ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION
Wholly Amended by Act No. 6360, Jan. 16, 2001
Amended by Act No. 6585, Dec. 31, 2001
Act No. 6797, Dec. 18, 2002
Act No. 7139, Jan. 29, 2004
Act No. 7142, Jan. 29, 2004
Act No. 7262, Dec. 30, 2004
Act No. 7796, Dec. 29, 2005
Act No. 7812, Dec. 30, 2005
Act No. 7917, Mar. 24, 2006
Act No. 8031, Oct. 4, 2006
Act No. 8030, Oct. 4, 2006
Act No. 8289, Jan. 26, 2007
Act No. 8486, May 25, 2007
Act No. 8778, Dec. 21, 2007
Act No. 8867, Feb. 29, 2008
Act No. 8852, Feb. 29, 2008
Act No. 9119, jun. 13, 2008
Act No. 9637, Apr. 22, 2009
Act No. 10138, Mar. 17, 2010
Act No. 10165, Mar. 22, 2010
Act No. 10166, Mar. 22, 2010
Act No. 10465, Mar. 29, 2011
Act No. 10560, Apr. 5, 2011
Act No. 11322, Feb. 17, 2012
Act No. 11690, Mar. 23, 2013
Act No. 12681, May 28, 2014
Act No. 12844, Nov. 19, 2014
Act No. 13014, Jan. 20, 2015
Act No. 13280, Mar. 27, 2015
Act No. 13344, jun. 22, 2015
Act No. 13343, jun. 22, 2015
Act No. 13520, Dec. 1, 2015
Act No. 14080, Mar. 22, 2016
Act No. 14580, Mar. 14, 2017
Act No. 14839, Jul. 26, 2017
Act No. 15628, jun. 12, 2018
Act No. 15751, Sep. 18, 2018
Act No. 16019, Dec. 24, 2018
Act No. 16021, Dec. 24, 2018
CHAPTER I GENERAL PROVISIONS
The purpose of this Act is to contribute to improving citizens’ lives and enhancing public welfare by facilitating utilization of information and communications networks, protecting personal information of people using information and communications services, and developing an environment in which people can utilize information and communications networks in a healthier and safer way.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| (1) | The definitions of the terms used in this Act shall be as follows: <Amended by Act No. 7139, Jan. 29, 2004; Act No. 8289, Jan. 26, 2007; Act No. 8778, Dec. 21, 2007; Act No. 9119, Jun. 13, 2008; Act No. 10166, Mar. 22, 2010; Act No. 12681, May 28, 2014> |
| 1. | The term "information and communications network" means an information and communications system for collecting, processing, storing, searching, transmitting, or receiving information by using telecommunications equipment defined in subparagraph 2 of Article 2 of the Telecommunications Business Act or computers and applied computer technology; |
| 2. | The term "information and communications services" means telecommunications services defined in subparagraph 6 of Article 2 of the Telecommunications Business Act and services providing information or intermediating the provision of information by using such telecommunications services; |
| 3. | The term "provider of information and communications services" means a telecommunications business entity defined in subparagraph 8 of Article 2 of the Telecommunications Business Act and any other person who provides information or intermediates to provide information commercially by utilizing services provided by a telecommunications business entity; |
| 4. | The term "user" means a person who uses information and communications services rendered by providers of information and communications services; |
| 5. | The term "electronic document" means data prepared and transmitted, received, or stored electronically in a standardized document by a device capable of processing information, such as a computer; |
| 6. | The term "personal information" means information pertaining to an individual alive, which contains information identifying a specific person with a name, a national identification number, or similar in the form of a code, letters, voice, sound, motion picture, or any other form (including information that makes it impracticable to identify a specific person by itself, but that enables to identify such person easily if combined with another information); |
| 7. | The term "computer security incident" means an event resulting from an attack on an information and communications network or an information system related to such network by means of hacking, computer virus, logic bomb, electronic mail bomb, denial of service, high-power electromagnetic wave, etc.; |
| 8. | Deleted; <by Act No. 13343 Jun. 22, 2015> |
| 9. | The term "message board" means, regardless of its name, a computer program or a technical device with which users can publish information in the form of a code, letters, voice, sound, image, motion picture, or any other form purposely to disclose the information to the public by using an information and communications network; |
| 10. | The term "telecommunications billing services" means information and communications services to perform the following business activities: |
| (a) | Business activities charging and collecting prices for goods or services sold or provided by a third person (hereinafter referred to as "goods or services") together with charges for the telecommunications services provided; |
| (b) | Business activities transmitting and receiving information of transactions electronically so that prices for goods or services sold or provided by a third person can be billed or collected together with charges for the telecommunications services provided by oneself, or settling, on behalf of another person, or intermediating payments for such prices; |
| 11. | The term "provider of telecommunications billing services" means a person who provides telecommunications billing services after being registered under Article 53; |
| 12. | The term "user of telecommunications billing services" means a person who purchases or uses goods or services by using telecommunications billing services rendered by a provider of telecommunications billing services; |
| 13. | The term "electronic transmission medium" means a medium transmitting codes, letters, voices, images, or motion pictures to addressees in an electronic form, such as an electronic document, via information and communications networks. |
| (2) | Except as otherwise provided for in paragraph (1), definitions of the terms used in this Act shall be governed by the Framework Act on National Informatization. <Amended by Act No. 9119, Jun. 13, 2008; Act No. 11690, Mar. 23, 2013> |
| Article 3 (Responsibilities of Providers and Users of Information and Communications Services) |
| (1) | Every provider of information and communications services shall contribute to protection of rights and interests of users and enhancement of users’ abilities to use information by protecting personal information of users and providing information and communications services in a healthier and safer way. |
| (2) | Every user shall make efforts to help to establish a healthier information society. |
| (3) | The Government may provide support to organizations composed of providers or users of information and communications services for their activities for protecting personal information and protecting youths in information and communications networks. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 4 (Formulating Policy on Promotion of Utilization of Information and Communications Networks and Protection of Information) |
| (1) | The Minister of Science and ICT or the Korea Communications Commission shall formulate policies to lay the foundations for an information society through the promotion of utilization of information and communications networks; the stable management and operation of such networks; the protection of personal information of users; and other related activities (hereinafter referred to as "promotion of utilization of information and communications networks, the protection of information, or other related matters"). <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | The policies under paragraph (1) shall contain descriptions of the following: <Amended by Act No. 16021, Dec. 24, 2018> |
| 1. | Development and dissemination of technology related to the information and communications networks; |
| 2. | Standardization of information and communications networks; |
| 3. | Promotion of utilization of information and communications networks, including the development of content of information and applied service for information and communications networks under Article 11; |
| 4. | Facilitation of sharing information through information and communications networks; |
| 5. | Promotion of use of the Internet; |
| 6. | Protection of personal information collected, processed, stored, and used via information and communications networks, and development and dissemination of technology related thereto; |
| 6-2. | Protection of personal information about a child under 14 years of age who may not have a clear understanding of risks and consequences of processing of personal information, user rights, etc.; |
| 7. | Protection of youths in information and communications networks; |
| 8. | Enhancement of safety and reliability of information and communications networks; |
| 9. | Other matters necessary for the promotion of utilization of information and communications networks, the protection of information, or other related matters. |
| (3) | When preparing the policy under paragraph (1), the Minister of Science and ICT or the Korea Communications Commission shall ensure that the policy conforms to the basic plan for national informatization under Article 6 of the Framework Act on National Informatization. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 5 (Relationship with Other Statutes) |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
CHAPTER II PROMOTION OF UTILIZATION OF INFORMATION AND COMMUNICATIONS NETWORK
| Article 6 (Development of Technology) |
| (1) | The Minister of Science and ICT may engage the relevant research institute, as prescribed by Presidential Decree, to implement a project for research and development, technical cooperation, transfer of technology, technical guidance, or similar, in order to promote the development of technology and equipment related to information and communications networks. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | The Government may provide financial support to a research institute that implements a project for research and development or similar in accordance with paragraph (1) for all or part of the cost and expenses incurred in such project. |
| (3) | Matters necessary for the disbursement and management of cost and expenses under paragraph (2) shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 7 (Management and Dissemination of Technology-Related Information) |
| (1) | The Minister of Science and ICT shall manage, systematically and comprehensively, the information pertaining to technology and equipment related to information and communications networks (hereafter referred to as "technology-related information" in this Article). <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | If necessary for managing technology-related information systematically and comprehensively, the Minister of Science and ICT may request data relevant to technology-related information from the relevant administrative agency and a national or public research institute. Upon such request, the head of such agency or institute shall comply with the request, unless there is a compelling reason not to do so. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (3) | The Minister of Science and ICT shall perform projects for dissemination of technology-related information, so that technology-related information can be used promptly and easily. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (4) | Matters necessary for the scope of technology and equipment related to information and communications networks which are to be disseminated pursuant to paragraph (3), shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 8 (Standardization and Certification of Information and Communications Networks) |
| (1) | The Minister of Science and ICT shall establish and provide a public notice of the standards for information and communications networks in order to promote the utilization of information and communications networks, and may recommend providers of information and communications services or persons who manufacture or supply products related to information and communications networks to comply with the standards: Provided, That the matters for which the Korean Industrial Standards under Article 12 of the Industrial Standardization Act have already been established shall comply with such standards. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | A person who manufactures or supplies a product related to information communications in conformity with the standards publicly notified pursuant to paragraph (1) may put on the product a mark stating that the product conforms to the standards, subject to the prior certification of the certification body under Article 9 (1). |
| (3) | Where a product falls under the proviso to paragraph (1) and the certification under Article 15 of the Industrial Standardization Act has been already given to the product, the product shall be deemed to have been certified pursuant to paragraph (2). |
| (4) | No person other than a person who holds the certification under paragraph (2) may put a mark verifying that his or her product conforms to the standards or put any similar mark, nor he or she may sell a product with any similar mark or display such product for the purpose of sale. |
| (5) | The Minister of Science and ICT may order a person who sells a product in violation of paragraph (4) or displays such product for the purpose of sale, to collect and recall the product or to obtain certification to put such mark; or may take any other corrective measure as may be necessary. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (6) | Matters regarding the subject matters of the standardization, the methods and procedures for such standardization, and a mark of certification under paragraphs (1) through (3), and the collection, recall, corrective measures, etc. under paragraph (5) shall be prescribed by Ordinance of the Ministry of Science and ICT. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 9 (Designation of Certification Bodies) |
| (1) | The Minister of Science and ICT may designate an institution to certify that products related to information and communications networks (hereinafter referred to as "certification body"), which are manufactured or supplied by a person, conform to the standards publicly notified pursuant to the main sentence of Article 8 (1). <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | If a certification body falls under any of the following, the Minister of Science and ICT may revoke the designation of such body or give an order of business suspension for a prescribed period not exceeding six months: Provided, That the Minister of Science and ICT shall revoke such designation, if it falls under subparagraph 1: <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| 1. | If the body is designated by fraud or other improper means; |
| 2. | If the body has not continued its certification services for at least one year without good cause; |
| 3. | If the body fails to meet the standards for designation under paragraph (3). |
| (3) | Matters regarding the standards and procedures for designation under paragraph (1), and the criteria for revocation of designation and for business suspension of a certification body under paragraph (2), and other related matters shall be prescribed by Ordinance of the Ministry of Science and ICT. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 10 (Support for Development of Content of Information) |
With an aim of securing national competitiveness and enhancing the public interest, the Government may provide financial and technical support, or otherwise, to persons who develop content of information distributed through information and communications networks.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 11 (Acceleration of Development of Applied Services for Information and Communications Networks) |
| (1) | The Government may provide financial and technical support, or otherwise as may be necessary, to any State agency, local government, or public institution that develops and operates applied services for improving efficiency in processing its business affairs or automatizing or upgrading its business process by utilizing information and communications network (hereinafter referred to as "applied services for information and communications networks"). |
| (2) | The Government may provide financial and technical support, or otherwise as may be necessary, to the private sector with an aim of facilitating the development of applied services for information and communications networks by the private sector; and shall take the following measures for nurturing technical human resources necessary to develop applied services for information and communications networks: |
| 1. | Support for Internet education conducted by schools at different levels and other educational institutions; |
| 2. | Extension of online education for citizens; |
| 3. | Support for projects to cultivate technical human resources specializing in information and communications networks; |
| 4. | Establishment of and support for institutions to cultivate technical human resources specializing in information and communications networks; |
| 5. | Support for development and dissemination of educational programs for utilizing information and communications networks; |
| 6. | Support for establishment of the technical qualification system related to information and communications networks and support for supply of technical human resources specializing in information and communications networks on demand; |
| 7. | Other matters necessary to cultivate technical human resources related to information and communications networks. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 12 (Establishment of System for Sharing Information) |
| (1) | The Government may encourage the development of a system for sharing information through linked operation and standardization of information and communications networks or in any other way so that the networks can be made efficient use of. |
| (2) | The Government may provide financial and technical support, or otherwise as may be necessary, to any person who develops a system for sharing information under paragraph (1). |
| (3) | Matters necessary for the encouragement and support under paragraphs (1) and (2) shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 13 (Projects for Promoting Utilization of Information and Communications Networks) |
| (1) | The Minister of Science and ICT may implement projects designed to promote efficient utilization and dissemination of technology, equipment, and applied services related to information and communications networks, as prescribed by Presidential Decree, in order to promote the utilization of information and communications networks in various areas of public service, local communities, industry, life, and social welfare and to eliminate gaps in accessibility to information. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | The Government may provide financial and technical support, or otherwise as may be necessary, to persons who participate in the projects under paragraph (1). |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 14 (Proliferation of the Internet) |
The Government shall formulate and implement policies to induce the public and private sectors to use Internet facilities available in the public and private sectors so that the Internet can be widely used; to form the basis for facilitating using the Internet through education and public relations activities on the Internet; and to eliminate gaps in accessibility to the Internet between localities, genders, and ages.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 15 (Improvement of Quality of Internet Services) |
| (1) | The Minister of Science and ICT shall formulate and implement policies to protect rights and interests of users of Internet services and to ensure improvement of quality of Internet services and stable availability of Internet services. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | If deemed necessary for implementing the policies under paragraph (1), the Minister of Science and ICT may prescribe and give a public notice of the standards for measuring and assessing the quality of Internet services, hearing opinions of organizations of providers and users of information and communications services and others. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (3) | Every provider of information and communications services may voluntarily assess the current status of quality of his or her own Internet services in accordance with the standards under paragraph (2) and may notify the results thereof to users. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Articles 16 and 17 Deleted. <by Act No. 7142, Jan. 29, 2004> |
CHAPTER III (Articles 18 through 21) DELETED.
CHAPTER IV PROTECTION OF PERSONAL INFORMATION
SECTION 1 Collection, Use, and Provision of Personal Information
| Article 22 (Consent to Collection and Use of Personal Information) |
| (1) | Whenever a provider of information and communications services intends to collect personal information of a user with intent to use it, he or she shall notify the user of all of the following and shall obtain consent from the user. The same shall apply where he or she intends to change any of the following: |
| 1. | Purposes of collection and use of the personal information; |
| 2. | Items of personal information he or she intends to collect; |
| 3. | Period during which he or she intends to possess and use the personal information. |
| (2) | A provider of information and communications services may collect and use personal information of a user without consent under paragraph (1) in any of the following cases: |
| 1. | Where the personal information is necessary in fulfilling the contract for provision of information and communications services, but it is obviously impracticable to obtain consent generally due to any economic or technical reason; |
| 2. | Where it is necessary for charging fees for the information and communications services rendered; |
| 3. | Where this Act or any other statute provides otherwise. |
| (3) | In giving notice, etc. of matters related to the processing of personal information to a child under 14 years of age, a provider of information and communications services shall use readily understandable forms and plain and readily comprehensible language. <Newly Inserted by Act No. 16021, Dec. 24, 2018> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 22-2 (Consent to Access Authority) |
| (1) | Where a provider of information and communications services needs authority to access (hereinafter referred to as “access authority”) information stored and functions installed in mobile devices of users in order to provide the relevant services, the provider shall inform users of the following so that users may clearly recognize such matters, and shall obtain consent of users: |
| 1. | In the case of access authority certainly necessary to provide the relevant services: |
| (a) | Items of the information and functions for which access authority is necessary; |
| (b) | Grounds that access authority is necessary; |
| 2. | In the case of access authority not certainly necessary to provide the relevant services: |
| (a) | Items of the information and functions for which access authority is necessary; |
| (b) | Grounds that access authority is necessary; |
| (c) | Fact that users may give no consent to the permission for access authority. |
| (2) | No provider of information and communications services shall refuse to provide the relevant services to users on the ground that the users give no consent to the establishment of access authority not certainly necessary to provide the relevant services. |
| (3) | Persons manufacturing and providing a basic operating system (referring to an operating environment in which softwares installed in mobile devices can be run) of mobile devices, manufacturers of mobile devices, and persons manufacturing and providing a software for mobile devices shall take measures necessary for protecting users’ information, such as devising methods for users to give or revoke consent to access authority where the provider of information and communications services intends to access the information stored and functions installed in mobile devices. |
| (4) | The Korea Communications Commission may conduct compliance inspections to ascertain that access authority is set for relevant services in accordance with paragraphs (1) through (3). <Newly Inserted by Act No. 15628, Jun. 12, 2018> |
| (5) | The scope of, and methods for consenting to, access authority referred to in paragraph (1), the measures necessary for protecting users’ information referred to in paragraph (3), and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Newly Inserted by Act No. 14080, Mar. 22, 2016]
| Article 23 (Restrictions on Collection of Personal Information) |
| (1) | No provider of information and communications services may collect personal information regarding any person, such as the person’s ideology, beliefs, family relationship status, kinship and matrimonial relationship, educational background, and medical history, which is anticipated to otherwise infringe seriously upon any right, interest, or privacy of the person: Provided, That any provider may collect such personal information within the minimum scope necessary where he or she obtains consent of the user under Article 22 (1) or such personal information is specially permitted as personal information that may be collected pursuant to any other statute. <Amended by Act No. 12681, May 28, 2014> |
| (2) | Where a provider of information and communications services collects personal information of a user, he or she shall only collect personal information within the minimum scope necessary to provide information and communications services. <Amended by Act No. 12681, May 28, 2014> |
| (3) | No provider of information and communications services shall refuse to provide such services on the ground that a user does not provide personal information other than the minimum personal information required. In such cases, the minimum personal information required means information that is specifically required to perform essential functions of the relevant services. <Newly Inserted by Act No. 12681, May 28, 2014> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 23-2 (Restrictions on Use of Resident Registration Numbers) |
| (1) | Except in any of the following cases, no provider of information and communications services may collect or use users’ resident registration numbers: <Amended by Act No. 10560, Apr. 5, 2011> |
| 1. | Where the provider is designated as the identification service agency pursuant to Article 23-3; |
| 2. | Where the collection and use of users’ resident registration numbers is authorized by statutes or regulations; |
| 3. | Where the Korea Communications Commission provides a public notice for the provider of information and communications services who inevitably collects or uses users’ resident registration numbers for his or her business purposes. |
| (2) | Even where the collection and use of users’ resident registration numbers is authorized pursuant to paragraph (1) 2 or 3, an identification method without using the users’ resident registration numbers (hereinafter referred to as “alternative means”) shall be provided. |
[This Article Wholly Amended by Act No. 11322, Feb. 17, 2012]
| Article 23-3 (Designation of Identification Service Agencies) |
| (1) | The Korea Communications Commission may, after reviewing the following, designate a person as an identification service agency who is deemed competent to safely and reliably perform the affairs of development, provision, and administration of the alternative means (hereinafter referred to as “identification service”): |
| 1. | A plan for physical, technological, and administrative measures in order to secure safety of the identification service; |
| 2. | Technological and financial capability necessary for performing the identification service; |
| 3. | Appropriateness of the scale of facilities relevant to the identification service. |
| (2) | When an identification service agency intends to fully or partially suspend identification service, it shall determine and notify a suspension period to the users not later than 30 days prior to the intended date of suspension and shall report the same to the Korea Communications Commission. In this case, the suspension period shall not exceed six months. |
| (3) | When an identification service agency intends to discontinue the identification affairs, it shall notify the intention to the users not later than 60 days prior to the intended date of discontinuation and shall report the same to the Korea Communications Commission. |
| (4) | Matters necessary for the detailed review criteria for each item subject to the review and the designation procedures for identification service agency under paragraph (1), suspension or discontinuation of the identification affairs under paragraphs (2) and (3), and other matters shall be determined by Presidential Decree. |
[This Article Newly Inserted by Act No. 10560, Apr. 5, 2011]
| Article 23-4 (Suspension of Identification Services and Revocation of Designation of Identification Service Agencies) |
| (1) | When an identification service agency falls under any of the following, the Korea Communications Commission may determine the period of suspension within six months; and may order full or partial suspension of the identification services or revoke the designation of identification service agency: Provided, That in the case of subparagraph 1 or 2, the Korea Communications Commission shall revoke the designation of identification service agency: |
| 1. | Where an identification service agency is designated by fraud or other improper means; |
| 2. | Where a person who has received the order for suspension of identification service fails to suspend the affairs in violation of the order; |
| 3. | Where a person fails to start identification services within six months from the date of designation, or has suspended the services for at least six consecutive months; |
| 4. | Where it becomes not suitable for the standard for designation pursuant to Article 23-3 (4). |
| (2) | The standards and procedures for any disposition under paragraph (1) and other necessary matters shall be determined by Presidential Decree. |
[This Article Newly Inserted by Act No. 10560, Apr. 5, 2011]
| Article 24 (Restrictions on Use of Personal Information) |
No provider of information and communications services may use personal information collected in accordance with Article 22 and the proviso to Article 23 (1) for any purpose other than the purpose consented by the relevant user or the purpose specified in the subparagraphs of Article 22 (2). [This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 24-2 (Consent to Provision of Personal Information) |
| (1) | Whenever a provider of information and communications services intends to furnish a third party with personal information of a user, he or she shall notify the user of all the following and shall obtain consent of the user, except as provided for in Article 22 (2) 2 and 3. The same shall apply where there is a change in any of the following: |
| 1. | The person to whom the personal information is furnished; |
| 2. | Purposes of use of the personal information of the person to whom the personal information is furnished; |
| 3. | Items of the personal information furnished; |
| 4. | Period during which the person to whom the personal information is furnished will possess and use the personal information. |
| (2) | A person who received any personal information of a user from a provider of information and communications services in accordance with paragraph (1) shall neither furnish the personal information to a third party nor use it for any purpose other than the purpose originally agreed upon at the time when the information was furnished, without consent of the user or except as otherwise provided for in other statutes. |
| (3) | When a provider of information and communications services or similar under Article 25 (1) are to obtain the consent to furnishing the information of a user under paragraph (1) and to the entrustment of management of personal information under Article 25 (1); he or she shall obtain such consent apart from the consent to collection and use of personal information pursuant to Article 22, and shall not refuse to provide its service on the ground that a user gives no such consent. <Newly Inserted by Act No. 10560, Apr. 5, 2011; Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 25 (Entrustment of Management of Personal Information) |
| (1) | A provider of information and communications services or a person who received personal information of users from the provider of information and communications services in accordance with Article 24-2 (1) (hereinafter referred to as "provider of information and communications services or similar") shall, if he or she intends to entrust a third party with handling of business affairs related to personal information (hereinafter referred to as "entrustment of management of personal information") so as to collect, create, connect, link, record, save, hold, process, edit, search, print, correct, recover, use, provide, disclose, destruct, or treat similarly users’ personal information (hereinafter referred to as "management"), notify the users of all the following and shall obtain consent of the users. The same shall apply where there exists a change in any of the following: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Any person to whom the management of personal information is entrusted (hereinafter referred to as "trustee"); |
| 2. | Details of the business affairs subject to the entrustment of management of personal information. |
| (2) | A provider of information and communications services or similar need not follow the procedures for notification and consent under paragraph (1) for entrusting the management of personal information, where the personal information is required to comply with the contract on the provision of the information and communications services and to enhance convenience of users and where all the matters prescribed in the subparagraphs of paragraph (1) have been disclosed to the public under Article 27-2 (1) or notified to users in a manner prescribed by Presidential Decree, such as by e-mail. The same shall apply where there exists a change in a matter prescribed in any subparagraph of paragraph (1). <Amended by Act No. 12681, May 28, 2014; Act No. 14080, Mar. 22, 2016> |
| (3) | When a provider of information and communications services or similar entrusts the management of personal information to a third party, he or she shall define the scope of purposes, in advance, within which the trustee is allowed to manage personal information of users, and the trustee shall not manage the personal information of users beyond the scope of purposes. <Amended by Act No. 14080, Mar. 22, 2016> |
| (4) | A provider of information and communications services or similar shall control, supervise, and educate the trustee to ensure that the trustee does not violate any provision of this Chapter. <Amended by Act No. 14080, Mar. 22, 2016> |
| (5) | If a trustee violates any provision of this Chapter in connection with the business affairs related to the entrustment of management of personal information and inflicts damages upon a user, the trustee shall be deemed an employee of the provider of information and communications services or similar in determining liability for such damages. <Amended by Act No. 14080, Mar. 22, 2016> |
| (6) | When entrusting a trustee with the management of personal information, a provider of information and communications services or similar shall do so in writing. <Newly Inserted by Act No. 14080, Mar. 22, 2016> |
| (7) | A trustee may re-entrust a third party with affairs entrusted pursuant to paragraph (1), only where the trustee obtains consent from the provider of information and communications services or similar. <Newly Inserted by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 26 (Transfer of Personal Information Following Transfer of Business) |
| (1) | Where a provider of information and communications services or similar fully or partially transfers personal information of users to a third party due to transfer of business, merger, or any similar cause, he or she shall notify the users of all the following by publishing them on the relevant website, by sending e-mail or by other means prescribed by Presidential Decree: |
| 1. | The fact that the personal information is to be transferred; |
| 2. | The name (referring to the name of a corporation, if the person is a corporation; hereafter the same shall apply in this Article), address, and telephone number of a person to whom the personal information is to be transferred (hereinafter referred to as "transferee of business or similar"), and other contact information of the person; |
| 3. | The methods and procedures available for revocation of consent, where a user does not want his or her personal information transferred to a third party. |
| (2) | If any personal information is transferred to a transferee of business or similar, such transferee shall without delay notify the users of such fact and his or her name, domicile, telephone number, and other contact information by publishing them on the relevant website, by sending e-mail or by other means prescribed by Presidential Decree. <Amended by Act No. 12681, May 28, 2014> |
| (3) | A transferee of business or similar may use or furnish personal information only within the scope of purposes originally defined for which the relevant provider of information and communications services or similar uses or furnishes the personal information of users: Provided, That the same shall not apply where he or she obtains consent from users otherwise. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 26-2 (Method Applicable in Obtaining Consent) |
The method applicable in obtaining the consent under Article 22 (1), the proviso to Article 23 (1), Article 24-2 (1) or (2), Article 25 (1), the proviso to Article 26 (3), or Article 63 (2) (hereinafter referred to as "consent to collection, use, provision, and similar disposition of personal information") shall be prescribed by Presidential Decree, considering media for collection of personal information, peculiarities of each type of business, number of users, and other related factors. [This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
SECTION 2 MANAGEMENT AND DESTRUCTION OF PERSONAL INFORMATION
| Article 27 (Designation of Persons Responsible for Management of Personal Information) |
| (1) | Every provider of information and communications services or similar shall designate a person responsible for protection of personal information, to protect the personal information of users and to process complaints from users in connection with the personal information: Provided, That a provider of information and communications services or similar need not designate such person, if the provider of information and communications services or similar falls under the criteria prescribed by Presidential Decree for the number of employees, number of users, and other related matters. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | If a provider of information and communications services or similar does not designate a person responsible for protection of personal information under the proviso to paragraph (1), the business owner or representative of such provider shall be the person responsible for protection of personal information. <Amended by Act No. 14080, Mar. 22, 2016> |
| (3) | The qualification requirements for a person responsible for protection of personal information and other matters necessary for designation of such person shall be prescribed by Presidential Decree. <Amended by Act No. 14080, Mar. 22, 2016> |
| (4) | Where a person responsible for protection of personal information becomes aware of a fact of violation of this Act or other relevant statute or regulation, he or she shall take measures for improvement immediately, and if necessary, shall report the measures for improvement to the business owner or representative of the provider of information and communications services or similar: Provided, That the provisions regarding reporting of measures for improvement shall not apply where the business owner or representative is the person responsible for protection of personal information pursuant to paragraph (2). <Newly Inserted by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 27-2 (Public Disclosure of Policy on Managing Personal Information) |
| (1) | When managing personal information of users, every provider of information and communications services or similar shall establish and disclose its policy on managing personal information to the public in a manner prescribed by Presidential Decree so that users become aware of the policy easily at any time. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | The policy on managing personal information under paragraph (1) shall include all of the following: <Amended by Act No. 11322, Feb. 17, 2012; Act No. 14080, Mar. 22, 2016> |
| 1. | Purposes of collection and use of personal information, items of personal information collected, and methods of collection; |
| 2. | The name of the person (referring to the name of a corporation, if the person is a corporation) to whom personal information is furnished, if the personal information is furnished to a third party, and purposes of use of the person to whom the personal information is furnished, along with items of the personal information furnished; |
| 3. | Period during which the personal information is possessed and used, and the procedures and methods for destroying the personal information (including the ground for preservation and items of preserved personal information, if it is required to preserve the personal information pursuant to the proviso to Article 29 (1), with the exception of its subparagraphs); |
| 4. | Details of business affairs subject to the entrustment of management of personal information and the trustee (they shall be included in the policy on management, only where this subparagraph is applicable); |
| 5. | Rights of users and their legal representatives and methods for exercising such rights; |
| 6. | Matters regarding installation, operation, and denial of a device that collects personal information automatically, such as an information file for access to the Internet; |
| 7. | The name and address of the person responsible for protection of personal information or the department responsible for business affairs related to the protection of personal information and processing related complaints and other contact information of such person or department. |
| (3) | When revising the policy on managing personal information under paragraph (1), every provider of information and communications services or similar shall give public notice of the reasons for and details of such revision without delay in a manner prescribed by Presidential Decree and shall take measures to make users aware of the details of the revision easily at any time. <Amended by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 27-3 (Notification or Reports on Leakage of Personal Information) |
| (1) | When a provider of information and communications services or similar becomes aware of the loss, theft, or leakage of personal information (hereinafter referred to as “leakages, etc.”), he or she shall without delay inform the relevant users of all the following and report to the Korea Communications Commission or the Korea Internet and Security Agency, and shall not notify or report them after 24 hours have elapsed since he or she became aware of such fact, without any justifiable cause: Provided, That other measures in lieu of the aforementioned notification may be taken as prescribed by Presidential Decree where users’ contact information is unknown or other good cause exists: <Amended by Act No. 12681, May 28, 2014; Act No. 14080, Mar. 22, 2016> |
| 1. | Each item of the personal information leaked; |
| 2. | Point of time the personal information is leaked; |
| 3. | Measures available for users to take; |
| 4. | Countermeasures to be taken by a provider of information and communications services or similar; |
| 5. | Responsible departments and contact information to be used for the users who seek consultations, etc., to submit their application for such consultations. |
| (2) | Upon receiving a report under paragraph (1), the Korea Internet and Security Agency shall without delay inform the Korea Communications Commission of such fact. <Newly Inserted by Act No. 12681, May 28, 2014> |
| (3) | A provider of information and communications services or similar shall explain just cause under the main sentence of and proviso to paragraph (1) to the Korea Communications Commission. <Newly Inserted by Act No. 12681, May 28, 2014> |
| (4) | Matters necessary for the methods, procedures, etc., for the notification and report under paragraph (1) shall be prescribed by Presidential Decree. |
| (5) | A provider of information and communications services or similar shall prepare countermeasures against the leakages, etc. of personal information, and shall seek measures to minimize any damage thereof. <Amended by Act No. 14080, Mar. 22, 2016> |
[This Article Newly Inserted by Act No. 11322, Feb. 17, 2012]
| Article 28 (Protective Measures for Personal Information) |
| (1) | When managing personal information of users, every provider of information and communications services or similar shall take the following technical and administrative measures in accordance with the guidelines prescribed by Presidential Decree to prevent loss, theft, leakage, forgery, or alteration of or damage to personal information and to secure the safety of personal information: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Establishment and implementation of an internal control plan for managing personal information in a safe way; |
| 2. | Installation and operation of an access control device, such as an intrusion prevention system to block illegal access to personal information; |
| 3. | Measures for preventing fabrication and alteration of access records; |
| 4. | Measures for security by using encryption technology and other methods for safe storage and transmission of personal information; |
| 5. | Measures for preventing breach by computer viruses, including installation and operation of vaccine software; |
| 6. | Other protective measures necessary for securing safety of personal information. |
| (2) | Every provider of information and communications services or similar shall limit the number of personnel processing users' personal information to the minimum extent. <Amended by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 28-2 (Prohibition on Disclosure of Personal Information) |
| (1) | A person who manages or has ever managed personal information of users shall not damage, intrude on, or disclose personal information that he or she learned in the course of performing his or her duty. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | No one shall be knowingly provided with any disclosed personal information for profit or any unlawful purpose. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 29 (Destruction of Personal Information) |
| (1) | In any of the following cases, a provider of information and communications services or similar shall destroy the relevant personal information without delay so that such personal information cannot be recovered or reproduced: Provided, That the same shall not apply where it is required to preserve the personal information in accordance with any other statute: <Amended by Act No. 11322, Feb. 17, 2012; Act No. 12681, May 28, 2014> |
| 1. | When the purpose of collection and use of personal information with consent obtained in accordance with Article 22 (1), the proviso to Article 23 (1), or Article 24-2 (1) or (2) or the purpose under the subparagraphs of Article 22 (2) has been achieved; |
| 2. | When a period during which it is allowed to possess and use personal information with consent obtained in accordance with Article 22 (1), the proviso to Article 23 (1), or Article 24-2 (1) or (2) ends; |
| 3. | When a period during which it is allowed to possess and use personal information in accordance with Article 27-2 (2) 3 ends, if the personal information has been collected and used without consent of users under Article 22 (2); |
| 4. | When the business is permanently closed down. |
| (2) | In an effort to protect personal information of the users who do not use information and communications services for a period of one year, a provider of information and communications services or similar shall take necessary measures, such as destruction of personal information, as prescribed by Presidential Decree: Provided, That where the period is otherwise provided either in accordance with other statue or regulation or at the request of the users, such provisions shall apply. <Newly Inserted by Act No. 11322, Feb. 17, 2012; Act No. 13520, Dec. 1, 2015> |
| (3) | A provider of information and communications services or similar shall notify, until 30 days before expiration of the period under paragraph (2), the users of the matters prescribed by Presidential Decree, such as the fact that the personal information will be destroyed, the expiration date of the period, and items of personal information subject to destruction, in a manner prescribed by Presidential Decree such as by e-mail. <Newly Inserted by Act No. 13520, Dec. 1, 2015> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 29-2 (Facilitating and Supporting Protection of Personal Information) |
| (1) | The Korea Communications Commission shall formulate the following policies in order to facilitate and support voluntary activities of providers of information and communications services or similar for protecting personal information: |
| 1. | Conducting education and promotion for protecting personal information; |
| 2. | Providing assistance in formulating and enforcing self-regulating rules for protecting personal information; |
| 3. | Fostering and supporting institutions and organizations related to protecting personal information; |
| 4. | Other matters necessary to provide assistance in voluntary activities for protecting personal information. |
| (2) | Matters necessary for formulating policies, etc. under paragraph (1) shall be prescribed by Presidential Decree. |
[This Article Newly Inserted by Act No. 16021, Dec. 24, 2018]
SECTION 3 Rights of Users
| Article 30 (Rights of Users) |
| (1) | Every user may, at any time, revoke his or her consent given to a provider of information and communications services or similar to allow the provider to collect, use, or provide his or her personal information. |
| (2) | Every user may request a provider of information and communications services or similar to allow the user to peruse, or to furnish with any of the following and may also require the provider to correct an error, if there is any error: |
| 1. | Personal information of the user which the provider of information and communications services or similar possesses; |
| 2. | Details of which the provider of information and communications services or similar has used personal information of the user or furnished it to a third party; |
| 3. | Details of which the user has given a consent to the provider of information and communications services or similar to collect, use, or provide his or her personal information. |
| (3) | If a user withdraws his or her consent pursuant to paragraph (1), a provider of information and communications services or similar shall without delay take necessary measures, such as the destruction of collected personal information in an irrecoverable or unreproducible way. <Amended by Act No. 12681, May 28, 2014> |
| (4) | Upon receiving a request to peruse or furnish matters in accordance with paragraph (2), a provider of information and communications services or similar shall take necessary measures without delay. |
| (5) | Upon receiving a request for correction of an error in accordance with paragraph (2), a provider of information and communications services or similar shall correct the error, notify the user of the reasons why it is unable to correct the error, if it is the case, or take any other necessary measures and shall not use the relevant personal information or provide it to a third party until the provider completes taking such measures: Provided, That the provider may provide the personal information to a third party or use the information, if requested to provide the personal information pursuant to any other statute. |
| (6) | A provider of information and communications services or similar shall make how to revoke consent under paragraph (1), how to request to peruse personal information or provide such information under paragraph (2), and how to request correction of an error, easier than how to collect personal information. |
| (7) | Paragraphs (1) through (6) shall apply mutatis mutandis to a transferee of business or similar. In such cases, "provider of information and communications services or similar" shall be construed as "transferee of business or similar". |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 30-2 (Notification of Details of Use of Personal Information) |
| (1) | A provider of information and communications services or similar falling under the standards determined by Presidential Decree shall periodically notify the users of the details of using personal information of such users (including details of the provision under Article 24-2 and of the entrustment of management of personal information under Article 25) in accordance with Article 22 and the proviso to Article 23 (1): Provided, That this shall not apply where the provider of information and communications services or similar does not collect any contact information or other personal information that can be notified to users. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | Types of personal information to be notified to users, frequency and method for notifying the information pursuant to paragraph (1) and other matters necessary for notification of details of using such personal information shall be determined by Presidential Decree. |
[This Article Newly Inserted by Act No. 11322, Feb. 17, 2012]
| Article 31 (Rights of Legal Representatives) |
| (1) | In order to obtain consent of a child under 14 years of age to collection, use, provision, etc. of personal information, a provider of information and communications services or similar shall ascertain whether the legal representative of the child has consented thereto, as prescribed by Presidential Decree. In such cases, the provider of information and communications services may require the child to provide the name of the legal representative and other information to the minimum extent necessary to obtain consent of the legal representative or to ascertain whether the legal representative has consented. <Amended by Act No. 16021, Dec. 24, 2018> |
| (2) | A legal representative may exercise rights of a user under Article 30 (1) and (2) regarding the personal information of the relevant child. |
| (3) | Article 30 (3) through (5) shall apply to a legal representative’s revocation of consent under paragraph (2) and his or her demand for perusal or correction of an error. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 32 (Compensation) |
| (1) | Where a user suffers any damage caused by a violation of any provision of this Chapter by a provider of information and communications services or similar, the user may claim compensation for damage against the said provider of information and communications services or similar. In this cases, the relevant provider of information and communications services or similar cannot be exempt from liability unless he or she proves that there is no intention or gross negligence on the part of the said provider. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | Where any damage occurs to a user because personal information has been lost, stolen, leaked, forged, altered, or damaged due to intention or gross negligence on the part of a provider of information and communications services or similar, a court may determine the amount of compensation to the extent not exceeding three times the said damage: Provided, That this shall not apply where the provider of information and communications services or similar proves that there is no intention or gross negligence on the part of the said provider. <Newly Inserted by Act No. 14080, Mar. 22, 2016> |
| (3) | Where a court determines the amount of compensation referred to in paragraph (2), it shall take the following into account: <Newly Inserted by Act No. 14080, Mar. 22, 2016> |
| 1. | Degree of intent or awareness of the likelihood of damage; |
| 2. | Scale of the damage caused by the relevant violation; |
| 3. | Economic benefits acquired by the provider of information and communications services or similar by committing the relevant violation; |
| 4. | Fines and penalty surcharges for violations; |
| 5. | Period, number, etc. of violations; |
| 6. | Status of the assets of the provider of information and communications services or similar; |
| 7. | Degree of efforts of the provider of information and communications services or similar to withdraw the relevant personal information after the user’s personal information has been lost, stolen, or leaked; |
| 8. | Degree of efforts of the provider of information and communications services or similar to remedy damage to the user. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 32-2 (Claim for Statutory Damages) |
| (1) | Where a user falls under each of the following, he or she may claim resonable compensation not exceeding three million won as damages, in lieu of claiming damages under Article 32 from a provider of information and communications services or similar within a period prescribed by Presidential Decree. In such cases, the relevant provider of information and communications services or similar cannot be exempt from liability unless he or she proves that there is no intention or negligence on the part of the said provider: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Where the provider of information and communications services or similar violates the provisions of this Chapter by intention or negligence; |
| 2. | Where personal information is lost, stolen, leaked, forged, altered, or damaged. |
| (2) | Where a claim for compensation under paragraph (1) is filed, a court may acknowledge a reasonable amount of loss within the limits prescribed in paragraph (1), taking into account the relevance of all pleadings and the outcomes of examination of evidence. |
| (3) | A user claiming compensation for damage pursuant to Article 32 may change such claim to the claim referred to in paragraph (1) before the argument of the inquisition is closed. <Newly Inserted by Act No. 14080, Mar. 22, 2016> |
[This Article Newly Inserted by Act No. 12681, May 28, 2014]
| Article 32-3 (Indemnity for Losses) |
| (1) | In order to fulfill liability for losses under Articles 32 and 32-2, each provider of information and communications services or similar shall take necessary measures such as taking out insurance, joining a mutual aid organization, or setting aside reserves. |
| (2) | The scope of, and the criteria for, business entities required to take out insurance or join a mutual aid organization under paragraph (1) and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Newly Inserted by Act No. 15628, Jun. 12, 2018]
| Article 32-4 (Deletion and Blocking of Exposed Personal Information) |
| (1) | A provider of information and communications services or similar shall ensure that users’ personal information, such as resident registration numbers, account numbers, and credit cards information, is not exposed to the public through information and communications networks. |
| (2) | Upon request by the Korea Communications Commission or the Korea Internet and Security Agency, a provider of information and communications services or similar shall take necessary measures, such as deleting and blocking exposed personal information referred to in paragraph (1). |
[This Article Newly Inserted by Act No. 14080, Mar. 22, 2016]
| Article 32-5 (Designation of Domestic Agents) |
| (1) | A person who meets the criteria prescribed by Presidential Decree, based upon considerations such as the number of users and sales, from among providers of information and communications services or similar with no domicile or place of business in the Republic of Korea, shall designate, in writing, an agent to act on his or her behalf with respect to the following (hereinafter referred to as "domestic agent"): |
| 1. | Duties of a person responsible for management of personal information under Article 27; |
| 3. | Submission of related articles, documents, etc. under Article 64 (1). |
| (2) | A domestic agent shall be a person who has a domicile or place of business in the Republic of Korea. |
| (3) | In designating a domestic agent pursuant to paragraph (1), all the following matters shall be included in the policy on managing personal information under Article 27-2: |
| 1. | The domestic agent's name (if the domestic agent is a corporation, referring to the name of the corporation and the name of its representative); |
| 2. | The domestic agent's domicile (if the domestic agent is a corporation, referring to the address of its place of business), and his or her telephone number and electronic mail address. |
| (4) | If a domestic agent violates this Act in relation to the subparagraphs of paragraph (1), such violation shall be deemed to have been committed by the relevant provider of information and communications services or similar. |
[This Article Newly Inserted by Act No. 15751, Sep. 18, 2018]
SECTION 4 (Articles 33 through 40) Deleted.
CHAPTER V PROTECTION OF USERS IN INFORMATION AND COMMUNICATIONS NETWORKS
| Article 41 (Preparation of Policy on Protection of Youths) |
| (1) | The Korea Communications Commission shall prepare a policy on the following measures to protect youths from information harmful to youth, such as information of obscenities and violence, circulated through information and communications networks (hereinafter referred to as "information harmful to youth"): |
| 1. | Development and dissemination of content-screening software; |
| 2. | Development and dissemination of technology for protection of youths; |
| 3. | Education and public relations activities for protection of youths; |
| 4. | Other matters prescribed by Presidential Decree for protection of youths. |
| (2) | The Korea Communications Commission may, in an effort to implement the policy under paragraph (1), support activities conducted by the Korea Communications Standards Commission under Article 18 of the Act on the Establishment and Operation of Korea Communications Commission (hereinafter referred to as the "Communications Standards Commission"), organizations of providers or users of information and communications services, and other relevant specialized institutions for protection of youths. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 42 (Labeling of Media Products Harmful to Youths) |
A person who provides information to the general public purposely to make it public through telecommunications services rendered by a telecommunications business entity (hereinafter referred to as "information provider") and who intends to provide any media product harmful to youths defined in subparagraph 3 of Article 2 of the Youth Protection Act among the media referred to in subparagraph 2 (e) of Article 2 of the aforesaid Act, shall put a label indicating that the information is a media product harmful to youths by the labeling method prescribed by Presidential Decree. <Amended by Act No. 11048, Sep. 15, 2011> [This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 42-2 (Prohibition on Advertisement of Media Products Harmful to Youths) |
No one may transmit, to a youth defined in subparagraph 1 of Article 2 of the Youth Protection Act, any information containing an advertisement of a media product harmful to youths defined in subparagraph 3 of Article 2 of the aforesaid Act among the media referred to in subparagraph 2 (e) of Article 2 of the aforesaid Act in the form of code, letter, voice, sound, image, or motion picture through an information and communications network or display such medium to the general public without taking any measure to restrict access by a youth. <Amended by Act No. 11048, Sep. 15, 2011> [This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 42-3 (Designation of Persons Responsible for Protection of Youths) |
| (1) | A provider of information and communications services whose the average number of users per day, sales, and other related factors fall under the criteria prescribed by Presidential Decree shall designate a person responsible for protection of youths to keep youths from information harmful to youths in the information and communication network. |
| (2) | The person responsible for protection of youths shall be chosen from among executive officers of the relevant business entity or the persons in a position equivalent to the head of a department responsible for business affairs related to protection of youths. |
| (3) | The person responsible for protection of youths shall block and control information harmful to youths in the information and communications network and shall perform business affairs for protection of youths, including establishment of a plan for protection of youths from information harmful to youths. |
| (4) | Matters necessary for designating a person responsible for protection of youths under paragraph (1) shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 43 (Duty of Providers of Visual or Sound Information to Keep Information) |
| (1) | An information provider prescribed by Presidential Decree from among those who engage in business providing media products harmful to youths defined in subparagraph 3 of Article 2 of the Youth Protection Act among the media products referred to in subparagraph 2 (e) of Article 2 of the aforesaid Act in a way to make it impossible to save or record the harmful media products in a user's computer shall keep relevant information. <Amended by Act No. 11048, Sep. 15, 2011> |
| (2) | The period during which an information provider under paragraph (1) is obligated to keep relevant information shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44 (Protection of Rights in Information and Communications Networks) |
| (1) | No user may circulate any information violative of other person's rights, including invasion of privacy and defamation, through an information and communications network. |
| (2) | Every provider of information and communications services shall make efforts to prevent any information under paragraph (1) from being circulated through the information and communications network operated and managed by the provider. |
| (3) | The Korea Communications Commission may prepare a policy on technological development, education, public relations activities, and other activities to prevent violation of other persons' rights by information circulated through information and communications networks, including invasion of privacy and defamation and may recommend providers of information and communications services to adopt the policy. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12681, May 28, 2014> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-2 (Request for Deletion of Information) |
| (1) | Where information provided through an information and communications network purposely to be made public intrudes on other persons' privacy, defames other persons, or violates other persons' right otherwise, the victim of such violation may request the provider of information and communications services who managed the information to delete the information or publish a rebuttable statement (hereinafter referred to as "deletion or rebuttal"), presenting explanatory materials supporting the alleged violation. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | Upon receiving a request for deletion or rebuttal of the information under paragraph (1), a provider of information and communications services shall delete the information or take a temporary or any other necessary measure and shall notify the applicant and the publisher of the information immediately. In such cases, the provider of information and communications services shall make it known to users that he or she has taken necessary measures by posting a public notification on the relevant message board or in any other way. |
| (3) | If there is any media product harmful to youths published in violation of the labeling method under Article 42 in the information and communications network operated and managed by a provider of information and communications services or if a content advertising any media product harmful to youths is displayed in such network without any measures to restrict access by youths under Article 42-2, the provider shall delete such content without delay. |
| (4) | Notwithstanding a request for deletion of the information under paragraph (1), if it is impracticable to judge whether information violates any right or it is anticipated that there will probably be a dispute between interested parties, a provider of information and communications services may take a measure to block access to the information temporarily (hereinafter referred to as "temporary measures"). In such cases, the period for the temporary measure shall not exceed 30 days. |
| (5) | Every provider of information and communications services shall clearly state in advance the details, procedures, and other matters regarding necessary measures in the terms and conditions. |
| (6) | If a provider of information and communications services takes necessary measures under paragraph (2) for the information circulated through the information and communications network operated and managed by himself or herself, the provider may have his or her liability to indemnify loss incurred by such information mitigated or discharged. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-3 (Discretionary Temporary Measures) |
| (1) | If a provider of information and communications services finds that information circulated through the information and communications network which he or she operates and manages, intrudes on someone's privacy, defames someone, or violates someone's rights, the provider may take temporary measures at his or her discretion. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-4 (Self Regulation) |
| (1) | An organization of providers of information and communications services may establish and implement a code of conduct applicable to providers of information and communications services with an objective to protect users and render information and communications services more safely and reliably. |
| (2) | An organization of providers of information and communications services may establish and enforce self-regulating guidelines for monitoring, etc. so as to prevent any of the following information from being circulated in information and communications networks: <Newly Inserted by Act No. 16021, Dec. 24, 2018> |
| 1. | Information harmful to youth; |
| (3) | The Government may support self-regulating activities by organizations of providers of information and communications services under paragraphs (1) and (2). <Newly Inserted by Act No. 16021, Dec. 24, 2018> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-5 (Identity Verification of Users of Message Boards) |
| (1) | If any of the following persons intends to install and operate a message board, he or she shall take necessary measures, as prescribed by Presidential Decree (hereinafter referred to as "measures for identity verification"), including preparation of methods and procedures for verifying identity of users of the message board: |
| 2. | Deleted. <by Act No. 12681, May 28, 2014> |
| (2) | Deleted.<by Act No. 12681, May 28, 2014> |
| (3) | The Government shall prepare a policy to develop a safer and more reliable system to verify identity of users under paragraph (1). |
| (4) | A public institution, etc. may have its liability for damages caused by fraudulent use of a user's identity by a third party mitigated or discharged, if it has taken the measures for identity verification under paragraph (1) with care as a good manager. <Amended by Act No. 12681, May 28, 2014> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
[Paragraph (1) 2 of this Article was deleted by Act No. 12681, promulgated on May 28, 2014, pursuant to the decision of unconstitutionality by the Constitutional Court made on August 23, 2012.]
| Article 44-6 (Claim to Furnish User's Information) |
| (1) | A person who alleges that information published or circulated by a specific user has intruded on his or her privacy, defamed him or her, or violated his or her rights, may file a claim with the defamation dispute conciliation division under Article 44-10 to demand the relevant provider of information and communications services to furnish the information he or she possesses about the alleged offender (referring to the minimum information prescribed by Presidential Decree, including the name and address, necessary for filing a civil or criminal complaint), along with materials supporting his or her allegation of the violation, in order to file a civil or criminal complaint against the alleged offender. |
| (2) | Upon receiving a claim under paragraph (1), the defamation dispute conciliation division shall make a decision on whether to furnish information, hearing the opinion of the relevant user, unless it is impossible to contact the relevant user or there is any particular reason otherwise. |
| (3) | A person who receives information about the relevant user under paragraph (1) shall not use the information for any purpose other than the purpose of filing a civil or criminal complaint. |
| (4) | Other matters necessary for the contents of a claim to furnish information of a user and the procedures therefor shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-7 (Prohibition on Circulation of Unlawful Information) |
| (1) | No one may circulate any of the following information through an information and communications network: <Amended by Act No. 11048, Sep. 15, 2011; Act No. 14080, Mar. 22, 2016; Act No. 15628, Jun. 12, 2018> |
| 1. | Information with obscene content distributed, sold, rented, or displayed openly in the form of code, words, sound, images, or motion picture; |
| 2. | Information with content that defames other persons by divulging a fact or false information, openly and with intent to disparage the person's reputation; |
| 3. | Information with content that arouses fear or apprehension by reaching other persons repeatedly in the form of code, words, sound, image, or motion picture; |
| 4. | Information with content that compromises, destroys, alters, or forges an information and communications system, data, a program, or similar or that interferes with the operation of such system, data, program, or similar without a justifiable ground; |
| 5. | Information with content that amounts to a media product harmful to youths under the Youth Protection Act and that is provided for profit without fulfilling the duties and obligations under the relevant statutes and regulations, including the duty to verify the subject's age and the duty of labeling; |
| 6. | Information with content that amounts to speculative activities prohibited by statutes and regulations; |
| 6-2. | Information regarding content of transactions of personal information in violation of this Act or other statutes and regulations regarding the protection of personal information; |
| 6-3. | Information regarding methods or drawings, etc. for manufacturing firearms or explosives (including things with a yield that may expose people to risk of life or bodily injury); |
| 7. | Information with content that divulges a secret classified under statutes and regulations or any other State secret; |
| 9. | Other information with content that attempts to commit, aids, or abets a crime. |
| (2) | The Korea Communications Commission may order a provider of information and communications services or a manager or an operator of a message board to reject, suspend, or restrictly manage information under subparagraphs 1 through 6, 6-2 and 6-3 of paragraph (1), subject to deliberation by the Communications Standards Commission: Provided, That if the information falls under paragraph (1) 2 or 3, the Commission shall not issue an order to reject, suspend, or restrict such management against the intention specifically manifested by the victim of the relevant information. <Amended by Act No. 14080, Mar. 22, 2016; Act No. 15628, Jun. 12, 2018; Act No. 16021, Dec. 24, 2018> |
| (3) | The Korea Communications Commission shall order a provider of information and communications services or a manager or an operator of a message board to reject, suspend, or restrict management of information under paragraph (1) 7 through 9, if the information falls under all of the following: <Amended by Act No. 14080, Mar. 22, 2016; Act No. 16021, Dec. 24, 2018> |
| 1. | There was a request from the head of a related central administrative agency [including requests from the head of an investigative agency for photos or copies of such photos (including copies of such copies) under Article 14 of the Act on Special Cases concerning the Punishment of Sexual Crimes out of the information referred to in paragraph (1) 9]; |
| 3. | The provider of information and communications services or the manager or operator of the message board has not complied with the demand for correction. |
| (4) | The Korea Communications Commission shall provide an opportunity to the provider of information and communications services or the manager, operator, or relevant user of the message board to whom an order is to be issued pursuant to paragraph (2) or (3) to present his or her opinion in advance: Provided, That the Commission need not provide an opportunity to present an opinion in any of the following cases: |
| 1. | Where it is necessary to make an urgent disposition for public safety and welfare; |
| 2. | Where there is a ground prescribed by Presidential Decree to believe that it is obviously impracticable or evidently unnecessary to hear an opinion; |
| 3. | Where a person concerned clearly manifests his or her intent to give up the opportunity to present his or her opinion. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Articles 44-8 (Protection of Children in Interactive Information and Communications Services) |
When a provider of information and communications services provides children under 14 years of age with information and communications services based on a system that processes information by engaging in a conversation with a human user through text messages or voice chat, it shall endeavor not to provide information containing inappropriate content to such children.
[This Article Newly Inserted by Act No. 16021, Dec. 24, 2018]
| Article 44-9 Deleted. <by Act No. 8867, Feb. 29, 2008> |
| Article 44-10 (Defamation Dispute Conciliation Division) |
| (1) | The Communications Standards Commission shall have the defamation dispute conciliation division comprised of five members or less for efficient conciliation of disputes arising in connection with information that intrudes other persons' privacy, defames other persons, or violates other persons' rights, including a member or more holding the qualification of attorney-at-law. |
| (2) | The members of the defamation dispute conciliation division shall be commissioned by the chairperson of the Communications Standards Commission with consent of the Communications Standards Commission. |
| (3) | Articles 33-2 (2) and 35 through 39 shall apply mutatis mutandis to the procedures for conciliation of disputes by the defamation dispute conciliation division. In such cases, "Dispute Mediation Committee" shall be construed as "Communications Standards Commission," and "disputes over personal information" as "disputes arising in connection with information that intrudes privacy, defames other persons, or violates other persons' rights among information circulated through information and communications networks". |
| (4) | Matters necessary for the installation and operation of the defamation dispute conciliation division and the conciliation of disputes, and other related matters shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
CHAPTER VI SECURING OF STABILITY OF INFORMATION AND COMMUNICATIONS NETWORK
| Article 45 (Securing of Stability of Information and Communications Network) |
| (1) | Every provider of information and communications services shall take protective measures to secure the reliability of the information and security of the information and communications networks. |
| (2) | The Minister of Science and ICT may prescribe and provide a public notice of guidelines for protective measures for information (hereinafter referred to as "information protection guidelines"), specifying details of the protective measures under paragraph (1) and may recommend providers of information and communications services to observe the guidelines. <Amended by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (3) | The information protection guidelines shall contain descriptions of the following: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Technical and physical protective measures, including installation and operation of an information protection system, for a person with no due authorization to prevent or counteract access to invasion upon an information and communications network; |
| 2. | Technical protective measures for preventing unlawful leakage, forgery. alteration, or deletion of information; |
| 3. | Technical and physical protective measures for securing the state of enabling continuous use of information and communications networks; |
| 4. | Administrative protective measures for stabilization of information and communications networks and protection of information, including securing human resources, organization, and expenses and establishing related plans. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 45-2 (Preliminary Examination on Information Protection) |
| (1) | If a provider of information and communications services intends to newly establish an information and communications network or to provide information and communications services, he or she shall take the matters regarding information protection into account in planning or designing thereof. |
| (2) | The Minister of Science and ICT may recommend a person who intends to operate the information and communications services or the telecommunications business falling under any of the following to take protective measures in accordance with the preliminary examination standards as determined by Presidential Decree: <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| 1. | The information and communications services or telecommunications business determined by Presidential Decree, for which authorization or permission by the Minister of Science and ICT should be obtained or registration with or report to the Korea Communications Commission should be made pursuant to this Act or other statutes or regulations; |
| 2. | The information and communications services or telecommunications business determined by Presidential Decree and fully or partially financed by the Minister of Science and ICT for the business expenses thereof. |
| (3) | Standards, methods, procedures, fees for the preliminary examination on protection of information pursuant to paragraph (2) and other necessary matters shall be determined by Presidential Decree. |
[This Article Newly Inserted by Act No. 11322, Feb. 17, 2012]
| Article 45-3 (Designation of Chief Information Security Officers) |
| (1) | In order to ensure security of information and communications systems, etc. and safe management of information, a provider of information and communications services shall designate an executive-level chief information security officer and shall report the designation to the Minister of Science and ICT: Provided, That a provider of information and communications services whose total assets, sales, and the like meet the criteria prescribed by Presidential Decree need not designate a chief information security officer. <Amended by Act No. 12681, May 28, 2014; Act No. 14839. Jul. 26, 2017; Act No. 15628, Jun. 12, 2018> |
| (2) | Methods and procedures for reporting under paragraph (1) shall be prescribed by Presidential Decree. <Newly Inserted by Act No. 12681, May 28, 2014> |
| (3) | No chief information security officer designated and reported under the main sentence of paragraph (1) (limited to where a provider of information and communications services meets the criteria prescribed by Presidential Decree with respect to total assets, sales, and the like) may simultaneously hold another office, other than the one performing duties referred to in paragraph (4). <Newly Inserted by Act No. 15628, Jun. 12, 2018> |
| (4) | A chief information security officer shall be responsible for the following: |
| 1. | Establishment, administration, and operation of an administrative system for information protection; |
| 2. | Analysis, evaluation, and improvement of the weakness of information protection; |
| 3. | Prevention of and response to a computer security incident; |
| 4. | Preparation of preliminary measures for information protection and designing, realization, etc. of security measures; |
| 5. | Review of a preliminary security for information protection; |
| 6. | Review of the encryption of important information and the suitability of a security server; |
| 7. | Other matters, such as taking necessary measures for protection of information pursuant to this Act or other relevant statutes or regulations. |
| (5) | A provider of information and communications services may establish and operate an association of chief information security officers comprised of chief information security officers prescribed in paragraph (1) in order to jointly prevent and respond to a computer security incident, share necessary information, and implement other joint programs prescribed by Presidential Decree. |
| (6) | The Government may fully or partially provide financial support to the association of chief information security officers under paragraph (5) for expenses incurred in conducting its activities. <Amended by Act No. 13343, Jun. 22, 2015; Act No. 15628, Jun. 12, 2018> |
| (7) | Matters regarding qualifications of a chief information security officer, etc. shall be prescribed by Presidential Decree. <Newly Inserted by Act No. 15628, Jun. 12, 2018> |
[This Article Newly Inserted by Act No. 11322, Feb. 17, 2012]
| Article 46 (Protection of Clustered Information and Communications Facilities) |
| (1) | Every business entity who operates and manages clustered information and communications facilities to render information and communications services on behalf of another person (hereinafter referred to as "business entity of clustered information and communications facilities") shall take protective measures as prescribed by Presidential Decree to operate the information and communications facilities stably. |
| (2) | Every business entity of clustered information and communications facilities shall purchase insurance policies as prescribed by Presidential Decree to cover damages that may be caused by destruction or damage of the clustered information and communications facilities or any other trouble in operation. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 46-2 (Emergency Countermeasures of Business Entities of Clustered Information and Communications Facilities) |
| (1) | In any of the following cases, a business entity of clustered information and communications facilities may fully or partially suspend rendering relevant services, as stipulated in the terms and conditions: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| 1. | If it is anticipated that an abnormality found in the information system of a person who uses clustered information and communications facilities (hereinafter referred to as "user of facilities") will probably cause a serious trouble to the information system of other users of facilities or clustered information and communications facilities; |
| 2. | If it is anticipated that an external computer security incident will probably cause serious trouble to the clustered information and communications facilities; |
| 3. | If there occurs a serious computer security incident and the Minister of Science and ICT or the Korea Internet and Security Agency requests to suspend the services. |
| (2) | When a business entity of clustered information and communications facilities suspends his or her services in accordance with paragraph (1), he or she immediately notify users of facilities of the suspension of services, specifically stating the reasons for the suspension, the date, time, period, and details of the suspension, and other related matters. |
| (3) | Once the event that caused suspension of services terminates, a business entity of clustered information and communications facilities shall resume his or her services immediately. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 46-3 Deleted. <by Act No. 11322, Feb. 17, 2012> |
| Article 47 (Certification of Information Security Management Systems) |
| (1) | With respect to a person who establishes and operates a comprehensive management system, including administrative and technical protective measures, for ensuring stability and reliability of an information and communications network (hereinafter referred to as "information security management system"), the Minister of Science and ICT may certify as to whether such person meets the standards under paragraph (4). <Amended by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| (2) | A telecommunication business entity under subparagraph 8 of Article 2 of the Telecommunications Business Act, or any of the following persons who provides or intermediates the provision of information by using telecommunications services of any telecommunication business entity, shall receive the certification under paragraph (1): <Newly Inserted by Act No. 11322, Feb. 17, 2012; Act No. 13520, Dec. 1, 2015; Act No. 16019, Dec. 24, 2018> |
| 2. | A business entity of clustered information and communications facilities; |
| 3. | A person falling under the standards determined by Presidential Decree, whose annual sales, tax revenue, or any similar is at least 150 billion won, whose sales of the sector of information and communications services of the previous year is at least 10 billion won, or whose average number of daily users over the past three months is at least one million. |
| (3) | Where a person required to be certified in accordance with paragraph (2) is certified for conformity with international standards for information protection or takes measures for information protection, as prescribed by Ordinance of the Ministry of Science and ICT, the Minister of Science and ICT may omit part of certification examination under paragraph (1). In this case, the detailed scope of omitted certification examination shall be determined and publicly notified by the Minister of Science and ICT. <Newly Inserted by Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| (4) | For the purpose of certification of an information security management system under paragraph (1), the Minister of Science and ICT may determine and give a public notice of other necessary matters, such as certification criteria specifying countermeasures for managerial, technical, and physical protection. <Amended by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23. 2013; Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| (5) | The period of validity of the certification of an information security management system under paragraph (1) shall be three years: Provided, That upon receipt of any rating for information protection and management in accordance with Article 47-5 (1), the certification under paragraph (1) shall be deemed effective during the period of validity of such rating. <Newly Inserted by Act No. 11322, Feb. 17, 2012; Act No. 13520, Dec. 1, 2015> |
| (6) | The Minister of Science and ICT may have the Korea Internet and Security Agency or any institution (hereinafter referred to as “certification body for information security management systems”) designated by the Minister of Science and ICT perform the following affairs related to the certification under paragraphs (1) and (2): <Newly Inserted by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23. 2013; Act No. Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| 1. | Examination of verifying whether the information security management systems by established by an applicant for certification meets the standards for certification under paragraph (4) (hereinafter referred to as “examination of certification”); |
| 2. | Review on the results of examination of certification; |
| 3. | Issuance and management of written certifications; |
| 4. | Ex post facto management of granted certifications; |
| 5. | Fosterage and qualification management of the certification examiners of information security management systems; |
| 6. | Other affairs regarding the certification of information security management systems. |
| (7) | If necessary for the efficient conduct of affairs related to certification, the Minister of Science and ICT may designate an institution for performing affairs related to examination of certification (hereinafter referred to as “examination institution for information security management systems”). <Newly Inserted by Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| (8) | The Korea Internet Security Agency, a certification body for information security management systems, and an examination institution for information security management systems shall, in order to enhance the efficiency of information security management systems, perform ex post facto management at least once a year and notify the Minister of Science and ICT of the results thereof. <Newly Inserted by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23. 2013; Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| (9) | A person who has received certification of an information security management system in accordance with paragraphs (1) and (2) may indicate or publicize the content of the certification, as prescribed by Presidential Decree. <Amended by Act No. 11322, Feb. 17, 2012; Act No. 13520, Dec. 1, 2015> |
| (10) | The Minister of Science and ICT may revoke the certification where any of the following grounds is found: Provided, That in the case of subparagraph 1, the Minister of Science and ICT shall revoke the certification: <Newly Inserted by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23. 2013; Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| 1. | Having received the certification of an information security management system by fraud or other improper means; |
| 2. | Falling short of the standards for certification under paragraph (4); |
| 3. | Refusing or obstructing the ex post facto management under paragraph (8). |
| (11) | Methods and procedures for, and scope and fees of, certification under paragraphs (1) and (2), methods and procedures for ex post facto management under paragraph (8), methods and procedures for revoking certification under paragraph (10), and other necessary matters shall be prescribed by Presidential Decree. <Amended by Act No. 11322, Feb. 17, 2012; Act No. 13520, Dec. 1, 2015> |
| (12) | Standards and procedures for, and period of validity, the designation of a certification body for information security management systems, and an examination institution for information security management systems shall be prescribed by Presidential Decree. <Amended by Act No. 11322, Feb. 17, 2012; Act No. 13520, Dec. 1, 2015> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 47-2 (Revocation of Designation of Certification Body or Examination Institution for Information Security Management Systems) |
| (1) | If a corporation or organization designated as a certification body or an examination institution for information security management systems pursuant to Article 47 falls under any of the following cases, the Minister of Science and ICT may revoke the designation or order it to fully or partially suspend the relevant business for a prescribed period not exceeding one year: Provided, That in the case of subparagraph 1 or 2, the designation shall be revoked without an exception: <Amended by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| 1. | Where it has obtained the designation of a certification body or an examination institution for information security management systems by fraud or other improper means; |
| 2. | Where it has granted or examined certification during a business suspension period; |
| 3. | Where it has not performed certification or examination of certification without a justifiable ground; |
| 4. | Where it has performed certification or examination of certification, in violation of Article 47 (11); |
| 5. | Where it no longer meets the criteria for designation under Article 47 (12). |
| (2) | Matters necessary for the revocation of designation and suspension of business under paragraph (1) and other related matters shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 47-3 (Certification of Personal Information Management System) |
| (1) | With respect to a person who established and is operating a comprehensive management system including administrative, technical, and physical protective measures in order to systematically and continuously perform the activities for protection of personal information in the information and communications network (hereinafter referred to as “personal information management system”), the Korea Communications Commission may certify as to whether the management system meets the standards pursuant to paragraph (2). |
| (2) | For the certification of a personal information management system pursuant to paragraph (1), the Korea Communications Commission may determine and give a public notice of standards for the certification including administrative, technical, and physical protective measures and other necessary matters. |
| (3) | Article 47 (6) through (12) shall apply mutatis mutandis to an institution which implements a personal information management system and the follow-up management. In this case, the term “paragraphs (1) and (2)” shall be construed as “paragraph (1)”. <Amended by Act No. 13520, Dec. 1, 2015> |
| (4) | Article 47-2 shall apply mutatis mutandis to the revocation of designation, etc. of a certification body for personal information management systems. |
[This Article Newly Inserted by Act No. 11322, Feb. 17, 2012]
| Article 47-4 (Protection of User Information) |
| (1) | The Government may prescribe guidelines necessary for protection of information of users to recommend users to observe the guidelines and may take measures necessary for preventing computer security incidents and precluding spread thereof, such as inspection of vulnerabilities and technical support. |
| (2) | If a major provider of information and communications services foresees that a serious problem is likely to occur in the information system of a user who uses the services, the information and communications network, or similar provided by such provider because of an occurrence of a serious computer security incident on the information and communications network, the provider may request the user to take necessary protective measures as stipulated by the terms and conditions and may place a temporary restriction on access to the relevant information and communications network if the user does not perform as requested. |
| (3) | When a software business entity defined in Article 2 of the Software Industry Promotion Act has produced a program that can address security vulnerabilities, he or she shall notify the Korea Internet and Security Agency of such production and shall notify users of the software of the production at least twice within one month from the date of production. <Amended by Act No. 9637, Apr. 22, 2009> |
| (4) | Specific details that shall be stipulated by the terms and conditions with respect to the request for protective measures under paragraph (2) and other related matters shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 47-5 (Management Rating for Information Protection) |
| (1) | A person who has obtained the certification of an information security management system pursuant to Article 47 is entitled to receive the management rating for information protection from the Minister of Science and ICT in order to enhance the level of a corporate’s management of its comprehensive information protection and to secure users’ reliability on information protection services. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | The Minister of Science and ICT may authorize the Korea Internet and Security Agency to perform the affairs of rating under paragraph (1). <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (3) | A person who has obtained the management rating for information protection pursuant to paragraph (1) may indicate the obtained rating or advertise the details of such rating as prescribed by Presidential Decree. |
| (4) | Where the Minister of Science and ICT finds any of the following cases, he or she may revoke the aforementioned rating: Provided, That in the case of subparagraph 1, the Minister shall revoke the granted rating: <Amended by Act No. 11690, Mar. 23, 2013; Act No. 13520, Dec. 1, 2015; Act No. 14839. Jul. 26, 2017> |
| 1. | Where a person has obtained the management rating for information protection, by fraud or other improper means; |
| 2. | Where a person falls short of the standards for rating pursuant to paragraph (5). |
| (5) | Standards for review in assigning the rating pursuant to paragraph (1); the methods and procedures for and fees of assigning the rating; the effective term of rating; the methods and procedures for revocation of rating pursuant to paragraph (4); and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Newly Inserted by Act No. 11322, Feb. 17, 2012]
| Article 48 (Prohibition on Intrusive Acts on Information and Communications Networks) |
| (1) | No one shall intrude on an information and communications network without a rightful authority for access or beyond a permitted authority for access. |
| (2) | No one shall mutilate, destroy, alter, or forge an information and communications system, data, program, or similar without a justifiable ground, nor shall he or she convey or spread a program that is likely to interrupt operation of such system, data, program, or similar (hereinafter referred to as "malicious program"). |
| (3) | No one shall cause a trouble to an information and communications network to interfere with stable operation of the information and communications network by sending a large amount of signals or data, letting the network process an illegitimate order, or doing the similar actions. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 48-2 (Countermeasures against Computer Security Incidents) |
| (1) | The Minister of Science and ICT shall perform the following business affairs to take proper countermeasures against computer security incidents and may have the Korea Internet and Security Agency fully or partially perform the business affairs, if necessary to do so: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| 1. | Collection and spread of information about computer security incidents; |
| 2. | Precaution and warning of computer security incidents; |
| 3. | Emergency measures against computer security incidents; |
| 4. | Other countermeasures against computer security incidents prescribed by Presidential Decree. |
| (2) | Any of the following persons shall furnish the Minister of Science and ICT or the Korea Internet and Security Agency with the information related to computer security incidents, including statistics by type of computer security incidents, statistics of traffic of the relevant information and communications network, and statistics of use by access channel, as prescribed by Presidential Decree: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| 1. | A major provider of information and communications services; |
| 2. | A business entity of clustered information and communications facilities; |
| 3. | Other persons prescribed by Presidential Decree from among those who operate an information and communications network. |
| (3) | The Korea Internet and Security Agency shall analyze the information under paragraph (2) and report it to the Minister of Science and ICT. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017; Act No. 14839. Jul. 26, 2017> |
| (4) | If a business entity obligated to furnish the information in accordance with paragraph (2) refuses to do so without a justifiable ground or furnishes false information, the Minister of Science and ICT may order the business entity to make a correction within a reasonable period prescribed by the Commission. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (5) | The Minister of Science and ICT or the Korea Internet and Security Agency shall use the information furnished in accordance with paragraph (2) properly within the extent necessary for taking countermeasures against a computer security incident. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (6) | If necessary to take countermeasures against a computer security incident, the Minister of Science and ICT or the Korea Internet and Security Agency may request a person falling under any subparagraph of paragraph (2) to provide human resources for assistance. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 48-3 (Report on Computer Security Incidents) |
| (1) | Where any of the following persons discovers a computer security incident, he or she shall immediately report it to the Minister of Science and ICT or the Korea Internet and Security Agency. In such cases, a notice given in accordance with Article 13 (1) of the Act on the Protection of Information and Communications Infrastructure shall be deemed a report under the foregoing sentence: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| 1. | A provider of information and communications services; |
| 2. | A business entity of clustered information and communications facilities. |
| (2) | Upon receiving a report on a computer security incident under paragraph (1) or becoming aware of a computer security incident, the Minister of Science and ICT or the Korea Internet and Security Agency shall take necessary measures under the subparagraphs of Article 48-2 (1). <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 48-4 (Analysis of Cause of Computer Security Incidents) |
| (1) | A person who operates an information and communications network, including a provider of information and communications services, shall analyze causes of a computer security incident and prevent damage from spreading, whenever a computer security incident occurs. |
| (2) | When a serious computer security incident occurs in an information and communications network operated by a provider of information and communications services, the Minister of Science and ICT may organize a private-public joint investigation team having expertise in protection of information to conduct an analysis on causes of such computer security incident in order to preclude spread of damage, take countermeasures against the computer security incident, recover from damage, and prevent recurrence of such computer security incident. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (3) | If deemed necessary for analyzing causes of a computer security incident pursuant to paragraph (2), the Minister of Science and ICT may order a provider of information and communications services and a business entity of clustered information and communications facilities to preserve relevant data, such as access records of the relevant information and communications network. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (4) | If deemed necessary for analyzing causes of a computer security incident, the Minister of Science and ICT may demand that a provider of information and communications services and a business entity of clustered information and communications facilities should submit data related to the computer security incident and also may order the private-public joint investigation team under paragraph (2) to enter a place of business of a person involved to conduct investigation into the causes of the computer security incident: Provided, That the submission of data corresponding to access log data under subparagraph 11 of Article 2 of the Protection of Communications Secrets Act shall be governed by the aforesaid Act. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (5) | The Minister of Science and ICT or the private-public joint investigation team shall not use the information learned through the data submitted and the investigation conducted in accordance with paragraph (4) for any purpose other than the analysis of causes of the computer security incident and preparation of countermeasures and shall destroy it immediately after the analysis of causes is completed. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (6) | Matters necessary for the organization of the private-public joint investigation team under paragraph (2) and the protection of data submitted in relation to a computer security incident in accordance with paragraph (4), and other related matters shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 49 (Protection of Secrets) |
No one shall mutilate another person's information processed, stored, or transmitted through an information and communications network, nor shall he or she infringe, misappropriate, or divulge another person's secret.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 49-2 (Prohibition on Collection of Personal Information by Acts of Deceiving) |
| (1) | No one shall collect another person's information or entice another person to furnish information through an information and communications network by an act of deceiving. |
| (2) | Whenever a provider of information and communications services discovers a violation of paragraph (1), he or she immediately report it to the Minister of Science and ICT, the Korea Communications Commission, or the Korea Internet and Security Agency. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 14080, Mar. 22, 2016; Act No. 14839. Jul. 26, 2017> |
| (3) | Upon receiving a report under paragraph (2) or becoming aware of a violation of paragraph (1), the Minister of Science and ICT, the Korea Communications Commission, or the Korea Internet and Security Agency shall take the following measures as may be necessary: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 14080, Mar. 22, 2016; Act No. 14839. Jul. 26, 2017> |
| 1. | Collection and diffusion of the information related to the violation; |
| 2. | Precaution and warning of similar damage; |
| 3. | Emergency measures to prevent damage and spread thereof, including requesting the relevant provider of information and communications services to block access paths or to inform the users of the fact that they are exposed to a violation under paragraph (1). |
| (4) | To take measures referred to in paragraph (3) 3, the Minister of Science and ICT or the Korea Communications Commission may order providers of information and communications services to take necessary measures, such as sharing among themselves information regarding acts of deceiving through information and communications networks. <Newly Inserted by Act No. 14080, Mar. 22, 2016; Act No. 14839. Jul. 26, 2017> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50 (Restrictions on Transmission of Advertising Information for Profit) |
| (1) | If any person intends to transmit advertising information for profit by using an electronic transmission medium, he or she shall obtain express prior consent from an addressee to whom such information is addressed: Provided, That he or she need not obtain prior consent in any of the following cases: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Where a person who has directly collected contact details from the addressee in his or her dealings of goods, etc. intends to transmit advertising information for profit on the same kinds of goods, etc. as those he or she manages and has dealt with the addressee within a period prescribed by Presidential Decree; |
| 2. | Where a telemarketer under the Act on Door-to-Door Sales informs prospective customers of the collection source of their personal information by voice, and solicits them to buy products or services by means of a telephone call. |
| (2) | Notwithstanding paragraph (1), where an addressee expresses his or her intention to refuse to receive information or revokes his or her prior consent, no person who intends to transmit advertising information for profit by using an electronic transmission medium shall transmit advertising information for profit. |
| (3) | Notwithstanding paragraph (1), a person who intends to transmit advertising information for profit by using an electronic transmission medium during the time between 9:00 pm and 8:00 am of the following day shall obtain express prior consent from the addressee of such information: Provided, That in cases of media prescribed by Presidential Decree, the forgoing shall not apply thereto. |
| (4) | A person who transmits advertising information for profit by using an electronic transmission medium shall specify the following matters in advertising information, as prescribed by Presidential Decree: |
| 1. | The name and contact details of a sender; |
| 2. | Matters regarding measures and methods by which an addressee can readily express his or her intention to refuse to receive information or to revoke his or her consent to receive information. |
| (5) | No person who transmits advertising information for profit by using an electronic transmission medium shall take any of the following measures: |
| 1. | Measures to avoid or interfere with, an addressee's refusal to receive, or revocation of his or her consent to receive, advertising information; |
| 2. | Measures to automatically generate an addressee's contact information, such as telephone numbers and e-mail addresses, by combining figures, codes, or letters; |
| 3. | Measures to automatically register telephone numbers or e-mail addresses for the purpose of transmitting advertising information for profit; |
| 4. | Various measures to hide the identity of the sender of advertising information or the source from which advertising is transmitted; |
| 5. | Various measures to induce an addressee to reply by deceiving him or her for the purpose of transmitting advertising information for profit. |
| (6) | A person who transmits advertising information for profit by using an electronic transmission medium shall take necessary measures so that an addressee does not incur any cost, such as telephone charges, when the addressee refuses to receive or revokes his or her consent to receive such information, as prescribed by Presidential Decree. |
| (7) | Where an addressee gives prior consent under paragraph (1) or expresses his or her intention to refuse to receive, or revoke his or her consent to receive, advertising information under paragraph (2), a person who intends to transmit advertising information for profit by using an electronic transmission medium shall inform the relevant addressee of the outcomes of measures taken in relation to consent to receive, refusal to receive, or revocation of consent to receive, advertising information, as prescribed by Presidential Decree. |
| (8) | A person who obtains consent to receive advertising information pursuant to paragraph (1) or (3) shall regularly verify whether an addressee of advertising information consents to receive such information, as prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 12681, May 28, 2014]
| Article 50-2 Deleted. <by Act No. 12681, May 28, 2014> |
| Article 50-3 (Commissioned Transmission of Advertising Information for Profit) |
| (1) | A person who has commissioned a third party to transmit advertising information for profit on his or her behalf shall control and oversee the third party to whom the transmission was commissioned to ensure that the third party does not violate Article 50. <Amended by Act No. 12681, May 28, 2014> |
| (2) | A person to whom transmission of advertising information for profit has been commissioned under paragraph (1) shall be deemed an employee of a person who has commissioned the transmission of information in determining liability for damages caused by a violation of a statute related to such business affair. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50-4 (Restrictions on Rendering Information Transmission Services) |
| (1) | A provider of information and communications services may take measures to refuse rendering corresponding services in any of the following cases: |
| 1. | If transmission or reception of advertising information hinders or is likely to hinder rendering the services; |
| 2. | If a user does not want to receive advertising information; |
| 3. | Deleted. <by Act No. 12681, May 28, 2014> |
| (2) | If a provider of information and communications services intends to take any measure for refusal under paragraph (1) or (4), he or she shall include matters regarding the refusal of the relevant services in the terms and conditions of a contract for use of information and communications services for which he or she concludes with the user of such services. <Amended by Act No. 12681, May 28, 2014> |
| (3) | A provider of information and communications services shall inform interested persons, such as users to whom such services are provided, of the fact that he or she has taken measures for refusal under paragraph (1) or (4): Provided, That where it is impracticable to inform them of the fact in advance, he or she shall inform them of the fact without delay after he or she has taken measures for refusal. <Amended by Act No. 12681, May 28, 2014> |
| (4) | Where services which a provider of information and communications services provides to users under a contract for use are used for transmitting advertising information for profits, in violation of Article 50 or 50-8, the relevant provider of information and communications services shall formulate necessary measures, such as refusal to provide the relevant services or fix of problems of information and communications networks or services. <Newly Inserted by Act No. 12681, May 28, 2014> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50-5 (Installation of Advertising Programs for Profit) |
When a provider of information and communications services intends to install a program designed to display advertising information or collect personal information in a user's computer or any other information processing device prescribed by Presidential Decree, he or she shall obtain consent from the user. In such cases, the provider shall notify the purpose of use of the program and the method of deletion.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50-6 (Distribution of Software Designed to Block Transmission of Advertising Information for Profit) |
| (1) | The Korea Communications Commission may develop and distribute software or computer programs designed for addressees to conveniently block or report any advertising information for profit when it is transmitted in violation of Article 50. |
| (2) | The Korea Communications Commission may provide necessary support to related public agencies, corporations, organizations, or similar for facilitating the development and distribution of software or computer programs for cutting off or reporting transmission under paragraph (1). |
| (3) | If telecommunications services rendered by a provider of information and communications services are used in transmitting advertising information for profit in violation of Article 50, the Korea Communications Commission may recommend the provider of information and communications services to take necessary measures, such as development of technology, education, and public relations activities to protect addressees. |
| (4) | The method of the development and distribution under paragraph (1) and the matters necessary for the support under paragraph (2) shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50-7 (Restrictions on Posting of Advertising Information for Profit) |
| (1) | Where any person intends to post advertising information for profit on a website, he or she shall obtain prior consent from the operator or the manager of a website: Provided, That in cases of a message board to which any person can have easy access without special authority and on which any person can post his or her message, he or she need not obtain prior consent. |
| (2) | Notwithstanding paragraph (1), where the operator or the manager of a website explicitly expresses his or her intention to refuse to post a notice or to revoke his or her prior consent, no person who intends to post advertising information for profit shall post advertising information for profit. |
| (3) | The operator or the manager of a website may take measures, such as deletion of advertising information for profit posted in violation of paragraph (1) or (2). |
[This Article Wholly Amended by Act No. 12681, May 28, 2014]
| Article 50-8 (Prohibition on Transmission of Advertising Information for Unlawful Acts) |
No one shall transmit any advertising information for goods or services prohibited by this Act or any other statute through an information and communications network.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 51 (Restrictions on Outflow of Important Information Abroad) |
| (1) | The Government may authorize providers or users of information and communications services to take necessary measures to prevent outflow abroad of any important information about industry, economy, science, technology, etc. of this county through information and communications networks. |
| (2) | The scope of the important information under paragraph (1) shall be as follows: |
| 1. | Information related to the national security and major policies; |
| 2. | Information about details of cutting-edge science and technology or equipment developed within this country. |
| (3) | The Government may authorize the providers of information and communications services that manage the information under the subparagraphs of paragraph (2) to take the following measures: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Installation of a systematic or technical device for preventing unlawful use of information and communications networks; |
| 2. | Systematic and technical measures for preventing unlawful destruction or manipulation of information; |
| 3. | Measures for preventing leakage of important information that providers of information and communications services have learned while managing the information. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 52 (Korea Internet and Security Agency) |
| (1) | The Government shall establish the Korea Internet and Security Agency (hereinafter referred to as the "Internet and Security Agency") to upgrade the information and communications network (excluding matters regarding establishment, improvement, and management of information and telecommunications network), encourage the safe use thereof, and promote the international cooperation and advancement into the overseas market in relation to broadcasting and communications. <Amended by Act No. 9637, Apr. 22, 2009> |
| (2) | The Internet and Security Agency shall be a corporation. <Amended by Act No. 9637, Apr. 22, 2009> |
| (3) | The Internet and Security Agency shall perform the following business affairs: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014; Act No. 13343 Jun. 22, 2015; Act No. 14839. Jul. 26, 2017> |
| 1. | Survey and research of laws, policies, and systems for the use and protection of the information and telecommunications network, promotion of the international cooperation and advancement into the overseas market in relation to broadcasting and communications, etc.; |
| 2. | Survey and research of statistics regarding the use and protection of the information and telecommunications network; |
| 3. | Analysis of negative effects arising from the use of the information and telecommunications network and research on countermeasures; |
| 4. | Public relations activities, education, and training for using and protecting the information and telecommunications network; |
| 5. | Information protection for the information and telecommunications network, development of technologies regarding the Internet address resources and standardization thereof; |
| 6. | Support for policies for the information security industry, development of relevant technology, and fostering of human resources; |
| 7. | Certification of an information security management system, and the implementation of and support for certification, evaluation, etc. of the information protection, such as evaluation or certification of an information security system; |
| 8. | Research of measures to protect personal information and support for development and proliferation of protection technology; |
| 9. | Support for the operation of the Dispute Mediation Committee and operation of the privacy call center; |
| 10. | Transmission of advertising information and consultation on and processing of complaints related to online advertisements; |
| 11. | Operation of a system to deal with computer security incidents of information and telecommunications network, analyze the causes thereof, and respond thereto; |
| 13. | Support for an efficient operation of the Internet and encouragement of wider use thereof; |
| 14. | Support for the protection of stored information of the Internet users; |
| 15. | Support for service policies pertaining to the Internet; |
| 16. | Protection of users and support for the proliferation of sound information on the Internet; |
| 20. | Support for such international cooperation, overseas expansion, and overseas publicity activities as are regarding broadcasting and communications; |
| 21. | Any other business incidental to the business referred to in subparagraphs 1 through 20; |
| 22. | Other business determined to fall under the affairs of, or entrusted to, the Internet and Security Agency in accordance with this Act, or any other statute or regulation, or other business entrusted by the Minister of Science and ICT, the Minister of the Interior and Safety, the Korea Communications Commission, or the head of any other administrative agency. |
| (4) | Expenses necessary for the business affairs of the Internet and Security Agency shall be funded by the following financial resources: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Government’s contributions; |
| 2. | Revenues accrued from the business referred to in each subparagraph of paragraph (3); |
| 3. | Other revenues accrued from operating the Internet and Security Agency. |
| (5) | Unless otherwise provided in this Act, the provisions governing incorporated foundations under the Civil Act shall apply mutatis mutandis to matters regarding the Internet and Security Agency. <Amended by Act No. 9637, Apr. 22, 2009> |
| (6) | No person, other than the Internet and Security Agency, shall use the name "Korea Internet and Security Agency". <Amended by Act No. 9637, Apr. 22, 2009> |
| (7) | Matters necessary for the operation of the Internet and Security Agency and performance of its business affairs shall be prescribed by Presidential Decree. <Amended by Act No. 9637, Apr. 22, 2009> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
CHAPTER VII TELECOMMUNICATIONS BILLING SERVICES
| Article 53 (Registration of Providers of Telecommunications Billing Services) |
| (1) | A person who intends to render telecommunications billing services shall meet the following requirements and file for registration with the Minister of Science and ICT, as prescribed by Presidential Decree: <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| 2. | A plan for protection of users of telecommunications billing services; |
| 3. | Human resources and physical facilities required for conducting the business; |
| (2) | A person eligible for the registration under paragraph (1) shall be either a company under Article 170 of the Commercial Act or a corporation under Article 32 of the Civil Act; and the total amount of its capital, contributions, or fundamental property shall be at least the amount prescribed by Presidential Decree, not less than 500 million won. |
| (4) | Articles 23 through 26 of the Telecommunications Business Act shall apply mutatis mutandis to a revision to registration of a provider of telecommunications billing services, the transfer or acquisition of business, or the merger or inheritance of business, the succession to business, and the cessation, discontinuance, dissolution, or similar of business of a provider of telecommunications billing services. In such cases, "special telecommunications business entity" shall be construed as "provider of telecommunications billing services", and "special telecommunications business" as "telecommunications billing services". <Amended by Act No. 10166, Mar. 22, 2010> |
| (5) | Detailed requirements and procedures for the registration under paragraph (1) and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
| Article 54 (Disqualification from Filing for Registration) |
Any of the following persons shall be disqualified from filing for registration under Article 53: <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> | 1. | A corporation for which one year has not elapsed since its business was discontinued pursuant to Article 53 (4) or a person who was a majority shareholder of such corporation as at the time its business was discontinued (referring to an investor prescribed by Presidential Decree; hereinafter the same shall apply), if one year has not elapsed since the date of discontinuance; |
| 2. | A corporation for which three years have not elapsed since its registration was revoked pursuant to Article 55 (1) or a person who was a majority shareholder of such corporation as at the time its registration was revoked, if three years have not elapsed since the date of revocation; |
| 4. | A person who did not perform his or her obligations within an agreed time limit in a banking transaction or any other commercial transaction and who is prescribed by the Minister of Science and ICT; |
| 5. | A corporation any of whose majority shareholders falls under subparagraphs 1 through 4. |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
| Article 55 (Orders to Revoke Registration) |
| (1) | Where a provider of telecommunications billing services files for registration by fraud or other improper means, the Minister of Science and ICT shall revoke the registration. <Amended by Act No. 13343 Jun. 22, 2015; Act No. 14839. Jul. 26, 2017> |
| (2) | The procedures for the disposition under paragraph (1) and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
| Article 56 (Reporting on Terms and Conditions) |
| (1) | Every provider of telecommunications billing services shall prepare terms and conditions on telecommunications billing services and report it to the Minister of Science and ICT (including reporting on a revision thereto). <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | If it is found that the terms and conditions under paragraph (1) is likely to undermine users’ interest of telecommunications billing services, the Minister of Science and ICT may recommend the relevant provider of telecommunications billing services to revise the terms and conditions. <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
| Article 57 (Securing Safety in Telecommunications Billing Services) |
| (1) | Every provider of telecommunications billing services shall perform his or her duty to pay attention as a good manager so that telecommunications billing services may be provided in a safe manner. <Amended by Act No. 12681, May 28, 2014> |
| (2) | Every provider of telecommunications billing services shall take administrative measures, including formulation of guidelines for work process and classification of accounts, and technical measures, including establishment of an information protection system, to secure safety and reliability of transactions through telecommunications billing services, as prescribed by Presidential Decree. |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
| Article 58 (Rights of Users of Telecommunications Billing Services) |
| (1) | When the price for goods, etc. sold or provided must be paid, or a provider of telecommunications billing services charges the price therefor; such provider shall notify the users of telecommunications billing services of the following: <Amended by Act No. 10560, Apr. 5, 2011; Act No. 12681, May 28, 2014> |
| 1. | Date and time telecommunications billing services are used; |
| 2. | Trade name and contact information of the other party with respect to purchasing or using any good or service through telecommunications billing services (referring to a person who sells or provides any good or service in a transaction through telecommunications billing services; hereinafter referred to as “other party to a transaction”); |
| 3. | Amount purchased or used through telecommunications billing services and details thereof; |
| 4. | Methods for raising an objection and contact information. |
| (2) | A provider of telecommunications billing services shall provide users of telecommunications billing services with a method by which users can verify the details of purchase and use and shall also furnish a user, upon request, with a written statement on the details of purchase and use (including an electronic document; hereinafter the same shall apply) within two weeks from the date requested. |
| (3) | A user of telecommunications billing services discovers that the telecommunications billing services have been rendered against his or her will, the user may request the provider of telecommunications billing services to make corrections (excluding where there is an intentional act or negligence on the part of the user of the telecommunications billing services), and where the provider of telecommunications billing services finds that the user's request for correction is reasonable, the provider shall withhold the payment of the price for use to a seller and shall notify the user of the results thereof within two weeks from the date of the request for correction. <Amended by Act No. 12681, May 28, 2014> |
| (4) | Every provider of telecommunications billing services shall preserve records of telecommunications billing services during the period, within five years, prescribed by Presidential Decree. |
| (5) | Where a provider of telecommunications billing services (referring to a person who provides services under Article 2 (1) 10 (a)) provides telecommunications billing services or increases the upper limits of use, he or she shall obtain consent from a user of the relevant telecommunications billing services in advance. <Newly Inserted by Act No. 12681, May 28, 2014> |
| (6) | When a provider of telecommunications billing services (referring to a person who provides services under Article 2 (1) 10 (a)) amends the terms and conditions, he or she shall notify users of the amendment thereof one month prior to the effective date of the amended terms and conditions. In such cases, a user who has an objection to the amended terms and conditions may terminate the contract for telecommunications billing services. <Newly Inserted by Act No. 12681, May 28, 2014> |
| (7) | The period, types, and scope of the details of purchase and use that a provider of telecommunications billing services should provide pursuant to paragraph (2); the types of records that a provider of telecommunications billing services should preserve pursuant to paragraph (4) and the methods for preserving such records; the methods for notifying amendment to the terms and conditions pursuant to paragraph (6); and matters necessary for terminating the contract, such as the period and procedures for raising an objection; shall be prescribed by Presidential Decree. <Amended by Act No. 12681, May 28, 2014> |
| (8) | The Minister of Science and ICT shall prescribe and provide public notice of matters necessary for methods for giving consent, etc. under paragraph (5). <Newly Inserted by Act No. 12681, May 28, 2014; Act No. 14839. Jul. 26, 2017> |
| (9) | The Minister of Science and ICT may prescribe and provide public notice of detailed matters regarding the methods for settling accounts, etc. so that telecommunications billing services are not provided against the will of users of telecommunications billing services. <Newly Inserted by Act No. 12681, May 28, 2014; Act No. 14839. Jul. 26, 2017> |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
| Article 58-2 (Request for Providing Information about Purchasers) |
| (1) | Any user of telecommunications billing services may request the counter-party to a transaction to provide information about the name and date of birth of a person who purchased or used goods, etc. (hereinafter referred to as "purchaser information") if necessary to ascertain that telecommunications billing services have been provided according to his or her intention. In such cases, the counter-party so requested to provide purchaser information shall provide such information within three days from the date of the request, in the absence of good reason not to do so. |
| (2) | A user of telecommunications billing services shall use the purchaser information provided pursuant to paragraph (1) only for the purpose of identifying the relevant purchaser or submitting such information to an investigative agency in filing a criminal complaint or report. |
| (3) | Other matters necessary relating to the content of, and the procedures for, requests for purchaser information shall be prescribed by Presidential Decree. |
[This Article Newly Inserted by Act No. 15628, Jun. 12, 2018]
| Article 59 (Mediation in and Resolution of Disputes) |
| (1) | Any provider of telecommunications billing services may establish and operate an institution or organization to autonomously mediate, resolve, or otherwise address disputes to protect rights and interests of users of telecommunications billing services. <Amended by Act No. 15628, Jun. 12, 2018> |
| (2) | If deemed necessary for mediating, resolving, or otherwise addressing disputes, an organization or institution authorized to mediate and resolve disputes under paragraph (1) may request for purchaser information on behalf of a user of telecommunications billing services with consent of the user. In such cases, Article 58-2 shall apply mutatis mutandis to the request for purchaser information, etc. <Newly Inserted by Act No. 15628, Jun. 12, 2018> |
| (3) | Every provider of telecommunications billing services shall prepare a procedure for raising an objection by users of telecommunications billing services in connection with the services and redressing damages to their rights, as prescribed by Presidential Decree, and where the provider enters into a contract for telecommunications billing services, the provider shall stipulate such procedure in the terms and conditions of the contract. <Amended by Act No. 12681, May 28, 2014> |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
| Article 60 (Liability for Damages) |
| (1) | A provider of telecommunications billing services shall be liable for damages caused to a user of the telecommunications billing services while rendering the services: Provided, That the same shall not apply where the damages were caused by intention or gross negligence on the part of the user of the telecommunications billing services. |
| (2) | A provider of telecommunications billing services shall negotiate with the claimant to damages for agreement on compensation for the damages under paragraph (1). |
| (3) | If parties fail to or are unable to reach an agreement on compensation for damages under paragraph (2), either party may file an application for decision with the Korea Communications Commission. <Amended by Act No. 8867, Feb. 29, 2008> |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
| Article 61 (Restrictions on Use of Telecommunications Billing Services) |
The Minister of Science and ICT may order a provider of telecommunications billing services to deny, suspend, or place a restriction on, the services against any of the following persons: <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11048, Sep. 15, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017>
| 2. | A person who undermines interests of users of telecommunications billing services seriously by enticing the users to purchase or use goods or services in any of the following means: |
| (a) | Transmitting any advertising information for profit in violation of Article 50; |
| (b) | Deceiving or enticing users of telecommunications billing services wrongfully; |
| 3. | A person who sells or renders goods or services prohibited by this Act or any other statute. |
[This Article Newly Inserted by Act No. 8778, Dec. 21, 2007]
CHAPTER VIII INTERNATIONAL COOPERATION
| Article 62 (International Cooperation) |
The Government shall cooperate reciprocally with other nations or international organizations in performing the following affairs:
| 1. | Affairs related to the transfer of personal information between nations and the protection of personal information; |
| 2. | Affairs for the protection of youths in information and communications networks; |
| 3. | Affairs for the prevention of acts that undermine safety of information and communications networks; |
| 4. | Other affairs for the facilitation of sounder and safer use of information and communications services. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 63 (Protection of Personal Information Transferred Abroad) |
| (1) | No provider of information and communications services or similar shall conclude an international contract with any term or condition in violation of this Act with respect to personal information of users. |
| (2) | A provider of information and communications services or similar shall obtain consent of the users in the case of intending to provide (including being inquired of), entrust management of, or deposit, such users’ personal information, overseas (hereafter referred to as “transfer” in this Article): Provided, That the said provider of information and communications services or similar need not obtain consent to either entrustment of management, or deposit, of the relevant personal information; where such transfer is necessary for implementing a contract on the provision of information and communications services and promoting the users’ convenience, and such provider or similar discloses all the matters referred to in each subparagraph of paragraph (3) pursuant to Article 27-2 (1) or informs such matters to the users in a manner prescribed by Presidential Decree, including by e-mail. <Amended by Act No. 14080, Mar. 22, 2016> |
| (3) | A provider of information and communications services or similar who intends to obtain the consent under paragraph (2) shall notify the relevant user of all the following matters in advance: |
| 1. | Items of the personal information transferred; |
| 2. | A nation to which the personal information is to be transferred, and the date and time, and methods of transfer; |
| 3. | The name of the person to whom the personal information is to be transferred (referring to the name of a corporation and the contact information of the person responsible for management of information, if the person is a corporation); |
| 4. | The purposes of use of the person to whom the personal information is to be transferred, and the period for possession and use of the personal information. |
| (4) | Where a provider of information and communications services or similar transfers personal information abroad with consent under paragraph (2), the provider shall take protective measures, as prescribed by Presidential Decree. |
| (5) | Paragraphs (1) through (4) shall apply mutatis mutandis where a person to whom a user's personal information is to be transferred intends to transfer such personal information to a third country. In such cases, "provider of information and communications services or similar" shall be construed as "person to whom personal information is to be transferred", and "person to whom personal information is to be transferred" as "person to whom personal information is to be transferred in a third country". <Newly Inserted by Act No. 15751, Sep. 18, 2018> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 63-2 (Principle of Reciprocity) |
Notwithstanding Article 63, restrictions may be imposed on providers of information and communications services or similar of any country restricting the transfer of personal information to a foreign country, to the extent equivalent to restrictions imposed by such country: Provided, That the same shall not apply where it is necessary to comply with a treaty or any other international agreement. [This Article Newly Inserted by Act No. 15751, Sep. 18, 2018]
CHAPTER IX SUPPLEMENTARY PROVISIONS
| Article 64 (Submission of Data) |
| (1) | The Minister of Science and ICT or the Korea Communications Commission may require a provider of information and communications services or similar (including a domestic agent and a person to whom this Article shall apply mutatis mutandis pursuant to Article 67; hereafter the same shall apply in this Article) to submit related articles, documents, and others in any of the following cases: <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017; Act No. 15751, Sep. 18, 2018> |
| 1. | Where the Minister or the Commission becomes aware of a violation or suspected violation of this Act; |
| 2. | Where the Minister or the Commission receives a report or petition on a violation of this Act; |
| 2-2. | Where an event, accident, or similar occurs or is likely to occur that noticeably damages safety and reliability of users’ information; |
| 3. | Where there is any other ground prescribed by Presidential Decree to believe that it is necessary for the protection of users. |
| (2) | When the Korea Communications Commission intends to take the following measures against a person who transmitted any advertising information for profit in violation of this Act, it may request a provider of information and communications services or similar to let it peruse or to submit data of the person who transmitted the advertising information, such as the name, address, and national identification number of the person and the period for access: |
| 1. | Corrective measures under paragraph (4); |
| 2. | Imposition of administrative fines under Article 76; |
| (3) | If a provider of information and communications services or similar fails to submit data under paragraph (1) or (2) or if it is found that a provider of information and communications services or similar has violated this Act, the Minister of Science and ICT or the Korea Communications Commission may assign public officials under his, her, or its control to enter the place of business of the person concerned related to such violation of this Act, including the provider of information and communications services or similar, for inspecting the current status of business, account books, documents, and others. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14080, Mar. 22, 2016; Act No. 14839. Jul. 26, 2017> |
| (4) | The Minister of Science and ICT or the Korea Communications Commission may order a provider of information and communications services or similar who has violated this Act to take corrective measures as may be necessary to stop or correct the violation, and may also require a provider of information and communications services or similar who has been ordered to take corrective measures to announce to the public the fact that he or she received the order to take such corrective measures. In such cases, the matters necessary for the methods, guidelines, and procedures for the public announcement and other related matters shall be prescribed by Presidential Decree. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (5) | In cases of issuing an order to take corrective measures as may be necessary pursuant to paragraph (4), the Minister of Science and ICT or the Korea Communications Commission may disclose to the public the issuance of the order to take corrective measures. In such cases, the matters necessary for the methods, guidelines, and procedures for the public disclosure and other related matters shall be prescribed by Presidential Decree. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (6) | When demanding submission or inspection of data or other materials pursuant to paragraph (1) or (2), the Minister of Science and ICT or the Korea Communications Commission shall give a written notice (including an electronic document), specifically stating the reasons and legal authority for such demand, the time limit for submission or the date and time for inspection, the details of data subject to the submission or inspection, and other related matters. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (7) | When an inspection under paragraph (3) is to be conducted, the plan for the inspection, including the date and time of, and the reasons for and details of, the inspection, shall be notified to the relevant provider of information and communications services or similar not later than seven days before the commencement of the inspection: Provided, That the plan for such inspection shall not be notified in an emergency case or if it is deemed impossible to accomplish the purposes of the inspection because of anticipated destruction of evidence or any other factor if a prior notice is given. |
| (8) | The public officials who conduct an inspection pursuant to paragraph (3) shall carry an identification indicating their authority with them to present it to people concerned, and shall deliver to the people concerned a document stating their names, the time and purposes of access, and other related matters, whenever they access to a place of business. |
| (9) | In cases of receiving, perusing, or inspecting data or any other material submitted pursuant to paragraphs (1) through (3), the Minister of Science and ICT or the Korea Communications Commission shall notify the relevant provider of information and communications services or similar of the results thereof (including the details of disposition, in cases of intending to make a disposition, such as an order to take corrective measures, as a result of the inspection) in writing. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (10) | The Minister of Science and ICT or the Korea Communications Commission may ask technical advice or any other support of the head of the Internet and Security Agency as may be necessary in demanding submission of data or conducting an inspection pursuant to paragraphs (1) through (4). <Amended by Act No. 9637, Apr. 22, 2009; Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (11) | The demand for submission of data or any other material and the inspections under paragraphs (1) through (3) shall be limited to the least extent necessary for the enforcement of this Act, and shall be not abused for any other purpose. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 64-2 (Protection and Destruction of Data) |
| (1) | If asked by a provider of information and communications services or similar to protect documents, data, or any other material submitted or collected pursuant to Article 64, the Minister of Science and ICT or the Korea Communications Commission shall not furnish them to a third party or disclose them to the general public. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | In cases of receiving data submitted through an information and communications network or converting collected data or any other material into an electronic format, the Minister of Science and ICT or the Korea Communications Commission shall take systematic and technical measures for security to protect personal information, trade secret, or similar from being leaked. <Amended by Act No. 10465, Mar 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (3) | If any of the following events occurs, the Minister of Science and ICT or the Korea Communications Commission shall immediately destroy documents, data, or any other material submitted or collected pursuant to Article 64, except as otherwise provided in any other statute. The same shall apply to a person to whom the authority of the Minister of Science and ICT or the Korea Communications Commission has been fully or partially delegated or entrusted under Article 65: <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| 1. | If the objectives of demanding submission of data, conducting a field inspection, or issuing an order to take corrective measures pursuant to Article 64 have been achieved; |
| 2. | If an administrative trial or administrative litigation is filed against an order issued to take corrective measures pursuant to Article 64 (4), when proceedings of such administrative trial are completed; |
| 3. | If a disposition is made to impose an administrative fine under Article 76 (4) and there is no objection to it, when the period to raise an objection under paragraph (5) ends; |
| 4. | If there is an objection filed against disposition of an administrative fine under Article 76 (4), when the non-contentious case procedures are closed at the competent court. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 64-3 (Imposition of Penalty Surcharges) |
| (1) | The Korea Communications Commission may impose, on a provider of information and communications services or similar, an amount equivalent to 3/100 or less of its sales related to a violation as a penalty surcharge, where such provider performs any of the following acts: <Amended by Act No. 11322, Feb. 17, 2012; Act No. 12681, May 28, 2014; Act No. 14080, Mar. 22, 2016; Act No. 15751, Sep. 18, 2018; Act No. 16021, Dec. 24, 2018> |
| 1. | Where the provider collects personal information without consent of the relevant user in violation of Article 22 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 2. | Where the provider collects personal information that is likely to seriously undermine rights, interests, or privacy of a person without consent of the relevant user in violation of Article 23 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 3. | Where the provider uses personal information in violation of Article 24 (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 4. | Where the provider furnishes a third party with personal information in violation of Article 24-2 (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 5. | Where the provider entrusts a third party with the management of personal information without consent of the relevant user in violation of Article 25 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 5-2. | Where the provider neglects his or her control, supervision, or education under Article 25 (4) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67), thereby causing a trustee to violate Chapter IV; |
| 6. | Where the provider has lost, stolen, divulged, forged, altered, or mutilated the personal information of a user, and not taken measures under Article 28 (1) 2 through 5 (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 7. | Where the provider collects personal information of a child under 14 years of age without consent of the legal representative or without ascertaining whether the legal representative has consented, in violation of Article 31 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 8. | Where the provider provides the personal information of any user overseas without obtaining consent from the user in violation of the main sentence of Article 63 (2) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 63 (5)). |
| (2) | Where a provider of information and communications services or similar on whom a penalty surcharge under paragraph (1) has been imposed, refuses to submit data for computation of his or her sales or submits any false data, the sales may be estimated on the basis of accounting records such as financial statements, and the current status of business, such as the number of subscribers and the service charges of other providers of information and communications services that are similar in size: Provided, That a penalty surcharge not exceeding 400 million won may be imposed where there was no sales or it is impracticable to compute the sales and where there is a ground prescribed by Presidential Decree. <Amended by Act No. 11322, Feb. 17, 2012> |
| (3) | When the Korea Communications Commission intends to impose a penalty surcharge under paragraph (1), it shall take the following factors into consideration: |
| 1. | The substance and gravity of the violation; |
| 2. | The duration and frequency of the violation; |
| 3. | The amount of profits acquired by the violation. |
| (4) | A penalty surcharge under paragraph (1) shall be computed based upon the factors under paragraph (3), but the specific guidelines and procedures for computation shall be prescribed by Presidential Decree. |
| (5) | If a person who is obligated to pay a penalty surcharge under paragraph (1) fails to pay it by the deadline, the Korea Communications Commission shall collect an additional charge equivalent to 6/100 of the unpaid penalty surcharge per annum beginning on the day immediately following the deadline. |
| (6) | If a person who is obligated to pay a penalty surcharge under paragraph (1) fails to pay it by the deadline, the Korea Communications Commission shall remind the person to pay it within a period prescribed by the Commission, and shall collect it in the same manner as delinquent national taxes are collected, if the person fails to pay the penalty surcharge and any additional charge imposed under paragraph (5) within the prescribed period. |
| (7) | Where a penalty surcharge imposed pursuant to paragraph (1) shall be refunded due to a court judgment or for any other reason, an additional amount equivalent to 6/100 of the penalty surcharge per annum shall be paid from the date the penalty surcharge is paid and until the date it is refunded. |
[This Article Newly Inserted by Act No. 9119, Jun. 13, 2008]
The Minister of Science and ICT or the Korea Communications Commission shall hold a hearing in any of the following cases: <Amended by Act No. 14839. Jul. 26, 2017>
| 1. | Where intending to revoke the designation of a certification body in accordance with Article 9 (2); |
| 2. | Where intending to revoke the designation of an identification service agency in accordance with Article 23-4 (1); |
| 3. | Where intending to revoke certification of an information security management system in accordance with Article 47 (10) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 47-3 (3)); |
| 4. | Where intending to revoke the designation of a certification body for information security management systems in accordance with Article 47-2 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 47-3 (4)); |
| 5. | Where intending to revoke any rating of information security management system in accordance with Article 47-5 (4); |
| 6. | Where intending to revoke the registration in accordance with Article 55 (1). |
[This Article Newly Inserted by Act No. 13520, Dec. 1, 2015]
| Article 65 (Delegation and Entrustment of Authority) |
| (1) | The Minister of Science and ICT or the Korea Communications Commission may delegate or entrust part of his or her authority under this Act to the heads of agencies under the control of the Ministry of Science and ICT or the presidents of the regional Korea posts, as prescribed by Presidential Decree. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (2) | The Minister of Science and ICT may entrust projects under Article 13 for facilitating the use of information and communications networks to the National Information Society Agency under Article 14 of the Framework Act on National Informatization, as prescribed by Presidential Decree. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (3) | The Minister of Science and ICT or the Korea Communications Commission may entrust the Internet and Security Agency with business affairs related to demanding submission of data and conducting inspections pursuant to Article 64 (1) and (2), as prescribed by Presidential Decree. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (4) | Article 64 (8) shall apply mutatis mutandis to employees of the Internet and Security Agency under paragraph (3). <Amended by Act No. 9637, Apr. 22, 2009> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 65-2 Deleted. <by Act No. 7812, Dec. 30, 2005> |
| Article 66 (Confidentiality) |
A person who is or was engaged in a job related to any of the following business affairs shall not divulge to another person any secret that he or she has learned while performing his or her duties, nor does he or she use it for any purpose other than performance of his or her duties: Provided, That the same shall not apply if any other statute provides otherwise: <Amended by Act No. 11322, Feb. 17, 2012>
| 1. | Deleted; <by Act No. 10465, Mar. 29, 2011> |
| 2. | Certification of an information security management system under Article 47; |
| 2-2. | Affairs of the certification of a personal information management system pursuant to Article 47-3; |
| 3. | Assessment of information protection systems under Article 52 (3) 4; |
| 4. | Deleted; <by Act No. 11322, Feb. 17, 2012> |
| 5. | Conciliation of disputes by the defamation dispute conciliation division under Article 44-10. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 67 (Application Mutatis Mutandis to Broadcasting Business Entities) |
| (1) | Chapter IV shall apply mutatis mutandis where a person falling under subparagraph 3 (a) through (e) and subparagraphs 6, 9, 12, and 14 of Article 2 of the Broadcasting Act collects, uses, or provides personal information of viewers. In this case, the term “provider of information and communications services” or “provider of information and communications services or similar” shall be construed as “person falling under subparagraph 3 (a) through (e) and subparagraphs 6, 9, 12, and 14 of Article 2 of the Broadcasting Act”; and the term “users” shall be construed as “viewers”. |
| (2) | Articles 22, 23, 23-2 through 23-4, 24, 24-2, 26, 26-2, 27, 27-2, 27-3, 28, 28-2, 29, 29-2, 30, 30-2, and 31 shall apply mutatis mutandis to the trustees under Article 25 (1). <Amended by Act No. 16021, Dec. 24, 2018> |
[This Article Newly Inserted by Act No. 11322, Feb. 17, 2012]
| Article 68 Deleted. <by Act No. 10165, Mar. 22, 2010> |
| Article 68-2 Deleted. <by Act No. 13343, Jun. 22, 2015> |
| Article 69 (Legal Fiction as Public Officials in Application of Penalty Provisions) |
Executive officers and employees of the National Information Society Agency and the Internet and Security Agency who engage in the business affairs entrusted by the Minister of Science and ICT or the Korea Communications Commission pursuant to Article 65 (2) or (3) shall be deemed public officials in applying Articles 129 through 132 of the Criminal Act. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> [This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 69-2 (Accusation) |
| (1) | Where an act falling under any subparagraph of Article 64-3 (1) is deemed existing, the Korea Communications Commission may accuse the responsible provider of information and communications services or similar to the local prosecutor’s office or other investigative agencies. |
| (2) | The Korea Communications Commission may recommend a provider of information and communications services or similar violating this Act with respect to the protection of personal information to take disciplinary action against the responsible person (including the representative and responsible executive officers). In this case, the person upon receiving such recommendation shall have regard thereto and notify the Korea Communications Commission of the result thereof. <Newly Inserted by Act No. 14080, Mar. 22, 2016> |
[This Article Newly Inserted by Act No. 11322, Feb. 17, 2012]
CHAPTER X PENALTY PROVISIONS
| Article 70 (Penalty Provisions) |
| (1) | A person who commits defamation of another person by disclosing a fact to the public through an information and communications network purposely to disparage the reputation of such person, shall be punished by imprisonment with labor for up to 3 years or by a fine not exceeding 30 million won. <Amended by Act No. 12681, May 28, 2014> |
| (2) | A person who commits defamation of another person by disclosing a false fact to the public through an information and communications network purposely to disparage the reputation of such person, shall be punished by imprisonment with labor for up to 7 years, by suspension of qualification for up to 10 years, or by a fine not exceeding 50 million won. |
| (3) | The prosecution may not prosecute a person who committed a crime under paragraph (1) or (2) against the victim's will explicitly manifested. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 70-2 (Penalty Provisions) |
A person who conveys or spread a malicious program in violation of Article 48 (2) shall be punished by imprisonment with labor for up to 7 years or by a fine not exceeding 70 million won. [This Article Newly Inserted by Act No. 14080, Mar. 22, 2016]
| Article 71 (Penalty Provisions) |
Any of the following persons shall be punished by imprisonment with labor for up to 5 years or by a fine not exceeding 50 million won: <Amended by Act No. 14080, Mar. 22, 2016; Act No. 16021, Dec. 24, 2018>
| 1. | A person who collects personal information without consent of the relevant user in violation of Article 22 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 2. | A person who collects personal information likely to seriously undermine rights, interests, or privacy of an individual without consent of the relevant user in violation of Article 23 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 3. | A person who uses or furnishes a third party with personal information, or who knowingly receives such personal information for profit or for any other wrongful purpose, in violation of Article 24, 24-2 (1) or (2), or 26 (3) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 4. | A person who entrusts someone with management of personal information without consent of the relevant user in violation of Article 25 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 5. | A person who compromises, infringes, or divulges personal information in violation of Article 28-2 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 6. | A person who knowingly receives any divulged personal information for profit or for any other wrongful purpose in violation of Article 28-2 (2); |
| 7. | A person who furnishes someone with personal information or uses thereof without taking necessary measures in violation of Article 30 (5) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 30 (7), 31 (3), or 67); |
| 8. | A person who collects personal information of a child under 14 years of age without consent of the legal representative or without ascertaining whether the legal representative has consented, in violation of Article 31 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 9. | A person who intrudes on an information and communications network in violation of Article 48 (1); |
| 10. | A person who disrupts an information and communications network in violation of Article 48 (3); |
| 11. | A person who damages another person's information or who infringes, misappropriates, or divulges another person's confidential information in violation of Article 49. |
| (2) | Any attempt referred to in paragraph (1) 9 shall be punished. <Newly Inserted by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 72 (Penalty Provisions) |
| (1) | Any of the following persons shall be punished by imprisonment with labor for up to 3 years or by a fine not exceeding 30 million won: <Amended by Act No. 12014, Jan. 20, 2015; Act No .13343 Jun. 22, 2015> |
| 1. | Deleted; <by Act No. 14080, Mar. 22, 2016> |
| 2. | A person who collects another person's personal information in violation of Article 49-2 (1); |
| 3. | A person who conducts affairs without filing for registration under Article 53 (1); |
| 4. | A person who lends a loan to someone or intermediates such loan by committing any of the following acts: |
| (a) | Conducting, or engaging someone to conduct vicariously, a transaction through telecommunications billing services by pretending sale or supply of goods or services or billing more than an actual selling price; |
| (b) | Engaging a user of telecommunications billing services to purchase or use certain goods or services through telecommunications billing services and then purchasing, at a discount, the goods or services purchased or used by the user of telecommunications billing services; |
| 5. | A person who divulges to another person any secret known to him or her while performing his or her duties or uses such secret for any purpose other than his or her duties in violation of Article 66. |
| (2) | Deleted. <by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 73 (Penalty Provisions) |
Any of the following persons shall be punished by imprisonment with labor for up to 2 years or by a fine not exceeding 20 million won: <Amended by Act No. 12681, May 28, 2014; Act No. 14080, Mar. 22, 2016; Act No. 15628, Jun. 12, 2018>
| 1. | A person who causes a user's personal information to be lost, stolen, divulged, forged, altered, or damaged because he or she has failed to take technical and administrative measures under Article 28 (1) 2 through 5 (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 1-2. | A person who fails to destroy personal information, in violation of Article 29 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 2. | A person who provides a media product harmful to youths for profit without labeling it as such in violation of Article 42; |
| 3. | A person who transmits to a youth any information containing advertisement of a media product harmful to youths or displays such information openly without taking any measures to restrict access by youths in violation of Article 42-2; |
| 4. | A person who uses a user's information for any purpose other than filing a civil or criminal lawsuit in violation of Article 44-6 (3); |
| 5. | A person who fails to comply with an order issued by the Korea Communications Commission under Article 44-7 (2) or (3); |
| 6. | A person who fails to preserve relevant data in violation of an order issued pursuant to Article 48-4 (3); |
| 7. | A person who entices another person to provide him or her with personal information in violation of Article 49-2 (1); |
| 7-2. | A person who uses provided information for any purpose other than identifying a purchaser or submitting the information to an investigative agency in filing a criminal complaint or report, in violation of Article 58-2 (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 59 (2)); |
| 8. | A person who fails to comply with an order issued pursuant to Article 61. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 74 (Penalty Provisions) |
| (1) | Any of the following persons shall be punished by imprisonment with labor for up to 1 year or by a fine not exceeding 10 million won: <Amended by Act No. 11322, Feb. 17, 2012; Act No. 12681, May 28, 2014> |
| 1. | A person who puts any similar label on a product or sells a product bearing any similar label, or who displays such product with intent to sell it, in violation of Article 8 (4); |
| 2. | A person who distributes, sells, lends, or openly displays any obscene codes, letters, sound, images, or motion pictures in violation of Article 44-7 (1) 1; |
| 3. | A person who makes any codes, letters, sound, images, or motion pictures arousing fear or apprehension reach another person repeatedly in violation of Article 44-7 (1) 3; |
| 4. | A person who takes measures, in violation of Article 50 (5); |
| 5. | Deleted; <by Act No. 12681, May 28, 2014> |
| 6. | A person who transmits any advertising information, in violation of Article 50-8; |
| 7. | A person who fails to file for any revision to registration, or who fails to file a report on transfer, acquisition, merger, or inheritance of business, in violation of Article 53 (4). |
| (2) | The prosecution may not prosecute a person who committed a crime under paragraph (1) 3 against the victim's will explicitly manifested. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 75 (Joint Penalty Provisions) |
If the representative of a corporation, or an agent or employee of, or any other person employed by, a corporation or individual commits any violation referred to in Articles 71 through 73 or Article 74 (1) in conducting the business affairs of the corporation or individual, the corporation or the individual shall, in addition to punishing the violator accordingly, be punished by a fine prescribed in the relevant Article: Provided, That this shall not apply where such corporation or individual has not been negligent in giving due attention and supervision regarding the relevant business affairs to prevent such violation. [This Article Amended by Act No. 10138, Mar. 17, 2010]
| Article 75-2 (Confiscation and Punitive Collection) |
Money and goods or other profits received by a person committing any crime referred to in Article 71 (1) 1 through 8, Article 72 (1) 2, and subparagraphs 1, 1-2 and 7 of Article 73 with respect to the relevant violation may be confiscated, and if it is impossible to confiscate such money and goods or other profits, the value thereof may be punitively collected. In this case, the penalty of confiscation or punitive collection may be imposed in addition to any other penalty. [This Article Newly Inserted by Act No. 14080, Mar. 22, 2016]
| Article 76 (Administrative Fines) |
| (1) | Any of the following persons and a person who made a third party commit an act falling under subparagraphs 7 through 11, shall be subject to an administrative fine not exceeding 30 million won: <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 12681, May 28, 2014; Act No. 13344, Jun. 22, 2015; Act No. 13520, Dec. 1, 2015; Act No. 14080, Mar. 22, 2016; Act No. 14839. Jul. 26, 2017; Act No. 15751, Sep. 18, 2018> |
| 1. | A person who refuses to provide services, in violation of Article 22-2 (2) or 23 (3) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 1-2. | A person who fails to take measures necessary to protect users’ information such as devising methods for users to give or revoke consent to access authority, in violation of Article 22-2 (3) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 2. | A person who collects or uses resident registration numbers in violation of Article 23-2 (1) or fails to take necessary measures in violation of Article 23-2 (2) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 2-2. | A person who either fails, in obtaining consent to provision of personal information or entrustment of management thereof, to obtain it separately from consent to collection and use of personal information, or refuses to provide any service on the ground that no consent has been given to such provision or entrustment, in violation of Article 24-2 (3) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 2-3. | A person who fails to give notice or report to users, the Korea Communications Commission, and the Korea Internet Security Agency, in violation of Article 27-3 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67), or gives notice or reports thereto after 24 hours have elapsed without just cause; |
| 2-4. | A person who fails to provide an explanation under Article 27-3 (3) or makes a false explanation; |
| 3. | A person who fails to take technical and administrative measures under Article 28 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 4. | A person who fails to take measures, such as the destruction of personal information, in violation of Article 29 (2) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 5. | A person who fails to take necessary measures, in violation of Article 30 (3), (4), or (6) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 30 (7), 31 (3), or 67); |
| 5-2. | A person who fails to notify details of personal information used, in violation of the main sentence of Article 30-2 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 6. | Deleted; <by Act No. 12681, May 28, 2014> |
| 6-2. | A person who fails to report the designation of a chief information security officer, in violation of Article 45-3 (1); |
| 6-3. | A person who fails to have an information security management system certified, in violation of Article 47 (2); |
| 7. | A person who transmits any advertising information for profit, in violation of Article 50 (1) through (3); |
| 8. | A person who fails to state the matters required to be stated, or who states false information on such matters, when transmitting any advertising information, in violation of Article 50 (4); |
| 9. | A person who imposes the burden of any expense on an addressee, in violation of Article 50 (6); |
| 9-2. | A person who fails to verify whether an addressee consents to receiving advertising information, in violation of Article 50 (8); |
| 10. | A person who installs a program without consent of the relevant user, in violation of Article 50-5; |
| 11. | A person who posts any advertising information for profit on a website, in violation of Article 50-7 (1) or (2); |
| 11-2. | A person who fails to take protective measures, in violation of Article 63 (4) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 63 (5)); |
| 12. | A person who fails to comply with an order issued, for violation of this Act, by the Minister of Science and ICT or the Korea Communications Commission pursuant to Article 64 (4). |
| (2) | Any of the following persons shall be subject to an administrative fine not exceeding 20 million won: <Amended by Act No. 14080, Mar. 22, 2016; Act No. 15628, Jun. 12, 2018; Act No. 15751, Sep. 18, 2018> |
| 1. | A person who fails to disclose or notify the matters regarding the entrustment of management of personal information to users, in violation of Article 25 (2) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 1-2. | A person who re-entrusts a third party with the management of personal information without obtaining a consent from a provider of information and communications services or similar, in violation of Article 25 (7) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 2. | A person who fails to notify a user of transfer of personal information in violation of Article 26 (1) or (2) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 3. | A person who fails to designate a person responsible for protection of personal information, in violation of Article 27 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 4. | A person who fails to disclose the relevant policy on managing personal information, in violation of Article 27-2 (1) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 4-2. | A person who fails to take necessary measures, such as taking out insurance, joining a mutual aid organization, or setting aside reserves, in violation of Article 32-3 (1), or fails to take out insurance, in violation of Article 46 (2); |
| 4-3. | A person who fails to designate a domestic agent, in violation of Article 32-5 (1); |
| 5. | A person who discloses all the matters referred to in each subparagraph of Article 63 (3) in violation of the proviso to Article 63 (2) or who entrusts the management of, or deposits, user’s personal information, overseas without informing the user. |
| (3) | Any of the following persons shall be subject to an administrative fine not exceeding 10 million won: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 10560, Apr. 5, 2011; Act No. 11322, Feb. 17, 2012; Act No. 12681, May 28, 2014; Act No. 13344, Jun. 22, 2015; Act No. 13520, Dec. 1, 2015; Act No. 14080, Mar. 22, 2016; Act No. 14839. Jul. 26, 2017; Act No. 15628, Jun. 12, 2018> |
| 1. | and 2. Deleted; <by Act No. Act No. 13343 Jun. 22, 2015> |
| 2-2. | A person who engages in the identification service without being designated as an identification service agency, in violation of Article 23-3 (1); |
| 2-3. | A person who fails to notify as to suspension of identification service under Article 23-3 (2) or as to discontinuation of identification service under Article 23-3 (3) to users or who fails to report the same to the Korea Communications Commission; |
| 2-4. | A person who continuously engages in identification services notwithstanding a disposition for suspension of identification service and revocation of the designation as an identification service agency under Article 23-4 (1); |
| 2-5. | A person who fails to entrust in writing the management of personal information in violation of Article 25 (6) (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 67); |
| 3. | A person who fails to designate a person responsible for protection of youths in violation of Article 42-3 (1); |
| 4. | A person who fails to preserve information, in violation of Article 43; |
| 5. | Deleted. <by Act No. 15628, Jun. 12, 2018> |
| 6. | Deleted; <by Act No. 13520, Dec. 1, 2015> |
| 7. | A person who advertises false details of the certification he or she has obtained, in violation of Articles 47 (9) and 47-3 (3); |
| 8. | and 9. Deleted; <by Act No. 11322, Feb. 17, 2012> |
| 10. | A person who fails to give notice to users of software, in violation of Article 47-4 (3); |
| 11. | A person who fails to comply with an order issued pursuant to Article 48-2 (4) to take corrective measures; |
| 11-2. | A person who fails to report a computer security incident, in violation of Article 48-3 (1); |
| 12. | A person who interferes with, refuses, or evades access to a place of business to conduct an inspection under Article 48-4 (4); |
| 12-2. | A person who fails to comply with an order issued by the Minister of Science and ICT or the Korea Communications Commission, in violation of Article 49-2 (4); |
| 12-3. | A person who fails to inform the results of handling consent to receive, refusal to receive, or revocation of consent to receive, advertising information, in violation of Article 50 (7); |
| 12-4. | A person who fails to take necessary measures, in violation of Article 50-4 (4); |
| 13. | A person who uses the name of the Korea Internet and Security Agency, in violation of Article 52 (6); |
| 14. | A person who fails to file a report on cessation, discontinuance, or dissolution of business, in violation of Article 53 (4); |
| 15. | A person who fails to report terms and conditions, in violation of Article 56 (1); |
| 16. | A person who fails to take administrative or technical measures, in violation of Article 57 (2); |
| 17. | A person who fails to notify a user of telecommunications billing services of the date and time of using the aforementioned services and other necessary matters, in violation of Article 58 (1); |
| 18. | A person who fails to provide a user of telecommunications billing services with the method by which the user can verify the details of purchase or use, or who fails to comply with a request by a user of telecommunications billing services to provide such method, in violation of Article 58 (2); |
| 19. | A person who fails to withhold payment of the price though a request to correct a telecommunications bill he or she has received from a user of telecommunications billing services is reasonable or who fails to notify the user of telecommunications billing services of the results of the measures taken in response to a request of the user, in violation of Article 58 (3); |
| 20. | A person who fails to preserve records of telecommunications billing services, in violation of Article 58 (4); |
| 20-2. | A person who provides telecommunications billing services or increases the maximum use without obtaining consent from a user of telecommunications billing services, in violation of Article 58 (5); |
| 20-3. | A person who fails to give notice regarding amendment to the terms and conditions of telecommunications billing services, in violation of Article 58 (6); |
| 20-4. | A person who fails to comply with a request by a user of telecommunications billing services for information, in violation of Article 58-2 (including where the aforesaid provisions shall apply mutatis mutandis pursuant to Article 59 (2)); |
| 21. | A person who fails to prepare the procedures for raising an objection by users of telecommunications billing services and redressing their infringed rights or who fails to stipulate such procedures when he or she enters into a contract for telecommunications billing services, in violation of Article 59 (3); |
| 22. | A person who fails to submit, or who falsely submitted, goods, documents, or any other material under Article 64 (1); |
| 23. | A person who fails to comply with a request for inspection or submission of data under Article 64 (2); |
| 24. | A person who refuses, interferes with, or evades access and inspection under Article 64 (3). |
| (4) | The administrative fines prescribed in paragraphs (1) through (3) shall be imposed and collected by the Minister of Science and ICT or the Korea Communications Commission, as prescribed by Presidential Decree. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14839. Jul. 26, 2017> |
| (5) | through (7) Deleted. <by Act No. 14580, Mar. 14, 2017> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force on July 1, 2001.
Article 2 (Transitional Measures Following Change of Basis for Establishing the Korea Information Security Center and of Its Name)
| (1) | The Korea Information Security Center established pursuant to Article 14-2 of the Framework Act on National Informatization as at the time this Act enters into force shall be deemed the Korea Information Security Agency established pursuant to Article 52 of this Act. |
| (2) | Any act performed by and any legal relations maintained by the Korea Information Security Center as at the time this Act enters into force shall be deemed performed and maintained by the Korea Information Security Agency. |
| (3) | The name of the Korea Information Security Center on the register book and other public registers as at the time this Act enters into force shall be deemed the name of the Korea Information Security Agency. |
Article 3 (Transitional Measures Following Change of Name of the Korea Information and Communications Promotion Association)
| (1) | The Korea Information and Communications Promotion Association as at the time this Act enters into force shall be deemed the Korea Association of Information and Telecommunication. |
| (2) | Any act performed and any legal relations maintained by the Korea Information and Communications Promotion Association as at the time this Act enters into force shall be deemed performed and maintained by the Association. |
| (3) | The name of the Korea Information and Communications Promotion Association on the register book and other public registers as at the time this Act enters into force shall be deemed the name of the Korea Association of Information and Telecommunication. |
Article 4 (Transitional Measures concerning Application of Penalty Provisions)
The application of penalty provisions to any act committed before this Act enters into force shall be governed by the previous provisions.
Article 5 Omitted.
Article 6 (Relationship with Other Statutes or Regulations)
If other statutes or regulations cite the previous Act on Promotion of Utilization of Information System or the provisions thereof as at the time this Act enters into force and if there exist corresponding provisions thereto in this Act, this Act or the corresponding provisions in this Act shall be regarded as being cited.
ADDENDA <Act No. 6585, Dec. 31, 2001>
Article 1 (Enforcement Date)
This Act shall enter into force on April 1, 2002.
Articles 2 through 4 Omitted.
ADDENDA <Act No. 6797, Dec. 18, 2002>
| (1) | (Enforcement Date) This Act shall enter into force one month after the date of its promulgation: Provided, That the amended provisions of Articles 50 (2) and (5), 56 (3) and (4), 60, and 67 (1) (limited to subparagraphs 15-2 and 15-4) shall enter into force six months after the date of promulgation of this Act. |
| (2) | (Transitional Measures concerning Application of Administrative Fines) The application of administrative fines to any violation committed before this Act enters into force shall be governed by the previous provisions. |
ADDENDA <Act No. 7139, Jan. 29, 2004>
| (1) | (Enforcement Date) This Act shall enter into force on the date of its promulgation: Provided, That the amended provisions of Articles 28, 45 (4), 46-3, 47-2 (4), and 48-4 (6) shall enter into force six months after the date of promulgation of this Act. |
| (2) | (Transitional Measures concerning Application of Administrative Fines) The application of administrative fines to any violation committed before this Act enters into force shall be governed by the previous provisions. |
ADDENDA <Act No. 7142, Jan. 29, 2004>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Articles 2 through 4 Omitted.
ADDENDUM <Act No. 7262, Dec. 30, 2004>
This Act shall enter into force three months after the date of its promulgation.
ADDENDA <Act No. 7796, Dec. 29, 2005>
Article 1 (Enforcement Date)
This Act shall enter into force on July 1, 2006.
Articles 2 through 6 Omitted.
ADDENDUM <Act No. 7812, Dec. 30, 2005>
This Act shall enter into force three months after the date of its promulgation.
ADDENDA <Act No. 7917, Mar. 24, 2006>
| (1) | (Enforcement Date) This Act shall enter into force three months after the date of its promulgation. |
| (2) | (Transitional Measures concerning Safety Check of Information Protection) Where a company specializing in information protection consulting under Article 17 of the Act on the Protection of Information and Communications Infrastructure has commenced the works of safety check of information protection before this Act enters into force, it may continue to perform the works of safety check of information protection pursuant to the previous provisions, notwithstanding the amended provisions of Article 46-3 (1). |
ADDENDUM <Act No. 8030, Oct. 4, 2006>
This Act shall enter into force three months after the date of its promulgation.
ADDENDA <Act No. 8031, Oct. 4, 2006>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 6 Omitted.
ADDENDA <Act No. 8289, Jan. 26, 2007>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Article 2 (Transitional Measures concerning Prohibition on Illegal Communications)
The orders issued by the Minister of Information and Communication to reject, suspend, or restrict handling of telecommunications services pursuant to Article 53 of the Telecommunications Business Act before this Act enters into force shall be deemed to have been issued pursuant to the amended provisions of Article 44-7 of this Act. Article 3 (Transitional Measures Following Change in Authority for Establishment of the Information and Communications Ethics Committee)
| (1) | The Information and Communications Ethics Committee established pursuant to Article 53-2 of the previous Telecommunications Business Act as at the time this Act enters into force shall be deemed the Information and Communications Ethics Committee established pursuant to the amended provisions of Article 44-8 of this Act. |
| (2) | The acts done by or against the Information and Communications Ethics Committee and other legal relationships with the Information and Communications Ethics Committee under the previous provisions before this Act enters into force shall be deemed the acts done by or against the Information and Communications Ethics Committee and other legal relationships with the Information and Communications Ethics Committee under the amended provisions of Article 44-8 of this Act. |
Article 4 (Transitional Measures concerning Collection, Use, and Provision of Personal Information)
| (1) | Consent obtained from a user in relation to collection, use, provision, or similar of personal information in accordance with the previous provisions of Article 22, 23, 24, or 54 as at the time this Act enters into force shall be deemed consent obtained lawfully in accordance with the amended provisions of Article 22, 23, 24, 24-2, or 54. |
| (2) | Handling of personal information, which has been entrusted lawfully in accordance with the previous provisions of Article 25 as at the time this Act enters into force shall be deemed to have been entrusted with consent obtained lawfully in accordance with the amended provisions of Article 25 (1). |
| (3) | An act performed by a person who succeeded rights and obligations of a provider of information and communications services or similar in accordance with the previous provisions of Article 26 as at the time this Act enters into force to use or provide personal information, shall be deemed to have been performed with consent obtained lawfully in accordance with the amended provisions of Article 26 (3). |
Article 5 (Transitional Measures concerning Application of Penalty Provisions)
The application of penalty provisions to any act committed before this Act enters into force shall be governed by the previous provisions.
Article 6 Omitted.
ADDENDA <Act No. 8486, May 25, 2007>
Article 1 (Enforcement Date)
This Act shall enter into force one year after the date of its promulgation.
Articles 2 through 10 Omitted.
ADDENDA <Act No. 8778, Dec. 21, 2007>
Article 1 (Enforcement Date)
This Act shall enter into force three months after the date of its promulgation.
Article 2 (Transitional Measures concerning Registration of Providers of Telecommunications Billing Services)
| (1) | A person who renders telecommunications billing services as at the time this Act enters into force shall complete the registration with the Minister of Information and Communication in accordance with the amended provisions of Article 53 (1) within three months from the date this Act enters into force. |
| (2) | A provider of telecommunications billing services who is registered in accordance with Article 28 (2) of the Electronic Financial Transactions Act as at the time this Act enters into force shall submit a written statement certifying the registration with the Minister of Information and Communication within three months from the date this Act enters into force. |
| (3) | A person who submits a written statement in accordance with paragraph (2) shall be deemed to have been registered in accordance with the amended provisions of Article 53 (1). |
ADDENDA <Act No. 8852, Feb. 29, 2008>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 7 Omitted.
ADDENDA <Act No. 8867, Feb. 29, 2008>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 12 Omitted.
ADDENDA <Act No. 9119, Jun. 13, 2008>
| (1) | (Enforcement Date) This Act shall enter into force six months after the date of its promulgation. |
| (2) | (Transitional Measures concerning Application of Penalty Provisions and Administrative Fines) The application of penalty provisions and administrative fines to any act committed before this Act enters into force shall be governed by the previous provisions. |
ADDENDA <Act No. 9637, Apr. 22, 2009>
Article 1 (Enforcement Date)
This Act shall enter into force three months after the date of its promulgation.
Article 2 (Preparation for Establishment of the Korea Internet and Security Agency)
| (1) | The Korea Communications Commission may perform preparatory activities to establish the Korea Internet and Security Agency by commissioning not less than five incorporators before this Act enters into force. |
| (2) | The incorporators shall prepare the articles of incorporation of the Korea Internet and Security Agency and obtain approval from the Korea Communications Commission. |
| (3) | Upon obtaining approval under paragraph (2), the incorporators shall register the incorporation of the Korea Internet and Security Agency by joint signature and turn over the administrative responsibility to the President of Korea Internet and Security Agency. |
| (4) | The incorporators shall be deemed decommissioned at the time the take-over of the administrative responsibility is complete pursuant to paragraph (3). |
Article 3 (Transitional Measures concerning Succession of the Korea Information Security Agency, the Korea Internet and Security Agency, and the Korea IT International Cooperation Agency)
| (1) | The administrative responsibilities of the Korea Information Security Agency under Article 52 of the Act on Promotion of Information and Communications Network Utilization and Information Protection (hereinafter referred to as the "Korea Information Security Agency"), the Korea Internet and Security Agency under Article 9 of the Internet Address Resources Act (hereinafter referred to as the "Korea Internet and Security Agency"), and the Korea IT International Cooperation Agency under Article 24-2 of the Framework Act on Informatization Promotion (hereinafter referred to as the "Korea IT International Cooperation Agency"), which are governed by the previous provisions as at the time this Act enters into force, shall be comprehensively succeeded to the Korea Internet and Security Agency under this Act. |
| (2) | The previous rights, obligations, properties of the Korea Information Security Agency, the Korea Internet and Security Agency, and the Korea IT International Cooperation Agency as at the time this Act enters into force shall be comprehensively succeeded to the Korea Internet and Security Agency under this Act. |
| (3) | The previous employment relationship covering the employees of the Korea Information Security Agency, the Korea Internet and Security Agency, and the Korea IT International Cooperation Agency as at the time this Act enters into force shall be comprehensively succeeded to the Korea Internet and Security Agency under this Act. |
| (4) | The previous activities performed by or in relation to the Korea Information Security Agency, the Korea Internet and Security Agency, and the Korea IT International Cooperation Agency as at the time this Act enters into force shall be deemed to have been performed by or in relation to the Korea Internet and Security Agency under this Act. |
| (5) | The names of the Korea Information Security Agency, the Korea Internet and Security Agency, and the Korea IT International Cooperation Agency indicated on the register as at the time this Act enters into force or other public books shall be deemed to be that of the Korea Internet and Security Agency under this Act. |
Article 4 Omitted.
Article 5 (Relationship with Other Statutes or Regulations)
Where the Act on Promotion of Information and Communications Network Utilization and Information Protection or the provisions thereof are cited in other statutes or regulations as at the time this Act enters into force, and any provision corresponding thereto exists in this Act, this Act or the corresponding provision of this Act shall be deemed to have been cited in lieu of the previous provision.
ADDENDUM <Act No. 10138, Mar. 17, 2010>
This Act shall enter into force three months after the date of its promulgation.
ADDENDA <Act No. 10165, Mar. 22, 2010>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation. (Proviso Omitted.)
Articles 2 through 7 Omitted.
ADDENDA <Act No. 10166, Mar. 22, 2010>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Articles 2 through 9 Omitted.
ADDENDA <Act No. 10465, Mar. 29, 2011>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
(Proviso Omitted.)
Articles 2 through 7 Omitted.
ADDENDA <Act No. 10560, Apr. 5, 2011>
Article 1 (Enforcement Date)
This Act shall enter into force three months after the date of its promulgation.
Article 2 (General Transitional Measures)
Previous acts of the identification service agency which developed and provided the previous identification affairs as at the time this Act enters into force shall be deemed to have been legitimately developed and provided if the agency obtains the designation of identification service agency under this Act.
Article 3 (Transitional Measures concerning Designation of Identification Service Agency)
A person who was conducting the identification service as at the time this Act enters into force shall be designated, within three months after this Act enters into force, as an identification service agency by the Korea Communications Commission pursuant to the amended provisions of Article 23-3 (1).
ADDENDA <Act No. 11048, Sep. 15, 2011>
Article 1 (Enforcement Date)
This Act shall enter into force one year after the date of its promulgation.
(Proviso Omitted.)
Articles 2 through 5 Omitted.
ADDENDA <Act No. 11322, Feb. 17, 2012>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions of Articles 45, 45-2, 45-3, 46-3, 47, 47-2, 47-3, 47-5, 52 (3) 7, 66, and 76 (3) 6 through 9 shall enter into force one year after the date of promulgation of this Act. Article 2 (Transitional Measures concerning Restrictions on Collection and Use of Resident Registration Numbers)
| (1) | A provider of information and communications services who provides methods of subscription for membership by using the subscriber’s resident registration number as at the time this Act enters into force shall destroy all the resident registration numbers possessed by the provider within two years after this Act enters into force: Provided, That this shall not apply in the case of any subparagraph of Article 23-2 (1). |
| (2) | Where a provider of information and communications services fails to destroy the resident registration numbers possessed by him or her within the period under paragraph (1), the amended provisions of Article 23-2 (1) shall be deemed violated. |
Article 3 (Transitional Measures concerning Abolition of Safety Inspection on Protection of Information)
A business entity who received a safety inspection on the protection of information pursuant to previous provisions as at the time this Act enters into force shall be deemed, during the relevant year in which he or she underwent the safety inspection on the protection of information, as a business entity who received the certification of an information security management system pursuant to the amended provisions of Article 47 (2). Article 4 (Transitional Measures concerning Certification of Personal Information Management System)
A person who received the certification of a personal information management system from the Korea Internet and Security Agency as at the time this Act enters into force shall be deemed to have received the certification of a personal information management system pursuant to the amended provisions of Article 47-3. Article 5 (Transitional Measures concerning Administrative Fines)
The application of administrative fines to any violation committed before this Act enters into force shall be governed by the previous provisions.
ADDENDA <Act No. 11690, Mar. 23, 2013>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation.
Articles 2 through 7 Omitted.
ADDENDA <Act No. 12681, May 28, 2014>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation:
Provided, That the amended provisions of Articles 44 (3), 44-5, and 76 (1) 6 shall enter into force on the date of promulgation of this Act. Article 2 (Transitional Measures concerning Penalty Surcharges and Penalty Provisions)
When penalty surcharges and penalty provisions apply to any violation committed before this Act enters into force, the previous provisions shall apply thereto.
ADDENDA <Act No. 12844, Nov. 19, 2014>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation: Provided That, the amendments to the statutes to be amended pursuant to Article 6 of the Addenda, which were promulgated before this Act enters into force but the enforcement dates of which have yet to arrive, shall enter into force on the enforcement date of the relevant statute.
Articles 2 through 7 Omitted.
ADDENDUM <Act No. 13014, Jan. 20, 2015>
This Act shall enter into force three months after the date of its promulgation.
ADDENDUM <Act No. 13280, Mar. 27, 2015>
This Act shall enter into force on the date of its promulgation.
ADDENDA <Act No. 13343, Jun. 22, 2015>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Articles 2 and 3 Omitted.
ADDENDA <Act No. 13344, Jun. 22, 2015>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Article 2 (Applicability to Administrative Dispositions)
The amended provisions of Article 55 (1) shall apply even to administrative dispositions against the violations committed before this Act enters intro force.
ADDENDA <Act No. 13520, Dec. 1, 2015>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation:
Provided, That the amended provisions of Article 29 (2) and (3) shall enter into force on the date of promulgation of this Act. Article 2 (Applicability to Destruction of Personal Information)
The amended provisions of Article 29 (2) and (3) shall apply even to the personal information collected or provided before such amended provisions enter into force. Article 3 (Applicability to Omission of Examination of Certification of Information Security Management Systems)
The amended provisions of Article 47 (3) shall apply even to persons who have made an application for the certification of an information security management system, procedures for which are underway. Article 4 (Transitional Measures concerning Certification of Information Security Management Systems)
A person who has not received the certification of an information security management system shall receive the certification within six months after this Act enters into force, in accordance with the amended provisions of Article 47 (2). Article 5 (Transitional Measures concerning Administrative Fines)
The application of administrative fines to any violation committed before this Act enters into force shall be governed by the previous provisions.
ADDENDA <Act No. 14080, Mar. 22, 2016>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation:
Provided, That the amended provisions of Articles 22-2 and 76 (1) 1 and 1-2 shall enter into force one year after the date of promulgation of this Act; the amended provisions of Articles 32 (2) and (3) and 32-2 (3) shall enter into force on July 25, 2016; and the amended provisions of Article 52 (4) shall enter into force on the date of promulgation of this Act. Article 2 (Applicability to Compensation for Damage)
The amended provisions of Articles 32 (2) and (3) and 32-2 (3) shall begin to apply from the first claim for compensation for damage against any information lost, stolen, leaked, forged, altered, or damaged after the said amended provisions enter into force. Article 3 (Transitional Measures concerning Informing Fact of Exposure to Violations)
A provider of information and communications services shall, not later than six months after this Act enters into force, establish equipment, by means of which informing messages can be sent to users pursuant to the amended provisions of Article 49-2 (3). Article 4 (Transitional Measures concerning Penalty Provisions)
The application of penalty provisions to any act committed before this Act enters into force shall be governed by the previous provisions.
Article 5 Omitted.
ADDENDUM <Act No. 14580, Mar. 14, 2017>
This Act shall enter into force on the date of its promulgation.
ADDENDA <Act No. 14839, Jul. 26, 2017>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation: Provided, That the amendments to the statutes to be amended pursuant to Article 5 of the Addenda, which were promulgated before this Act enters into force but the enforcement dates of which have yet to arrive, shall enter into force on the enforcement date of the relevant statute.
Articles 2 through 6 Omitted.
ADDENDUM <Act No. 15628, Jun. 12, 2018>
This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions of Articles 32-3, 45-3, and 76 (2) 4-2 (limited to the part relevant to the amended provisions of Article 32-3) shall enter into force one year after the date of its promulgation.
ADDENDUM <Act No. 15751, Sep. 18, 2018>
This Act shall enter into force six months after the date of its promulgation.
ADDENDA <Act No. 16019, Dec. 24, 2018>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation. (Proviso Omitted.)
Articles 2 and 3 Omitted.
ADDENDUM <Act No. 16021, Dec. 24, 2018>
This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions of Articles 44-4 and 44-7 (3) 1 shall enter into force three months after the date of its promulgation.