개인정보 유출에 따른 비재산적 손해 - 서울고등법원 2019. 5. 3. 선고 2017나2074963 판결과 ʻ통제권의 상실ʼ을 중심으로 -

What is at stake when personal data is stolen, disclosed or processed without consent, shared with third parties against the will of the concerned data subject? And what are the possible ramifications of personal data breaches? Is it mere mental distress or angst caused by such unlawful disclosure? Or is there something else at risk looming in the background? This paper aims to bring to light the oft-overlooked and misunderstood principle of autonomy in the language and discourse regarding personal data breaches in South Korea. Two prominent judgments of the Seoul High Court and the Supreme Court of Korea will respectively be examined and criticised, wherein the judges have unduly dismissed the data subjects’ claim for damages despite the flagrant violation of the Personal Information Protection Act. It is argued that the current state of the Korean law regarding damages for personal data breaches fails to adequately protect the rights of the data subjects and in so doing has jettisoned the principle of individual autonomy. Further, this paper proposes that ‘loss of control’ be recognised as non-material damage naturally flowing from wrongful disclosure of personal information. To this end, a particular focus is placed on Article 82 of the EU General Data Protection Regulation, its Recitals, and the recent English judgment in Lloyd v Google in which the Court of Appeal held inter alia that a claimant may recover damages for loss of control of his/her data without having to prove any pecuniary loss or distress. Going forward, a more harmonised approach across legal regimes is proffered. After all, data knows no boundaries.