Overruling of Corrective Orders Against Naver and Gmarket for Breaching Personal Information Protection Regulations

In January 2021, the Personal Information Protection Commission (PIPC) issued corrective orders and imposed administrative fines against Naver Corp. (Naver) and Gmarket Inc. (Gmarket) due to the continuous increase in electronic commerce fraud cases, such as the misuse of open market seller accounts. The orders were issued based on the grounds that the sellers did not take sufficient security measures when accessing the system. The PIPC considered the third-party sellers on Naver and Gmarket as personal information handlers of Naver and Gmarket, and held Naver and Gmarket responsible for their management and supervision of personal information handlers. 

Lee & Ko, on behalf of Naver and Gmarket, filed a lawsuit to cancel the corrective orders. Lee & Ko presented various evidence from different angles to prove that the sellers were independent personal information controllers who received personal information from Naver and Gmarket, rather than personal information handlers of Naver and Gmarket, and argued that the orders were illegal and unfair. 

The district court accepted the arguments of Naver and Gmarket and canceled the corrective orders imposed by the PIPC.

This case was the first case that clarified the scope of personal information handlers and holds significant value as a precedent in terms of the role and responsibilities of platform service providers in relation to e-commerce businesses, including open markets. The case is currently ongoing at the appellate court, and Lee & Ko continues to represent Naver and Gmarket.