for early access to the latest igaming videos!
and get the latest igaming news first!
The South Korean Supreme Court has made clear that using another person’s personal information, even when obtained illegally, still counts as handling data under the Personal Information Protection Act.
The judges explained that if offenders were not treated as “personal information processors” simply because the data was acquired unlawfully, then strict responsibility and compensation for victims would be avoided, leaving a serious gap in protection.
On May 31, the legal community reported that the Court’s First Division, led by Justice Seo Kyung-hwan, rejected the appeal of Mr. A. He had been convicted for running an online gambling space and misusing hundreds of personal records.
The ruling upheld the lower court’s decision, confirming a one‑year prison sentence, according to a report by South Korean outlet News11.
Deposit and withdrawal functions confirmed the site was active
Mr. A and his accomplices set up an illegal online gambling site in 2024, using personal data taken from other platforms. They obtained the names, account details, and phone numbers of 796 people from an anonymous source and registered them on the new site.
This was done to test whether the deposit, withdrawal, and game features were working, and users were signed up without their consent.
Mr. A was charged with running an illegal gambling operation and misusing personal information. Both the first and second trial courts found him guilty and sentenced him to one year in prison.
On appeal, he argued that the site was incomplete and therefore no crime had been committed. The court rejected this, ruling that the gambling functions were already active.
The Supreme Court later upheld this view, stressing that anyone who processes personal information for business purposes is considered a “personal information processor.” “Game users could access the site to play games like baccarat and slots, and the deposit and withdrawal functions for gambling funds were actually functioning,” the court stated.
“Even if personal information is obtained through fraudulent means such as hacking, or illegally distributed personal information is obtained without the data subject’s consent or legal basis, and then processed by operating personal information files for business purposes based on it, the same cannot be regarded differently,” the judges added.
