One employee email, 2.8 billion won... Court: Penalty against National Credit Union Federation of Korea justified

[Financial News] The National Credit Union Federation of Korea will have to pay an administrative penalty of around 2.8 billion won in full after personal credit information was leaked in an incident that began with a single email sent by one employee. The court ruled that even a nonprofit organization can be fined based on all the dues collected from its member credit unions, treating them as “revenue.”
According to legal sources on the 11th, the Second Administrative Division of the Seoul Administrative Court, presided over by Judge Gong Hyun-jin, ruled against the plaintiff on August 20 in a suit filed by the National Credit Union Federation of Korea seeking to overturn the Financial Services Commission’s penalty decision.
In 2019, shortly before leaving the job, an employee of the National Credit Union Federation of Korea sent inspection reports, complaint investigation records and other documents containing 18,465 records of personal credit information learned through work to an employee of a local credit union in Busan via the groupware email system. The leaked information included names, account numbers, loan amounts and balances.
From 2019 to 2021, a period of about two years and 10 months, the federation stored customers’, executives’ and employees’ personal credit information unencrypted on work PCs. It also had no procedure requiring prior approval from the person responsible for management before personal credit information was sent externally by email. The federation discovered the incident about a year and seven months after it occurred, and did not report it to the Financial Supervisory Service until another eight months had passed.
Following an inspection by the Financial Supervisory Service, the Financial Services Commission imposed administrative penalties in December 2024 totaling 2.872 billion won: 248 million won for disclosure unrelated to work purposes and 2.624 billion won for a leak resulting from failure to meet the duty to safeguard the credit information processing system. Administrative penalties serve both to sanction violations and to recover unjust gains obtained through them.
The main issue was whether a penalty could be imposed on a nonprofit organization based on its “revenue.” The former Credit Information Use and Protection Act allowed a penalty of up to 3% of revenue related to the violation. The federation argued that, as a nonprofit organization, it had no revenue that could serve as a basis for the penalty because it earned no separate revenue from inspection and supervision.
The court rejected that argument. It said that “the wording of the above provision does not limit those subject to penalties to for-profit corporations,” and found that a penalty could also be imposed on the federation, a nonprofit. The court also found the FSC’s decision to count all dues as revenue related to the violation justified, because dues collected from local credit unions were closely connected to the federation’s full range of activities, including guidance and supervision. The average annual dues for fiscal years 2016–2018, which the FSC used as the base amount, were 16,660,010,000 won.
The court also rejected the claim that the two penalties amounted to double punishment. It explained that “the first and second dispositions apply in different contexts,” and that holding the employer responsible for an individual employee’s disclosure was separate from holding it responsible for failing to meet its duty to manage the computer system.
The court also rejected the argument that the groupware email did not constitute an “external transmission” because the federation and local credit unions use a shared computer network. It found that the information had been transmitted externally, saying, “The plaintiff and the local credit unions are separate legal entities, collect, use and hold different personal credit information, and cannot be considered to have been granted unrestricted mutual access to the personal credit information each holds.” The court also found a causal link between lax security management and the leak, reasoning that encryption and prior approval procedures would have prevented the employee from sending the information for personal purposes or the local credit union employee from viewing it.
The court also rejected the claim that the penalties were excessive. Citing the scale of the leak, the importance of the information, the long period of violations and the delayed report, it said that “the plaintiff’s conduct cannot be regarded as a minor violation.” An abuse or excess of discretion occurs when an administrative agency exceeds or improperly exercises the discretion granted to it by law. The court found that this was not the case, since the FSC had followed the procedures for calculating and reducing the penalties set out in the regulations.
[email protected] Kim Dong-gyu Reporter