Supreme Court Decision of July 12, 2018, 2015Do464

In light of the principle of personal responsibility for criminal penalties, the above provision applies only when the corporation has neglected its duty of reasonable caution or supervision regarding the work related to the violation caused by its employees (See Supreme Court Decision of July 14, 2011, 2009Do5516, etc.). According to this provision, corporations are punished for negligence in performing their duties of reasonable caution or supervision in relation to the work where the violation occurred. Whether a corporation has neglected its duty of reasonable caution or supervision in a specific case must be assessed comprehensively based on all circumstances related to the violation, including the legislative intent of the relevant law, the degree of expected infringement of legal interests due to violation of penal provisions, the purpose of establishing the penalty provisions, as well as the specific nature of the violation and the extent of the actual damage or outcome caused by it, the scale of the corporation's business, the possibility of supervision over the perpetrator, or the specific command and supervision relationships, and the measures actually taken by the corporation to prevent the violation (See Supreme Court Decision of April 15, 2010, 2009Do9624, Supreme Court Decision of December 9, 2010, 2010Do12069, etc.)

Defendant 3, as an engineer of the Central Application Team, sent an email to application engineers working in the Korean region, including Defendant 1, on April 24, 2012. It showed that Defendant 3 was working to convey the requests of Korean clients regarding the glass thickness of the panels subject to inspection through the Central Application Team to the R&D center of ○○○ headquarters ('It would be good to reflect the needs of Korean clients during initial development'), and attempted to gather and convey the demands and needs of Korean clients related to OLED panel inspection ('Please let us know the problems or areas that need improvement in the current OLED inspection, as well as future functional requirements'), which does not seem to imply that □□□ was merely an organization collecting customer information under the instructions of ○○○ headquarters. Rather, the following circumstances evidenced by the record include:

① The CEO of ○○○ headquarters sends an ethics guideline (Code of Ethics) to all employees every year urging them not to seek competitive advantage through illegal or unethical sales practices and not to gain unfair benefits through improper use of confidential information.

② The defendant company provided training and established a 'Removable Storage Usage Policy' stating that engineers must obtain client approval to store information when using removable storage devices at client sites and must comply with client security regulations.

③ The defendant company's Cheonan office included security training in monthly environmental safety training and regularly trained them to comply with client security regulations through emails.

④ The defendant company's Paju office conducted security training informing them that violations of client security regulations would be reflected in their personnel evaluations, and emphasized the importance of security regularly by explaining changes in security procedures of other companies during weekly meetings.

⑤ When performing application work at client sites, whether the defendant company employees legitimately take client information depends primarily on the supervision of the client site engineers, and since security procedures vary by client, it is not easy for the defendant company to verify afterwards whether any information that has come out from outside has been approved by the client.

⑥ The layered images of this case were not leaked to the outside of ○○○ but appeared to have been shared only among those with work-related connections within ○○○.

Based on these circumstances, it is difficult to view that the defendant company failed to exercise reasonable care to prevent the improper use and disclosure by accused field engineer Defendant 1 or neglected its supervisory duties, and there is no other evidence to support a finding of negligence in the defendant company's duty of care in their business operations.