GS Caltex case

The GS Caltex case (GS 칼텍스 사건) is referred to the case where 11.5 million customers' data were leaked and a part of victims filed lawsuits for compensation only to fail.

In this case, the Supreme Court decided what kind of data breach amounts to damage to be compensated for mental distress, as explained below.

Key words
data breach, compensation for mental distress, collective lawsuits, damages

Facts
GS Caltex operated customers service centers nationwide based on the databases of personal data of GS Bonus card members who regularly used GS gas station networks. GS Caltex entrusted the operation of GS customers service centers to its subsidiary, GS Nextation.

In July 2008, several employees of GS Nextation conspired each other to steal massive personal data of GS Bonus Card members including names, resident registration numbers, addresses, telephone numbers, email addresses. They put those data into storages such as CD Roms and DVDs, and planned to sell the storages by showing them to journalists for the expected lawsuits filed by card members for damages.

In September 2008, the journalists reported shocking news that 11 million GS Caltex customers' data CDs were found from a trash can in downtown Seoul. In a few days, all the data snatchers were arrested by police, and other CD Roms and DVDs were wholly recovered by police with no customers data explicitly leaked.

First instance
In September 2010, the Seoul Central District Court decided that the court found no responsibility on the part of GS Caltex and its subsidiary, GS Nextation. The court ruled that the massive data leak could not automatically result in mental distress calling for considerable amount of damages. The court said it depends on the case-by-case type, nature and scope of leak of personal information affected by the incident. In fact, the affected personal information was only names, RR numbers, tel numbers, of the nature unlikely threatening economic interests of data subjects. And the CD Roms and DVDs containing 11.5 million customers’ personal information were recovered by police immediately after the incident.

Appellate court
In June 2011, in a collective suit filed by 5,900 appellants, the Seoul High Court affirmed the ruling of the first instance. But the appellate court added in its reasoning as follows:
 * 요컨대, 개인정보가 유출되어 자기정보결정권이 침해되기에 이르렀다는 사실만으로 곧바로 그 개인에게 ‘정신적 손해’가 발생하였다고 할 수는 없고, 개인정보의 유출로 인하여 그 개인에게 정신적 손해가 발생하였는지는 그 유출된 개인정보의 종류와 성격, 개인정보와 개인정보 주체와의 관계, 유출의 정도 및 이에 따라 예상되는 위험성, 정보수집주체가 유출된 개인정보를 이용한 방식과 규모 등 여러 요소를 고려하여 개별적, 구체적으로 판단되어야 한다. 그런데 이 사건 개인정보는 원고들의 성명, 주민등록번호, 전화번호, 이메일 주소 등 개인을 알아볼 수 있는 정보이고, ‘사상·신념, 노동조합·정당의 가입·탈퇴, 정치적 견해, 건강, 성생활 등에 관한 정보’와 같이 정보주체에 관한 아주 민감한 정보는 아닐 뿐만 아니라, ‘은행계좌번호, 은행계좌의 비밀번호 등 금융에 관한 정보’와 같이 공개될 경우 곧바로 정보주체의 경제적 이익을 침해할 우려가 높은 정보에도 해당하지 않는 것인 점, 이 사건 개인정보는 범행공모자와 언론기관 관계자에게 유출된 직후 곧바로 전체가 회수되어 폐기된 점, 실제로 이 사건 개인정보가 부정하게 사용되었다거나 이 사건 개인정보의 유출로 말미암아 이를 취득한 제3자로부터 많은 양의 스팸메시지나 스팸메일을 받게 되었다는 등의 원고들이 개별적, 구체적인 피해를 입은 사실을 인정할 증거가 없거나 부족한 상태에서, 원고들의 이 사건 개인정보가 한때나마 유출된 적이 있었다는 사실만으로 원고들에게 정신적인 피해가 있었을 것이라고 단정하기는 어렵고, 달리 원고들이 개별적, 구체적으로 정신적 피해를 입었다고 인정할 만한 증거도 없으므로, 원고들에게 정신적 손해가 발생하였다고 보기는 어렵다.

Supreme Court
In December 2012, the Supreme Court confirmed:
 * GS Caltex built and managed a database of its gas credit card members, which it used for customer service; GS Nextation, commissioned by GS Caltex to manage customer service etc., management team employee X conspired with Y et al to extract the aforementioned information (specifically: name, resident registration number, address, phone number, and email address) of credit card members including Plaintiff et al, deliver or copy the information through a DVD and other storage devices, then report the information leak to the media so that the information can be used in a class action lawsuit; and thereby provided such storage devices to journalists.

and ruled:
 * In a case where personal information collected by a person who handles the information was leaked out by the person's employee against the intentions of the subject of the personal data (hereinafter "data subject"); when determining whether the leak caused the data subject to suffer emotional distress which qualifies as compensable damages, the determination should be made after considering the following circumstances, and judged accordingly and specifically to each individual case.
 * Firstly, the type and characteristic of the leaked personal information; whether the data subject is identifiable through the leaked information; whether a third party accessed the leaked information, and if it did not occur, whether there is probability that a third party had such access or will have access in the future; to what extend the leaked information was spread; whether the leak possibly caused any additional infringement of rights; the actual reality of how the personal information was managed by the person who handled the information, and the specific circumstances in which the information was leaked; and what measures were taken to prevent injury caused by the leak, and to prevent the spread of leaked information.
 * In this case, we determined that it was difficult to perceive that Mu et al suffered emotional distress which qualifies as compensable damages on the following grounds. Firstly, although the information was first extracted by X, and then leaked to accomplices and journalists, immediately after the news reports, every storage device containing the information, as well as computers used to edit or transfer the information was seized from the related parties, or voluntarily submitted, or destroyed.
 * Secondly, the crime was discovered when the information was delivered or copied to a limited number of the aforementioned individuals while they were conspiring, planning, and preparing to sell the personal information of this case to the market or to a lawyer. Since every storage device containing the personal information of this case was seized or destroyed, and there being no trace of any other leak, it does not appear likely that any third party aside from the aforementioned individuals was able to access or use the information.
 * Thirdly, while is true that nonparty 1 and other offenders who leaked the personal information of this case, as well as journalists, did access a portion of the information; the offenders accessed the information only during the process of storing, editing, and copying it; and it does not appear that they intended to learn in detail, or understand the contents of the information themselves. As for the journalists: since they accessed the information only for the purpose of confirming its existence, scope, and accuracy during the process of coverage and report, it does not appear they were able to recognize detailed contents of the information. Considering the type and scope of the information, it seems highly difficult to identify or discover any specific personal information with the kind of aforementioned access.
 * Finally, there were no circumstances to perceive that additional injury caused by the information leak was inflicted upon the plaintiffs, such as identity confirmation or illegal use of another person's name.

In a different case, the Supreme Court held almost in a same manner:
 * In a case where a personal information handler leaks the gathered information against the intention of the data subjects; the standard to determine whether the data subjects suffered emotional distress which qualifies as compensable damages has been elaborated.
 * In this case where GS Caltex built and managed a database of its gas credit card members, which it used for customer service; GS Nextation, commissioned by GS Caltex to manage customer service etc., management team employee X conspired with Y and Z to extract the aforementioned information of credit card members including Plaintiffs, deliver or copy the information through a DVD and other storage devices, then report the information leak to the media so that the information can be used in a collective action; and thereby provided such storage devices to journalists: we determined that it was difficult to perceive that Plaintiffs suffered emotional distress which qualifies as compensable damages.