A data leak at Duo Info (Duo), Korea's largest matchmaking company, is escalating into a class-action lawsuit. As law firms move to recruit victims and say they will seek at least 500,000 won in damages per person, attention is on what level of liability the court will recognize, given that highly sensitive data—such as marital history and assets, education, and physical conditions—was leaked on a large scale.
◇ Dozens already join class action... "At least 500,000 won per person"
According to legal sources on the 3rd, law firms LKB & Partners Pyeongsan and Sangwon are recruiting participants for a joint lawsuit, and dozens have already expressed their intention to join. The firms plan to seek at least 500,000 won in damages per person.
The incident began in Jan. last year when an employee's work PC at Duo was hacked. According to the Personal Information Protection Commission, Duo recognized the leak but, without justifiable reason, failed to meet the obligation to report it within 72 hours and did not notify data subjects. The number of confirmed victims alone totals 427,464 full members.
The Personal Information Protection Commission (PIPC) imposed a penalty surcharge of 1.197 billion won on the 23rd for neglecting its duty to implement safety measures, such as managing access to databases.
The crux of the case is the "sensitivity" of the leaked information. It was found to include not only basic data such as IDs and passwords, names, dates of birth, contact information, and addresses, but also height, weight, blood type, religion, hobbies, marital history, sibling relationships, and education and workplace information.
Law firms reviewing the case plan to seek at least 500,000 won per person in damages. The volume of leaked data is significant, and many items are sensitive and detailed personal information. Concerns are growing that such data could lead to secondary crimes beyond mere spam or advertising issues. When workplace names and contact information are combined, it could be exploited for workplace intrusion crimes, and marital history, religion, or physical data could be used for threats, insults, or invasions of privacy. The government has strengthened monitoring of secondary distribution on the dark web in connection with this case for the same reason.
Attorney Mun In-gon of Law Firm Sangwon said, "Even compared to the many past personal information leaks, this case is different in nature because highly sensitive information was leaked," adding, "That is why we set the damages claim at a minimum of 500,000 won."
◇ Looking at precedents of sensitive data leaks… damages of 10 million won have been recognized
The key question is what level of damages the court will actually recognize. Recent precedents show a clear trend that the "sensitivity" of personal information serves as the core criterion for calculating damages.
In 2019, the Seoul Central District Court recognized 10 million won in damages in a case where a counseling center used counseling transcripts as seminar materials and in a book without the parties' consent, calling it "sensitive information that can significantly invade privacy, such as dating tendencies and values." The Supreme Court finalized the ruling in 2022.
There are also cases where liability was recognized for relatively simple data leaks. The Busan District Court recognized 1 million won in damages in a case where an insurance company employee, during the handling of a traffic accident, listed the victim's address in court documents without consent. The court found that even if it was not actually used for service, merely placing it in a state where a third party could view it posed a risk of infringing legal interests.
Attorney Jeong Tae-won of LKB & Partners Pyeongsan said, "Even looking at recent precedents, it is clear that sensitivity is the most important factor in the courts' calculation of damages," adding, "The Duo case is not a simple contact leak but one that can expose a person's highly private sphere of life, so there is a strong possibility the court will recognize high damages."