provision of the former Personal Information Protection Act does not apply to public agencies that lack independent legal personality, such as fire stations operating as direct arms of a provincial government.
  • Where the employing entity cannot be held liable under the provision, neither can the individual employee who committed the act — the two are legally linked.
  • The principle of legality bars courts from reading unincorporated public agencies into a penal provision that does not mention them, however natural the extension might seem.
  • This does not necessarily mean the conduct goes entirely unpunished — the remand leaves open the possibility of conviction on a different legal basis, and the Act has since been amended.

Why This Matters

This ruling exposes a structural gap in how Korean privacy law allocates criminal responsibility across different types of public sector entities. For practitioners, it is a reminder that dual liability provisions in Korean statutes must be read strictly — the identity and legal character of the employing entity is a threshold question, not an afterthought. For legislators and regulators, the decision underscores the importance of expressly addressing unincorporated public agencies in penal provisions, a gap that the subsequent amendment to the Personal Information Protection Act appears to have addressed.

Article: https://www.lawtimes.co.kr/news/articleView.html?idxno=219777

Leave a comment