1. The Client's Situation
An education and consulting company sought to review the possibility of claiming liquidated damages and seeking compensation for breach of contract, after it confirmed indications that one of its instructors had leaked a third party's personal information to an external phishing criminal. The company also requested advice on whether the leak could constitute a criminal offense.
2. The Advice of Your Legal Team
Your Legal Team first reviewed the confidentiality and trust-protection clauses of the contract for the purpose of claiming liquidated damages. However, it presented the assessment that the leaked personal information was difficult to regard as a trade secret under the law, and that the requirements of repeated or public acts of harm were also not met, making it difficult to establish a breach of contract. A civil claim for damages was likewise evaluated as having low practical effectiveness, as proving the occurrence and amount of the damage was expected to be difficult. On the criminal side, the possibility of a violation of the Personal Information Protection Act was reviewed, but it was considered unlikely that criminal liability could be established, since the leaker was highly likely not to qualify as a "personal information controller" under the law. Nevertheless, taking into account that the facts were unclear, we also advised on the possibility of filing a criminal complaint or report so that the matter could be assessed by an investigative authority.
3. The Result
Following Your Legal Team's review, the client refrained from pursuing an excessive damages lawsuit or claim for liquidated damages, and adjusted its strategy toward reviewing whether to file a criminal complaint with an investigative authority after confirming the facts. This allowed the client to prevent unnecessary legal disputes and to organize the matter around measures that offered real practical benefit.