When a personal data breach occurs, affected users can file a damages lawsuit against the company involved. The legal basis, litigation procedures, and key checkpoints that users should verify are summarized below.

■ Case: Damage That Began With an Unfamiliar Phone Call

Ms. C, a housewife in her 40s, is a victim of a personal data leak from an online shopping mall she had used for a long time. One day, she received a call from an unfamiliar number, and the caller accurately knew her name, address, and recent order history. Based on this information, the caller requested payment details. Immediately after Ms. C, feeling anxious, contacted the shopping mall's customer service, she confirmed that the company had announced a personal data breach incident. Realizing that she was among those affected by the leak, Ms. C began looking into available courses of action.

■ Legal Basis: Liability for Compensation Under the Personal Information Protection Act

The Personal Information Protection Act stipulates that a personal information controller is liable for compensation if it leaks personal information intentionally or negligently, thereby causing harm to users. Affected users can claim individual compensation through civil lawsuits, and when there are multiple victims, cases may proceed as joint lawsuits or class actions.

■ Core Issue in Litigation: Whether Safety Measure Obligations Were Fulfilled

• The following are key issues in damages lawsuits:
• The specific items of leaked personal information and the circumstances of the leak
• Whether the company neglected its security management duties
• The fact that actual damage occurred

Courts determine liability and the scope of compensation by examining whether the personal information controller fulfilled the safety measure obligations required by law and whether actual damage resulted from the leak.

■ User Response Procedures and Essential Checkpoints

The procedures that users considering litigation should follow are outlined below.

① Confirm the breach: Receive or verify notification of the breach and the specific items leaked from the company. ② Consult with specialized agencies: File a report with the Personal Information Protection Commission or seek consultation through the Personal Information Infringement Report Center of the Korea Internet & Security Agency. ③ Preserve evidence: Save records of the breach notification and materials supporting the circumstances of the damage. These serve as crucial evidence in subsequent litigation procedures. ④ Consult with legal experts: When preparing for a lawsuit, consult with legal professionals to confirm the procedures. ⑤ Multi-victim lawsuits: When there are multiple victims, a method of recruiting a plaintiff group through law firms or civic organizations may also be utilized.

■ Precautions: The Burden of Proof Lies with the User

Damages lawsuits follow a structure in which the user's side must directly prove the company's fault, causation, and the occurrence of damages. Therefore, compensation is not automatically awarded simply because a leak has been confirmed. Lawsuit outcomes are finalized through court deliberation and judgment, and the procedures and results vary by case.

[This article is for general informational purposes and does not guarantee the outcome of any individual lawsuit or the availability of compensation. For specific procedures and responses, you must consult the Personal Information Protection Commission, the Personal Information Infringement Report Center, or a legal expert. This article was produced with AI assistance.]