Law Viewer

Back Home

ENFORCEMENT DECREE OF THE ACT ON THE DEVELOPMENT OF CLOUD COMPUTING AND PROTECTION OF ITS USERS

Presidential Decree No. 26550, Sep. 25, 2015

Amended by Presidential Decree No. 28210, Jul. 26, 2017

 Article 1 (Purpose)
The purpose of this Decree is to provide for matters delegated by the Act on the Development of Cloud Computing and Protection of Its Users and matters necessary for the enforcement of said Act.
 Article 2 (Cloud Computing Technologies)
"Information and communications technologies specified by Presidential Decree" in subparagraph 2 of Article 2 of the Act on the Development of Cloud Computing and Protection of Its Users (hereinafter referred to as the "Act") means the following technologies:
1. Technologies used by virtually combining or dividing resources for information and communications (hereinafter referred to as "information and communications resources"), including integrated or shared information and communications devices, information and communications facilities, and software;
2. Technologies that process a large volume of information by dispersing it into multiple information and communications resources;
3. Other technologies that utilize information and communications resources in setting up and using cloud computing systems, including technologies that automate the placement, management, etc. of information and communications resources.
 Article 3 (Cloud Computing Services)
"Services specified by Presidential Decree" in subparagraph 3 of Article 2 of the Act means the following services:
1. Service of providing servers, storage, networks, etc.;
2. Service of providing software, including applications;
3. Service of providing an environment for developing, distributing, operating, managing, etc. software, including applications;
4. Other services of providing a combination of at least two kinds of services among those specified in subparagraphs 1 through 3.
 Article 4 (Formulation of Master Plans)
(1) When the Minister of Science and ICT intends to formulate a master plan referred to in Article 5 (1) of the Act (hereinafter referred to as "master plan"), he/she shall establish guidelines for formulating a specific plan for the administrative affairs assigned to the head of each central administrative agency involved in developing cloud computing services, facilitating the use of such services, and protecting users (hereinafter referred to as "related central administrative agency"), and shall notify the head of each related central administrative agency of such guidelines by no later than the end of February of the year immediately preceding that year in which the master plan is implemented. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(2) The head of each related central administrative agency shall formulate a specific plan for the administrative affairs assigned to the agency in accordance with the guidelines for formulation referred to in paragraph (1) and shall submit it to the Minister of Science and ICT by no later than April 30 of the year immediately preceding that year in which the master plan is implemented. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(3) The Minister of Science and ICT shall combine the specific plans submitted pursuant to paragraph (2) and the specific plan of the Minister of Science and ICT for the administrative affairs assigned to the ministry to formulate a master plan and shall finalize the master plan by no later than June 30 of the year immediately preceding that year in which the master plan is implemented, upon deliberation thereon by the Strategic Committee for Information and Communications Technology under Article 7 of the Special Act on Promotion of Information and Communications Technology, Vitalization of Convergence thereof, Etc. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(4) The Minister of Science and ICT shall promptly notify the head of each related central administrative agency of the master plan finalized under paragraph (3). <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 5 (Formulation, Evaluation, etc. of Implementation Plans)
(1) The Minister of Science and ICT shall establish guidelines for the method, etc. of formulating implementation plans referred to in Article 5 (3) of the Act and shall notify the head of each related central administrative agency of the guidelines to assist the head of each related central administrative agency formulate the implementation plan according to such guidelines. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(2) The head of each related central administrative agency shall submit to the Minister of Science and ICT a report on the outcomes of executing the implementation plan for the preceding year and the implementation plan formulated for the following year in accordance with the guidelines under paragraph (1) with respect to the administrative affairs assigned to the agency, by no later than August 31 each year. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(3) If deemed necessary, the Minister of Science and ICT may request the head of the related central administrative agency to revise or amend the implementation plan in compliance with the master plan. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(4) The Minister of Science and ICT shall evaluate the reports submitted pursuant to paragraph (2) with regard to the outcomes of executing the implementation plans for the preceding year and shall notify the head of each related central administrative agency of the findings from evaluation by no later than October 31 each year. In such cases, the head of each related central administrative agency shall reflect the findings from evaluation in the implementation plan for the following year. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(5) The head of each related central administrative agency shall comprehensively review each request made under paragraph (3), the findings from evaluation under paragraph (4), matters concerning assistance to small and medium enterprises under Article 8, etc., and shall finalize an implementation plan by no later than December 31 of the year immediately preceding that year in which the implementation plan is implemented.
(6) The Minister of Science and ICT shall consult with the Minister of the Interior and Safety on the matters concerning the realization, operation, and development of electronic government, among the matters concerning the formulation, etc. of an implementation plan under paragraphs (1), (3), and (4). <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 6 (Scope and Methods of Fact-Finding Surveys)
(1) When the Minister of Science and ICT conducts a fact-finding survey pursuant to Article 7 (1) of the Act (hereinafter referred to as "fact-finding survey"), he/she shall include the following matters: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. Status of the enterprises related to cloud computing and the size of the market;
2. Status of sales of cloud computing service providers;
3. Status of the use and distribution of cloud computing technologies and cloud computing services;
4. Status of human resources in the cloud computing industry and the estimated demand for human resources;
5. The scale of research and development of and investment in cloud computing;
6. Other matters necessary for formulating master plans and implementation plans.
(2) When the Minister of Science and ICT intends to conduct a fact-finding survey, he/she shall formulate a survey plan which includes the purposes, targets, methods, period, etc. of the survey. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(3) Fact-finding surveys shall be conducted by field survey, document investigation, statistical survey, literature survey, etc. and may be conducted electronically, such as via information and communications networks, and electronic mail, if necessary for conducting the fact-finding survey efficiently.
(4) When the Minister of Science and ICT requests cloud computing service providers, etc. to submit data or express opinions pursuant to Article 7 (2) of the Act, he/she shall notify them of the necessary matters in the survey plan formulated pursuant to paragraph (2) to request them to cooperate with him/her in such matters. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 7 (Pilot Projects)
Pursuant to Article 9 (1) of the Act, the head of a related central administrative agency may implement the following projects as pilot projects:
1. Projects for encouraging public institutions defined in subparagraph 3 of Article 2 of the Electronic Government Act, to use cloud computing and to distribute cloud computing to such public institutions;
2. Projects for commercializing cloud computing technologies;
3. Projects for commercializing cloud computing services;
4. Projects for developing converged services by utilizing cloud computing technologies and cloud computing services;
5. Other projects for promoting the use and distribution of cloud computing, including projects for technologies and services for protecting user information.
 Article 8 (Assistance to Small and Medium Enterprises)
When the Minister of Science and ICT or the head of a related central administrative agency intends to implement a research and development project pursuant to Article 8 of the Act, he/she shall formulate a plan to take measures for encouraging participation of small and medium enterprises engaging in cloud computing, determine the scope of assistance to such small and medium enterprises and specific methods for implementing the project, etc., and shall reflect them in the implementation plan. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 9 (Facilitation of Introduction of Cloud Computing to State Agencies, etc.)
(1) If a master plan or an implementation plan formulated for national informatization under the Framework Act on National Informatization contains any matter regarding a policy related to the introduction of cloud computing or the budget necessary for implementing a project for cloud computing, the Minister of Science and ICT shall review the relevant matter pursuant to Article 12 (2) of the Act, and may express his/her opinion on the matter to the Minister of Strategy and Finance and the head of the related central administrative agency. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(2) When the Minister of Science and ICT intends to express his/her opinion pursuant to paragraph (1), he/she shall consult with the Minister of the Interior and Safety on the matters concerning the introduction of cloud computing in connection with the realization, operation, and development of the electronic government. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 10 (Methods, etc. for Forecasting Demand)
(1) Pursuant to Article 13 (1) of the Act, the head of each State agency, local government, or public institution defined in subparagraph 3 of Article 2 of the Electronic Government Act, (hereinafter referred to as "State agency or institution") shall submit information about the upcoming annual demand of the agency or institution for cloud computing projects to the Minister of the Interior and Safety by no later than October 31 each year, and the Minister of the Interior and Safety shall collect such information and submit it to the Minister of Science and ICT. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(2) The Minister of Science and ICT shall disclose the details of information about the demand for cloud computing projects within 30 days from the date he/she receives such information pursuant to paragraph (1) through the system for collective management of information on the software industry under Article 14 (2) of the Software Industry Promotion Act or the website of the Ministry of Science and ICT or by any other similar means. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(3) Except as otherwise expressly provided for in paragraph (2), the Minister of Science and ICT shall determine the specific methods and procedure for disclosure in consultation with the Minister of the Interior and Safety. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 11 (Formulation of Policy for Training Specialized Human Resources)
(1) When the Minister of Science and ICT formulates a policy for training human resources specialized in cloud computing pursuant to Article 14 (1) of the Act, the policy shall be based on the data obtained by surveying the status of human resources in the cloud computing industry and demand forecast for human resources under Article 6 (1) 4. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(2) If the Minister of Science and ICT deems it necessary to formulate a policy under paragraph (1), he/she may gather consensus from related central administrative agencies, experts, organizations, institutions, etc. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 12 (Designation, etc. of Institutions for Training Specialized Human Resources)
(1) Any person who wishes to be designated as an educational institution specialized in cloud computing pursuant to Article 14 (2) of the Act (hereinafter referred to as "institution for training specialized human resources") shall meet all the following requirements for designation:
1. The person shall be any of the following institutions and organizations:
(a) A school that operates educational courses related to cloud computing, among the schools defined in Article 2 of the Higher Education Act;
(b) An institution that operates educational courses related to cloud computing, among institutions established pursuant to any other Act as educational institutions similar to those defined in Article 2 of the Higher Education Act;
(c) A public institution that executes affairs related to cloud computing, among public institutions under Article 4 of the Act on the Management of Public Institutions;
(e) Any other institution or organization that executes affairs related to cloud computing;
2. The person shall meet all the requirements under attached 1 regarding human resources, facilities, etc.
(2) Any person who wishes to be designated as an institution for training specialized human resources shall file an application for designation in the attached Form with the Minister of Science and ICT, accompanied by the following documents: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. Articles of incorporation;
2. Status of human resources, facilities, and equipment secured for education;
3. An education plan, including educational courses and curricula;
4. A financing plan for operating expenses and a plan for utilizing subsidies;
5. Education regulations.
(3) When the Minister of Science and ICT designates an institution for training specialized human resources, he/she shall notify the relevant institution or organization of such designation and shall publish it on the website of the Ministry of Science and ICT. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(4) Pursuant to Article 14 (2) of the Act, the Minister of Science and ICT may fully or partially subsidize an institution for training specialized human resources for the following expenses: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. Teaching remuneration and allowances;
2. Costs of teaching materials and equipment, and materials for practice;
3. Expenses for practice;
4. Other expenses incurred in training human resources specialized in cloud computing.
 Article 13 (Procedure for Revoking Designation of Institutions for Training Specialized Human Resources)
(1) When the Minister of Science and ICT intends to revoke designation of an institution for training specialized human resources pursuant to Article 14 (3) of the Act, he/she shall hold a hearing under the Administrative Procedures Act. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(2) When the Minister of Science and ICT revokes designation of an institution for training specialized human resources, he/she shall notify the relevant institution or organization of such revocation and shall publish it on the website of the Ministry of Science and ICT. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 14 (Assistance in Establishment of Integrated Information and Communications Facilities Based on Cloud Computing Technologies)
(1) Pursuant to Article 16 (1) of the Act, the State and local governments may grant subsidies within budgetary limits for expenses incurred in building infrastructure necessary for establishing information and communications facilities integrated by using cloud computing technologies (hereinafter referred to as "integrated information and communications facilities based on cloud computing technologies"), such as information and communications networks.
(2) Pursuant to Article 16 (1) of the Act, the State and local governments may provide technical assistance in improving energy efficiency of facilities and securing stable operation in connection with the establishment of integrated information and communications facilities based on cloud computing technologies. In this regard, the head of a related central administrative agency or the head of a local government may request the Minister of Science and ICT or the Minister of the Interior and Safety to cooperate in technical assistance. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 15 (Designation, etc. of Specialized Agency)
(1) A specialized agency under Article 19 (1) of the Act shall execute the following affairs: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. Research and development of cloud computing technologies;
2. Introduction and active use of cloud computing;
3. Introduction and active use of cloud computing in State agencies, etc.;
4. Assistance in training human resources specialized in cloud computing;
5. Research, development, and technical assistance for protecting users of cloud computing;
6. Creation of an environment safe for using cloud computing;
7. Assistance in projects implemented by the Minister of Science and ICT, the head of a related central administrative agency, or the head of a local government to promote the cloud computing industry and to facilitate the use of cloud computing.
(2) Pursuant to Article 19 (1) of the Act, the Minister of Science and ICT shall designate the following institutions as specialized agencies, taking into consideration the nature of affairs: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. The National Information Society Agency referred to in Article 14 of the Framework Act on National Informatization (hereinafter referred to as the National Information Society Agency");
2. The Korea Local Information Research and Development Institute under Article 72 of the Electronic Government Act (hereinafter referred to as the "Korea Local Information Research and Development Institute");
3. The Korea Internet and Security Agency under Article 52 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (hereinafter referred to as the "Korea Internet and Security Agency");
(3) Each specialized institutions referred to in paragraph (2) shall submit a business plan for the relevant year and a performance report for the preceding year to the Minister of Science and ICT by no later than January 1 each year. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 16 (Suspension Period of Cloud Computing Services Subject to Notification)
"Period specified by Presidential Decree" in Article 25 (1) 3 of the Act means either of the following cases:
1. Where the period during which cloud computing services are suspended continuously is at least ten consecutive minutes;
2. Where cloud computing services are suspended at least twice during 24 hours from the time cloud computing services are initially suspended and the period of suspension in total is not less than 15 minutes.
 Article 17 (Details and Method of Notice)
(1) In any case referred to in Article 25 (1) of the Act, the person who provides cloud computing services (hereinafter referred to as "cloud computing service provider") shall promptly notify the relevant users of the following matters: Provided, That, if it is impracticable to ascertain the cause of the suspension referred to in subparagraph 2 immediately, the cloud computing service provider shall promptly notify the relevant user of the rest of the following matters first, and then shall notify the relevant user of the cause of the suspension, when ascertained:
1. Details of the suspension;
2. Cause of the suspension;
3. Measures taken by the cloud computing service provider to prevent the worsening of loss;
4. Methods for preventing users of cloud computing services (hereinafter referred to as "cloud computing service users") from sustaining loss or preventing the worsening of loss;
5. The office in charge and its contact information.
(2) A cloud computing service provider shall give notice under paragraph (1) by at least one means, among telephone, mobile phone, mail, electronic mail, text message, posting the notice on the access screen for cloud computing services, and other similar means: Provided, That the notice shall be posted for at least 15 days, if it is given on the access screen for cloud computing services.
(3) If it is impracticable to give notice under paragraph (1) due to a natural disaster or other force majeure event, public notice may be given in lieu thereof by publishing it at least once in two or more general daily newspapers distributed nationwide defined in subparagraph 1 (a) of Article 2 of the Act on the Promotion of Newspapers, Etc.
(4) A cloud computing service provider who gives public notice pursuant to paragraph (3) shall promptly notify the Minister of Science and ICT of the natural disaster or other force majeure and of details of the public notice, in writing (or by electronic document). <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(5) When a cloud computing service provider notifies the Minister of Science and ICT of the divulgence of user information referred to in Article 25 (1) 2 of the Act pursuant to Article 25 (2) of the Act, he/she shall include the following information in the notification: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. A summary of the user information divulged (limited to where such information has been ascertained);
2. The time and details of divulgence;
3. Measures taken by the cloud computing service provider to prevent the worsening of loss.
 Article 18 (Measures for Preventing Worsening of Loss, etc.)
Pursuant to Article 25 (3) of the Act, the Minister of Science and ICT may take the following measures: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. Requesting the preservation and submission of data for analyzing causes of divulgence accidents, etc. and conducting on-site investigations;
2. Rendering assistance with technology and human resources in recovering from loss incurred by divulgence accidents and preventing recurrence of such accidents;
3. Ascertaining whether measures necessary for preventing the worsening of loss and recurrence, and for recovering from loss have been taken and requesting to take measures for improvement;
4. Other necessary measures, such as guidance and publicity necessary for preventing the worsening and recurrence of loss and recovering from loss.
 Article 19 (Notice, etc. of Expiration of Contract or Closure of Business)
(1) Pursuant to Article 27 (3) and (6) of the Act, a cloud computing service provider shall notify a user of the following matters by no later than 30 days before the contract with the user expires:
1. The date and time the contract expires;
2. A statement that the user may demand user information to be returned;
3. A statement that user information will be destroyed, if the user does not accept the return of user information or does not wish to have user information returned before the contract expires;
4. The method and procedure for returning user information;
5. The office in charge and its contact information.
(2) When a cloud computing service provider intends to completely or partially discontinue its services, it shall notify users of the following matters by no later than 30 days before the date the services discontinue, in accordance with Article 27 (4) of the Act, and shall post such matters on the website of the cloud computing service provider until the services discontinue:
1. Details of the matters to be discontinued and reasons for discontinuance;
2. Date services discontinue;
3. A statement that users may demand to return user information;
4. A statement that user information will be destroyed, if a user does not accept the return of user information or does not want to have user information returned before the date the services discontinue;
5. The method and procedure for returning user information;
6. The office in charge and its contact information.
(3) A cloud computing service provider shall give notice under paragraph (1) or (2) by at least one means, among telephone, mobile phone, mail, electronic mail, text message, and other similar means.
(4) Pursuant to Article 27 (3) and (4) of the Act, a cloud computing service provider shall return user information before the relevant contract expires or the services discontinue, and such user information shall be returned in a usable state.
(5) When a cloud computing service provider destroys user information pursuant to Article 27 (3) and (4) of the Act, it shall permanently delete the information irrecoverably.
(6) When a public institution under subparagraph 3 of Article 2 of the Electronic Government Act intends to use cloud computing services, it shall make a contract with a cloud computing service provider in accordance with the guidelines established by the Minister of the Interior and Safety, pursuant to Article 27 (5) of the Act, regarding the methods and timing for giving notice of the expiration of a contract or of the discontinuance of services; and regarding the methods and timing for returning or destroying user information under paragraphs (1) through (5). <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
 Article 20 (Delegation and Entrustment)
(1) Pursuant to Article 31 (1) of the Act, the Minister of Science and ICT shall delegate his/her authority to conduct fact-finding investigations under Article 30 (1) through (4) of the Act to the Director-General of the Central Radio Management Service. <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
(2) Pursuant to Article 31 (2) of the Act, the Minister of Science and ICT shall entrust the following affairs under his/her jurisdiction, to the National IT Industry Promotion Agency: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. Fact-finding investigations;
2. Assistance to small and medium enterprises under Article 11 of the Act (excluding technical assistance and subsidization for expenses under Article 11 (1) 2 of the Act);
3. Receiving forecasts on demand under Article 13 of the Act;
4. Projects for promotion of international cooperation and overseas expansion under Article 15 of the Act;
5. Assistance in establishing integrated information and communications facilities based on cloud computing technologies under Article 16 of the Act.
(3) Pursuant to Article 31 (2) of the Act, the Minister of Science and ICT shall entrust the following affairs under his/her jurisdiction, to the Korea Internet and Security Agency: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. Technical assistance and subsidization for expenses to small and medium enterprises under Article 11 (1) 2 of the Act;
2. Research and development of standards for protecting information under Article 23 (2) of the Act;
3. Receipt of notice of user information divulged under Article 25 (2) of the Act;
4. Measures for preventing the worsening and recurrence of loss and recovering from loss under Article 25 (3) of the Act.
(4) Pursuant to Article 31 (2) of the Act, the Minister of Science and ICT and the Minister of the Interior and Safety may entrust the following affairs under their jurisdiction to the National Information Society Agency or the Korea Local Information Research and Development Institute. In such cases, the Minister of Science and ICT and the Minister of the Interior and Safety shall give public notice of the institutions and affairs entrusted: <Amended by Presidential Decree No. 28210, Jul. 26, 2017>
1. Formulation of policies and technical assistance for introducing cloud computing by State agencies, etc. under Article 12 of the Act;
2. Assistance in establishing integrated information and communications facilities based on cloud computing technologies under Article 16 of the Act (limited to the matters in which assistance is requested to the Minister of the Interior and Safety pursuant to Article 14 (2) of this Decree);
3. Development of policies and technical assistance for using cloud computing services by public institutions under Article 20 of the Act.
 Article 21 (Guidelines for Imposing Administrative Fines)
The guidelines for imposing administrative fines under Article 37 (1) of the Act shall be prescribed in attached Table 2.
ADDENDUM
This Decree shall enter into force on September 28, 2015.
ADDENDA <Presidential Decree No. 28210, Jul. 26, 2017>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Articles 2 through 6 Omitted.