Operator Sentenced to Prison for Testing Gambling Site with Personal Data from Other Websites

Unauthorized Acquisition and Use of Personal Information of 796 Individuals

Supreme Court, Seocho-gu, Seoul. Photo by Yonhap News Agency

A prison sentence has been finalized for an operator who opened a gambling website and unlawfully obtained the personal information of members from other sites to use for testing purposes.

According to the legal community on May 31, the Supreme Court's First Division (Presiding Justice Seo Kyunghwan) dismissed the appeal of Mr. A, who was indicted on charges of establishing a gambling space and violating the Personal Information Protection Act, thereby upholding the original sentence of one year in prison.

At the end of 2024, Mr. A opened a gambling website and unlawfully obtained the names, account numbers, and mobile phone numbers of 796 members from other sites. He was brought to trial on charges of using this information for his work, including arbitrarily registering them as members on his own site to check its functionality.

The key issue in the trial was whether a person who acquires information by unlawful means can still be considered a "personal information controller" subject to the duties and responsibilities under the Personal Information Protection Act. If the status of personal information controller is not recognized due to the illegal acquisition of information, it would be impossible to impose legal obligations on the perpetrator. Under the current Personal Information Protection Act, a personal information controller refers to an entity that processes information for work purposes. However, there are no separate restrictions regarding the circumstances or method of acquisition.

The court ruled, "Anyone who processes information for the purpose of operating a personal information file for work, whether by themselves or through others, is considered a personal information controller regardless of how the information was acquired."

The court further stated, "If the status of personal information controller is denied due to illegal acquisition, this would create a gap in protecting the data subject’s right to informational self-determination and would relieve the perpetrator of their legal obligations. Therefore, even if the information was obtained by unlawful means, if it was used in the course of work, the individual must still bear responsibility as a legal subject."

This content was produced with the assistance of AI translation services.