Hello. I am Attorney Shin Jun-sun from the Law Firm Cheongchul.

“It’s a work PC, so why can’t the company check it?”
“I suspect that the employee is leaking company information; how can I find evidence?”

When handling corporate legal matters, I often receive such questions.

Recently, an interesting ruling came out from the Daegu District Court related to this issue. The company president investigated the PC of an employee who was on industrial accident leave with digital forensics and ended up being held liable for damages of 3 million won. While it is known that looking into an employee's PC or email could be punishable by criminal law, this time, the civil liability for the invasion of privacy was acknowledged, rather than a violation of the Personal Information Protection Act.

So, under what circumstances will a company be held responsible for checking the contents of a work PC without the employee’s consent? Let’s examine how the court's judgment on this has changed over the past 20 years through major precedents.

[Question]

What legal responsibilities does a company incur when it accesses an employee's work PC without their consent?

[Answer]

1. 2003 case - Violation of the Communication Privacy Protection Act, Information and Communications Network Act, and Criminal Law recognized

In 2003, the Supreme Court confirmed a guilty verdict from the lower court concerning an unauthorized email reading incident at a broadcasting company (Supreme Court ruling 2003. 8. 22. 2003do3344).

The then CEO of the company, suspecting that the sales branch manager was leaking unfavorable internal matters to the media, instructed a contract employee to "check the computer emails and let me know." Accordingly, the contract worker accessed the victim's email account without permission 8 times from January to February 2002, and another audit staff member obtained the CMOS password and Windows screensaver password of another victim's laptop and used it to access personal documents.

The court recognized the accessing of the email account as a violation of the Communication Privacy Protection Act and Information and Communications Network Act, and additionally recognized the act of accessing documents by bypassing the laptop password as a criminal offense of secret violation. In particular, regarding the defendants' claim that