As the validity of the "online power of attorney" has emerged squarely as a key issue in the SK Telecom SIM card information leak damages suit, some say it could affect large-scale personal data leak lawsuits across the board. In particular, the Coupang case, where similar joint suits are underway, is expected to see litigation strategies shift depending on how the standards for identifying plaintiffs and proving authorization are set.
According to legal sources on the 30th, at the first hearing held on the 26th before the Seoul Central District Court Civil Division 30 (Presiding Judge Kim Seok-beom), the core issue that surfaced was not responsibility for the hacking but whether the 15,900 plaintiffs were properly identified. The case consolidates three joint suits involving 9,166, 5,275 and 1,459 people, and the plaintiffs are seeking a total of 7.95555 billion won, or 500,000 won per person.
◇ Dispute over "Are they real plaintiffs?"… SKT's defense
SK Telecom argues that in an online-based authorization method, it is difficult to rule out the possibility of duplicate applications, third-party applications, or inclusion of non-subscribers, and is demanding strict verification to identify the plaintiffs. A key point of contention is that in non-face-to-face methods such as Naver Form and Google Forms, it is not possible to completely block the possibility of duplicate participation by the same person.
The court and both sides clashing over the power of attorney also goes directly to the structure of the suit. Unlike a "class action," in which a representative acts for the whole, this case is a "joint suit" in which each participant joins as an individual plaintiff, so the court and the defendant must verify individually whether each person is an actual plaintiff, whether they authorized directly, and whether they are an SK Telecom subscriber.
The court's decision to examine the power-of-attorney issue before ruling on the merits also stems from this structure. Attorney Jeong Sang-hyeon of Law Office WANT for the plaintiffs said, "Because expressing the intention to appoint an agent in writing is a prerequisite, the aim is to sort this out before the merits." Ha Hee-bong, managing attorney at Law Office LOPID, also said, "Since issues have been raised, it appears the court intends to confirm the facts first."
However, the legal community sees limits to denying the validity of online authorization itself. Under the Electronic Signature Act and e-litigation rules, the key is whether the authorization document was prepared according to the person's own intent, whether identity can be verified, and whether the risk of forgery or alteration is sufficiently controlled.
The plaintiffs say the defendant's objections are excessive. Attorney Kim Hyeong-gyu of Law Firm DOUL said, "It may be a litigation strategy that takes the statute of limitations into account." Claims for damages cannot be filed after three years from the date the victim and wrongdoer are known. In other words, if the trial is prolonged, it could make additional participation in the suit more difficult.
◇ Ripple effects for the Coupang suits as well… "Tougher plaintiff verification standards are inevitable"
The decision in this SK Telecom case is expected to affect large-scale personal data leak lawsuits in general. In particular, the Coupang case, in which 33.67 million or so personal data records were leaked according to a government announcement, involves numerous joint suits of similar structure.
At least 11 law firms and law offices are participating in the Coupang joint suits, with the number of filings reaching dozens. The legal community believes future litigation strategies could change depending on how the standards for identifying plaintiffs are set in the SK Telecom case.
There is also a possibility that the defendant's strategy of broadly challenging, before a ruling on the merits, issues such as duplicate plaintiffs, identity verification, and whether they are actual users will spread. Accordingly, analysts say the need has grown for the plaintiffs to further strengthen procedural requirements at the recruitment stage, including stronger identity verification, cross-checking subscription information, and blocking duplicate participation.
Coupang maintains its existing position that it will wait for the results of the Personal Information Protection Commission's investigation.
In the end, observers say this case is less about upending the online power-of-attorney system itself, and more a testbed to gauge how far to raise the standards for identifying plaintiffs and proving authorization in joint suits numbering in the tens of thousands.