Supreme Court rules hackers handling stolen data are personal information processors

The Supreme Court ruled that entities obtaining personal information through hacking or other illicit means qualify as personal information processors if they use that data to operate business files. The decision was issued in a case involving charges of opening gambling spaces and violating the Personal Information Protection Act.

The court stated that anyone processing personal information to operate a file for business purposes falls under the definition prescribed by Article 2, Paragraph 5 of the act, even when the information was acquired through unauthorized methods such as hacking or purchased from illegal distribution channels without consent. Excluding operators of illegally obtained files from this scope could create a vacuum in protecting the right to self-determination regarding personal information, the court noted.

The justices also determined that violations involving prohibited use or provision of data and those involving acquisition through improper means constitute independent constituent elements. Because the specific requirements for each offense differ, one statute does not supersede the other; consequently, when a single act satisfies the requirements of both offenses, the violations stand in a relationship of imaginary concurrence rather than one being subsumed by the other.