Supreme Court rules unincorporated fire stations exempt from privacy fines

The Supreme Court ruled on March 12 that an unincorporated fire station does not qualify as a legal entity subject to dual punishment provisions under the Personal Information Protection Act, overturning a lower court conviction in case 2025Do10321.

The decision rests on the principle of legality in criminal law, which prohibits extending penal liability beyond explicit statutory definitions. While the Act designates certain government bodies without legal personality as data handlers, its penalty clause specifically targets only 'corporations or individuals.' The justices concluded that because the law lacks a clear provision applying these penalties to unincorporated public institutions, neither the entity nor its employees can be prosecuted under this specific framework.

The case involved a public official serving as an interviewer for a fire station in Gyeonggi Province who was charged with misusing personal data. The defendant had retained contact information provided by a job applicant during the hiring process and later used the number to make a private phone call containing personal remarks. Lower courts had convicted the official, reasoning that the fire station counted as a data handler and the employee was its agent.

The high court distinguished between entities that manage data and those liable for criminal penalties under the specific dual punishment clause. The ruling found an error in the lower court's judgment that recognized the defendant's guilt.