Supreme Court sends insurance agent privacy case back for retrial

The Supreme Court on Thursday sent a fraud and privacy case involving an insurance agent back to a lower court, ruling that original judges erred in assuming the agent qualified as a personal information processor simply because he collected customer data.

The decision, delivered on February 26 in case 2024Do14998, overturns a conviction for fraud, forgery of electronic records, and violations of the Personal Information Protection Act. The high court found the lower court failed to sufficiently examine whether the agent held the ultimate authority to determine the purpose and method of data processing, a legal requirement for establishing liability.

The case centers on an agent who conspired with an accomplice to impersonate a client and modify insurance contracts using personal details such as birth dates and addresses. While the agent gathered this information while mediating contracts, the court clarified that actual collection alone does not define a processor under the Personal Information Protection Act.

Instead, the determination must rest on who holds the ultimate authority to decide the purpose, content, method and procedure of the data processing. Judges must consider whether the processing serves the unique business interests of the agent or the insurance company, and who exercises substantial command over the handling of the files.

The high court noted that agents typically mediate contracts on behalf of insurers, meaning the purpose of data collection is closely tied to the insurer's own business obligations. Consequently, the ultimate decision-making power regarding the data likely resides with the insurance company rather than the individual agent.

In its ruling, the court emphasized that liability should be assigned to the entity best positioned to protect the rights of data subjects and ensure proper handling. The lower court had convicted the agent without sufficiently examining factors such as the specific terms of his agency contract, the existence of personal information files he allegedly operated, or who actually managed those files. The case now returns for a new trial to apply these standards in determining the correct assignment of legal responsibility.