2-column view
ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.21305 | 20260707 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.21066 | 20251001 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20678 | 20250722 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20534 | 20250604 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20260 | 20240814 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20069 | 20240724 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.18871 | 20221211 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.18201 | 20211209 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.17358 | 20200910 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.17354 | 20201210 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.17348 | 20201210 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.17347 | 20200609 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.17344 | 20201210 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.16955 | 20200805 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.16825 | 20200611 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.16021 | 20190325 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.16019 | 20190625 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.15751 | 20190319 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.15628 | 20181213 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.14839 | 20170726 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.14580 | 20170314 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.14080 | 20160923 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13520 | 20160602 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13344 | 20151223 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13343 | 20151223 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13280 | 20150327 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13014 | 20150421 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.12844 | 20141119 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.12681 | 20140528 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.11690 | 20130323 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.11322 | 20120818 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.10560 | 20110706 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.10465 | 20110930 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.10166 | 20100923 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.10165 | 20100923 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.10138 | 20100317 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.9637 | 20090723 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.9119 | 20081214 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.8867 | 20080322 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.8852 | 20080322 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.8778 | 20080322 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.8486 | 20080526 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.8289 | 20070727 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.8031 | 20061004 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.8030 | 20070105 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.7917 | 20060625 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.7812 | 20060331 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.7796 | 20060701 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.7262 | 20050331 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.7142 | 20040730 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.7139 | 20040129 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.6797 | 20030119 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.6585 | 20020401 |
| ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.6360 | 20010701 |
| ACT ON PROMOTION OF UTILIZATION OF INFORMATION AND COMMUNICATIONS NETWORK | No.5986 | 19990701 |
| ACT ON PROMOTION OF UTILIZATION OF INFORMATION AND COMMUNICATIONS NETWORK | No.5835 | 19990701 |
| ACT ON EXPANSION OF DISSEMINATION AND PROMOTION OF UTILIZATION OF INFORMATION SYSTEM | No.5219 | 19970131 |
| ACT ON EXPANSION OF DISSEMINATION AND PROMOTION OF UTILIZATION OF INFORMATION SYSTEM | No.4998 | 19960307 |
| ACT ON EXPANSION OF DISSEMINATION AND PROMOTION OF UTILIZATION OF INFORMATION SYSTEM | No.4969 | 19960101 |
| ACT ON EXPANSION OF DISSEMINATION AND PROMOTION OF UTILIZATION OF INFORMATION SYSTEM | No.4528 | 19930609 |
| ACT ON EXPANSION OF DISSEMINATION AND PROMOTION OF UTILIZATION OF INFORMATION SYSTEM | No.4439 | 19911214 |
| ACT ON EXPANSION OF DISSEMINATION AND PROMOTION OF UTILIZATION OF INFORMATION SYSTEM | No.4393 | 19911211 |
| ACT ON EXPANSION OF DISSEMINATION AND PROMOTION OF UTILIZATION OF INFORMATION SYSTEM | No.3848 | 19870101 |
CHAPTER I GENERAL PROVISIONS
| Article 1 (Purpose) |
The purpose of this Act is to contribute to improving citizens’ lives and enhancing public welfare by facilitating utilization of information and communications networks, protecting personal information of people using information and communications services, and developing an environment in which people can utilize information and communications networks in a healthier and safer way.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 2 (Definitions) |
| (1) | The definitions of terms used in this Act shall be as follows: <Amended by Act No. 7139, Jan. 29, 2004; Act No. 8289, Jan. 26, 2007; Act No. 8778, Dec. 21, 2007; Act No. 9119, Jun. 13, 2008; Act No. 10166, Mar. 22, 2010; Act No. 12681, May 28, 2014; Act No.13343 Jun. 22, 2015> |
| 1. | The term "information and communications network" means an information and communications system for collecting, processing, storing, searching, transmitting or receiving information by using telecommunications facilities and equipment prescribed in subparagraph 2 of Article 2 of the Telecommunications Business Act or computers and applied computer technology; |
| 2. | The term "information and communications services" means the telecommunications services prescribed in subparagraph 6 of Article 2 of the Telecommunications Business Act and services of providing information or intermediating the provision of information by using such telecommunications services; |
| 3. | The term "providers of information and communications services" means the telecommunications business operators prescribed in subparagraph 8 of Article 2 of the Telecommunications Business Act and other persons who provide information or intermediate to provide information commercially by utilizing services provided by a telecommunications business operator; |
| 4. | The term "users" means persons who use information and communications services rendered by providers of information and communications services; |
| 5. | The term "electronic document" means data prepared and transmitted, received, or stored electronically in a standardized document by a device capable of processing information, such as a computer; |
| 6. | The term "personal information" means the information pertaining to an individual alive, which contains information identifying a specific person with a name, a national identification number, or similar in the form of a code, letters, voice, sound, motion picture, or any other form (including information that makes it impracticable to identify a specific person by itself, but that enables to identify such person easily if combined with another information); |
| 7. | The term "intrusion" means an event resulting from an attack on an information and communications network or an information system related to such network by means of hacking, computer virus, logic bomb, mail bomb, denial of service, high-power electromagnetic wave, etc.; |
| 8. | Deleted.; <by Act No.13343 Jun. 22, 2015> |
| 9. | The term "message board" means, regardless of its name, a computer program or a technical device with which users can publish information in the form of a code, letters, voice, sound, image, motion picture, or any other form purposely to disclose the information to the public by using an information and communications network; |
| 10. | The term "telecommunications billing services" means information and communications services to perform the following business activities: |
| (a) | Business activities of charging and collecting prices for goods or services sold or provided by a third person (hereinafter referred to as "goods or services") together with charges for the telecommunications services provided; |
| (b) | Business activities of transmitting and receiving information of transactions electronically so that prices for goods or services sold or provided by a third person can be billed or collected together with charges for the telecommunications services provided by oneself, or settling, on behalf of another person, or intermediating payments for such prices; |
| 11. | The term "provider of telecommunications billing services" means a person who provides telecommunications billing services after being registered under Article 53; |
| 12. | The term "user of telecommunications billing services" means a person who purchases or uses goods or services by using telecommunications billing services rendered by a provider of telecommunications billing services; |
| 13. | The term "electronic transmission medium" means a medium transmitting codes, letters, voices, images or motion pictures to addressees in an electronic form, such as an electronic document, via information and communications networks. |
| (2) | Except as otherwise provided for in paragraph (1), definitions of terms used in this Act shall be governed by the Framework Act on National Informatization. <Amended by Act No. 9119, Jun. 13, 2008; Act No. 11690, Mar. 23, 2013> |
| Article 3 (Responsibilities of Providers and Users of Information and Communications Services) |
| (1) | Every provider of information and communications services shall contribute to protection of rights and interests of users and enhancement of users’ abilities to use information by protecting personal information of users and providing information and communications services in a sounder and safer way. |
| (2) | Every user shall make efforts to help to establish a healthier information society. |
| (3) | The Government may provide support to organizations composed of providers or users of information and communications services for their activities for protecting personal information and protecting juvenile in information and communications networks. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 4 (Preparation of Policy on Promotion of Utilization of Information and Communications Networks and Protection of Information) |
| (1) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission shall prepare policies to lay a foundation for an information society through the promotion of utilization of information and communications networks, the stable management and operation of such networks, the protection of personal information of users, and other related activities (hereinafter referred to as "promotion of utilization of information and communication networks, the protection of information, or other related matters"). <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (2) | The policies under paragraph (1) shall contain descriptions of the following: |
| 1. | Development and dissemination of technology related to the information and communications networks; |
| 2. | Standardization of information and communications networks; |
| 3. | Promotion of the use of information and communications networks, including the development of content of information and applied service for information and communications networks under Article 11; |
| 4. | Facilitation of sharing information through information and communications networks; |
| 5. | Promotion of use of internet; |
| 6. | Protection of personal information collected, processed, stored and used via information and communications networks, and development and dissemination of technology related thereto; |
| 7. | Protection of juvenile in information and communications networks; |
| 8. | Enhancement of safety and reliability of information and communications networks; |
| 9. | Other matters necessary for the promotion of utilization of information and communications networks, the protection of information, or other related matters. |
| (3) | When the Minister of Science, ICT and Future Planning or the Korea Communications Commission prepares the policy under paragraph (1), he/she shall ensure that the policy conforms to the basic plan for national informatization under Article 6 of the Framework Act on National Informatization. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 5 (Relationship to Other Acts) |
Except as otherwise provided for in any other Act, the promotion of use of information and communications networks, the protection of information, or other related matters shall be governed by the provisions of this Act: Provided , That this Act shall take precedence over the Electronic Financial Transaction Act, in cases where a provision of this Act and a provision of the Electronic Financial Transaction Act are applicable to the telecommunications billing service under Chapter VII.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
CHAPTER II PROMOTION OF UTILIZATION OF INFORMATION AND COMMUNICATIONS NETWORK
| Article 6 (Development of Technology) |
| (1) | The Minister of Science, ICT and Future Planning may engage the relevant research institute, as prescribed by Presidential Decree, to implement a project for research and development, technical cooperation, transfer of technology, technical guidance, or similar, in order to promote the development of technology and equipment related to information and communications networks. <Amended by Act No. 11690, Mar. 23, 2013> |
| (2) | The Government may provide financial support to a research institute that implement a project for research and development or similar in accordance with paragraph (1) for all or part of the cost and expenses incurred in such project. |
| (3) | Necessary matters concerning the disbursement and management of cost and expenses under paragraph (2) shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 7 (Management and Dissemination of Technology-Related Information) |
| (1) | The Minister of Science, ICT and Future Planning shall manage, systematically and comprehensively, the information pertaining to technology and equipment related to information and communications networks (hereafter referred to as "technology-related information" in this Article). <Amended by Act No. 11690, Mar. 23, 2013> |
| (2) | The Minister of Science, ICT and Future Planning may, if necessary for managing technology-related information systematically and comprehensively, request data relevant to technology-related information from the relevant administrative agency and a national or public research institute. In such cases, the head of such agency or institute shall, upon such request, comply with the request, unless any particular reason exists. <Amended by Act No. 11690, Mar. 23, 2013> |
| (3) | The Minister of Science, ICT and Future Planning shall perform projects for dissemination of technology-related information, so that technology-related information can be used promptly and easily. <Amended by Act No. 11690, Mar. 23, 2013> |
| (4) | Necessary matters concerning the scope of technology and equipment related to information and communications networks, which shall be disseminated pursuant to paragraph (3), shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 8 (Standardization and Certification of Information and Communications Networks) |
| (1) | The Minister of Science, ICT and Future Planning shall establish and provide a public notice the standards for information and communications networks in order to promote the use of information and communications networks, and may recommend providers of information and communication services or the persons who manufacture or supply products related to information and communications networks to comply with the standards: |
| (2) | A person who manufactures or supplies a product related to information communications in conformity with the standards publicly notified pursuant to paragraph (1) may put on the product a mark stating that the product conforms to the standards, subject to the prior certification of the certifying institution under Article 9 (1). |
| (3) | In cases where a product falls under the proviso to paragraph (1) and the certification under Article 15 of the Industrial Standardization Act has been already given to the product, the product shall be deemed to have been certified pursuant to paragraph (2). |
| (4) | No person but those who hold the certification under paragraph (2) may put a mark verifying that his/her product conforms to the standards or put any similar mark, nor may sell a product with any similar mark or display such a product for the purpose of sale. |
| (5) | The Minister of Science, ICT and Future Planning may order a person, who sells a product in violation of paragraph (4) or displays such a product for the purpose of sale to collect and recall the product or to obtain certification to put such a mark, or may take any other corrective measure as may be necessary. <Amended by Act No. 11690, Mar. 23, 2013> |
| (6) | Necessary matters concerning the subject matters of the standardization, the method and procedure for such standardization, and a mark of certification under paragraphs (1) through (3), and the collection, recall, corrective measures, etc. under paragraph (5) shall be prescribed by Ministerial Decree of Science, ICT and Future Planning. <Amended by Act No. 11690, Mar. 23, 2013> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 9 (Designation of Certifying Institutions) |
| (1) | The Minister of Science, ICT and Future Planning may designate an institution to certify products related to information and communications networks (hereinafter referred to as a "certifying institution"), which are manufactured or supplied by a person, and conforming to the standards publicly notified pursuant to the main sentence of Article 8 (1). <Amended by Act No. 11690, Mar. 23, 2013> |
| (2) | The Minister of Science, ICT and Future Planning may, if a certifying institution falls under any of the following subparagraphs, revoke the designation or give an order of business suspension for a prescribed period of time not exceeding six months: |
| 1. | If the institution is designated by fraud or other improper means; |
| 2. | If the institution has not continued its certification service for one year or longer without a justifiable reason; and |
| 3. | If the institution fails to meet the standards for designation under paragraph (3). |
| (3) | Necessary matters concerning the standards and procedures for designation under paragraph (1) and, the criteria for revocation of designation and for business suspension of a certifying institution under paragraph (2), and other related matters shall be prescribed by Ministerial Decree of Science, ICT and Future Planning. <Amended by Act No. 11690, Mar. 23, 2013> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 10 (Support for Development of Content of Information) |
With an aim of securing national competitiveness and enhancing the public interest, the Government may provide financial and technical support, or otherwise, to the persons who develop content of information distributed through information and communications networks.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 11 (Acceleration of Development of Applied Services for Information and Communications Networks) |
| (1) | The Government may provide financial and technical support, or otherwise as may be necessary, to any State agency, local government, public institution that develops and operates applied services for improving efficiency in processing its business affairs or automatizing or upgrading process of its business affairs by utilizing information and communications network (hereinafter referred to as "applied services for information and communications networks"). |
| (2) | The Government may provide financial and technical support, or otherwise as may be necessary, to private sector with an aim of facilitating the development of applied services for information and communications networks by private sector and shall take the following measures for nurturing technical human resources necessary to develop applied services for information and communications networks: |
| 1. | Support for internet education conducted by schools in various levels and other educational institutions; |
| 2. | Extension of internet education for citizens; |
| 3. | Support for projects to cultivate technical human resources specializing in information and communications networks; |
| 4. | Establishment of and support for institutions to cultivate technical human resources specializing in information and communications networks; |
| 5. | Support for development and dissemination of educational programs for utilizing information and communications networks; |
| 6. | Support for establishment of the technical qualification system related to information and communications networks and support for supply of technical human resources specializing in information and communications networks on demand; |
| 7. | Other matters necessary for cultivate technical human resources related to information and communications networks. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 12 (Establishment of System for Sharing Information) |
| (1) | The Government may encourage to build up a system for sharing information through linked operation and standardization of information and communications networks or in any other way so that the networks can be made efficient use of. |
| (2) | The Government may provide financial and technical support, or otherwise as may be necessary, to any person who builds up a system for sharing information under paragraph (1). |
| (3) | Necessary matters concerning the encouragement and support under paragraphs (1) and (2) shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 13 (Projects for Promoting Use of Information and Communications Networks) |
| (1) | The Minister of Science, ICT and Future Planning may implement projects designed to promote efficient use and dissemination of technology, equipment, and applied services related to information and communications networks, as prescribed by Presidential Decree, in order to promote the use of information and communications networks in various areas of public service, local communities, industry, life, and social welfare and eliminate gaps in accessibility to information. <Amended by Act No. 11690, Mar. 23, 2013> |
| (2) | The Government may provide financial and technical support, or otherwise as may be necessary, to the persons who participate in the projects under paragraph (1). |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 14 (Proliferation of Internet) |
The Government shall induce public and private sectors to use internet facilities available in public and private sectors so that internet can be proliferated, expand the user base for internet through education and public relations activities on internet, and prepare and enforce a policy to eliminate gaps in accessibility to internet between localities, genders, and ages.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 15 (Improvement of Quality of Internet Service) |
| (1) | The Minister of Science, ICT and Future Planning shall prepare and enforce a policy to protect rights and interests of users of internet service and to ensure improvement of quality of internet service and stable availability of internet service. <Amended by Act No. 11690, Mar. 23, 2013> |
| (2) | The Minister of Science, ICT and Future Planning may, if deemed necessary for enforcing the policy under paragraph (1), prescribe and give a public notice of the standards for measuring and assessing the quality of internet service, hearing opinions of organizations of providers and users of information and communications services and others. <Amended by Act No. 11690, Mar. 23, 2013> |
| (3) | Every provider of information and communications services may voluntarily assess the current status of quality of his/her own internet service in accordance with the standards under paragraph (2) and notify the results thereof to users. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Articles 16 and 17 Deleted. <by Act No. 7142, Jan. 29, 2004> |
CHAPTER III DELETED
| Articles 18 through 21 Deleted. <by Act No.13343 Jun. 22, 2015> |
CHAPTER IV PROTECTION OF PERSONAL INFORMATION
Section 1 Collection, Use, and Provision of Personal Information
| Article 22 (Consent to Collection and Use of Personal Information) |
| (1) | A provider of information and communications services shall, whenever he/she intends to collect personal information of a user purposely to use it, notify the user of the following matters and obtain consent from the user. The same shall apply in cases where he/she intends to change any of the following matters: |
| 1. | Purposes of collection and use of the personal information; |
| 2. | Items of personal information that he/she intends to collect; |
| 3. | Period of time during which he/she intends to possess and use the personal information. |
| (2) | A provider of information and communications services may collect and use personal information of a user without the consent under paragraph (1) in any of the following cases: |
| 1. | If the personal information is necessary in fulfilling the contract for provision of information and communications services, but it is obviously difficult to get consent in an ordinary way due to any economic or technical reason; |
| 2. | If it is necessary in paying charges on the information and communication services rendered; |
| 3. | If a specific provision exists in this Act or any other Act otherwise. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 22-2 (Consent to Access Authority) |
| (1) | Where a provider of information and communications services needs authority to access (hereinafter referred to as “access authority”) information stored and functions installed in mobile devices of users in order to provide the relevant services, the provider shall inform users of the following matters so that users may clearly recognize such matters, and shall obtain consent of users: |
| 1. | In the case of access authority certainly necessary to provide the relevant services: |
| (a) | Items of the information and functions for which access authority is necessary; |
| (b) | Ground that access authority is necessary. |
| 2. | In the case of access authority not certainly necessary to provide the relevant services: |
| (a) | Items of the information and functions for which access authority is necessary; |
| (b) | Ground that access authority is necessary; |
| (c) | Fact that users may give no consent to the permission on access authority. |
| (2) | No provider of information and communications services shall refuse to provide the relevant services to users on the ground that the users give no consent to the establishment of access authority not certainly necessary to provide the relevant services. |
| (3) | The persons manufacturing and providing a basic operating system (referring to an operating environment in which softwares installed in mobile devices can be run) of mobile devices, the manufacturers of mobile devices, and the persons manufacturing and providing a software for mobile devices shall take measures necessary for protecting users’ information, such as devising methods for users to give or revoke consent to access authority where the provider of information and communications services intends to access the information stored and functions installed in mobile devices. |
| (4) | The Scope of, and methods for consenting to, access authority referred to in paragraph (1), measures necessary for protecting users’ information referred to in paragraph (3), and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Added by Act No. 14080, Mar. 22, 2016]
| Article 23 (Restrictions on Collection of Personal Information) |
| (1) | No provider of information and communications services may collect personal information regarding any person, such as his/her ideology, beliefs, family relationship status, kinship and matrimonial relationship, educational background, and medical history, which is anticipated to otherwise infringe seriously upon any right, interest, or privacy of the person: |
| (2) | Where a provider of information and communications services collects personal information of a user, he/she shall only collect personal information within the minimum scope necessary to provide information and communications services. <Amended by Act No. 12681, May 28, 2014> |
| (3) | No provider of information and communications services shall refuse to provide such services on the ground that a user does not provide personal information other than the minimum personal information required. In such cases, the minimum personal information required means information that is specifically required to perform essential functions of the relevant services. <Added by Act No. 12681, May 28, 2014> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 23-2 (Restriction on Use of Resident Registration Numbers) |
| (1) | Other than the cases falling under any of the following subparagraphs, a provider of information and communications services may not collect/use users’ resident registration numbers: <Amended by Act No. 10560, Apr. 5, 2011> |
| 1. | Where the provider is designated as the identification service agency pursuant to Article 23-3; |
| 2. | Where collection/use of users’ resident registration numbers is authorized by statutes; |
| 3. | Where the Korea Communications Commission makes a public announcement for the provider of information and communications services who inevitably collects/uses users’ resident registration numbers for his/her business purposes. |
| (2) | Even where the collection/use of users’ resident registration numbers is authorized pursuant to paragraph (1) 2 or 3, an identification method without using the users’ resident registration numbers (hereinafter referred to as “alternative means”) shall be provided. |
[Wholly Amended by Act No. 11322, Feb. 17, 2012]
| Article 23-3 (Designation of Identification Service Agency, etc.) |
| (1) | The Korea Communications Commission may, after reviewing each item of the following subparagraphs, designate a person as an identification service agency who is deemed competent to safely and reliably perform the affairs of development, provision and administration of the alternative means (hereinafter referred to as “identification service”): |
| 1. | A plan for physical/technological/administrative measures in order to secure safety of the identification service; |
| 2. | Technological/financial capability necessary for performing the identification service; |
| 3. | Appropriateness of the scale of facilities relevant to the identification service. |
| (2) | When the identification service agency intends to suspend all or part of identification service, it shall determine and notify a suspension period to the users no later than 30 days prior to the intended date of suspension and shall report the same to the Korea Communications Commission. In this case, the suspension period shall not exceed six months. |
| (3) | When the identification service agency intends to discontinue the identification affairs, it shall notify the intention to the users no later than 60 days prior to the intended date of discontinuation and shall report the same to the Korea Communications Commission. |
| (4) | Necessary matters concerning the criteria for each standard subject to the review and the designation procedure of identification service agency under paragraph (1), suspension or discontinuation of the identification affairs under paragraphs (2) and (3) and other matters shall be determined by Presidential Decree. |
[This Article Added by Act No. 10560, Apr. 5, 2011]
| Article 23-4 (Suspension of Identification Service and Cancelation of Designation of Identification Service Agency) |
| (1) | When the identification service agency falls under any of the following subparagraphs, the Korea Communications Commission may determine the period of suspension within six months and order suspension of all or part of the identification service, or cancel designation of identification service agency: |
| 1. | Where an identification service agency is designated by falsity or other fraudulent methods; |
| 2. | Where a person who has received the order for suspension of identification service fails to suspend the affairs in violation of the order; |
| 3. | Where a person fails to start the identification service within six months from the date of being designated, or suspend the service continuously for six months or more; |
| 4. | Where it becomes not suitable for the standard of designation pursuant to Article 23-3 (4). |
| (2) | Standards and procedures for any dispositions pursuant to paragraph (1) and other necessary matters shall be determined by Presidential Decree. |
[This Article Added by Act No. 10560, Apr. 5, 2011]
| Article 24 (Restriction on Use of Personal Information) |
No provider of information and communications services may use personal information collected in accordance with Article 22 and the proviso to Article 23 (1) for any purpose other than the purpose consented by the relevant user or the purpose specified in any subparagraph of Article 22 (2).
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 24-2 (Consent to Provision of Personal Information) |
| (1) | Every provider of information and communications services shall, whenever he/she intends to furnish a third party with personal information of a user, notify the user of all the following matters and obtain consent from the user, except as provided for in Article 22 (2) 2 and 3. The same shall apply in cases where there is a change in any of the following matters: |
| 1. | The person to whom the personal information is furnished; |
| 2. | Purposes of use of the personal information of the person to whom the personal information is furnished; |
| 3. | Items of the personal information furnished; |
| 4. | Period of time during which the person to whom the personal information is furnished will possess and use the personal information. |
| (2) | A person who received any personal information of a user from a provider of information and communications services in accordance with paragraph (1) shall not furnish the personal information to a third party or use it for any purpose other than the purpose originally agreed upon at the time when the information was furnished without consent of the user or a specific provision otherwise specified in any other Act. |
| (3) | When the provider, etc. of information and communications services under Article 25 (1) is given the consent to furnishing user’s information under paragraph (1) and to the entrustment of management of personal information under Article 25 (1), he/she shall obtain such consent apart from the consent to collection/use of personal information pursuant to Article 22, and shall not refuse to provide its service on the ground of a user’s refusal of aforementioned consent. <Added by Act No. 10560, Apr. 5, 2011; Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 25 (Entrustment of Management of Personal Information) |
| (1) | A provider of information and communications services or a person who received personal information of users from the provider of information and communications services in accordance with Article 24-2 (1) (hereinafter referred to as a "provider of information and communications services or similar") shall, if he/she intends to entrust a third party with handling of business affairs related to personal information (hereinafter referred to as "entrustment of management of personal information") so as to collect, create, connect, link, record, save, hold, process, edit, search, print, correct, recover, use, provide, disclose, destruct or treat similarly users’ personal information (hereinafter referred to as "management"), notify the users of all the following matters and shall obtain consent of the users. The same shall apply in cases where there exists a change in any of the following matters: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Any person to whom the management of personal information is entrusted (hereinafter referred to as a "trustee"); |
| 2. | Details of the business affairs subject to the entrustment of management of personal information. |
| (2) | A provider of information and communications services or similar may omit the procedures for notification and consent under paragraph (1) for entrusting the management of personal information, where the personal information is required to comply with the contract on the provision of the information and communications services and enhance convenience of users and where all the matters prescribed in subparagraphs of paragraph (1) have been disclosed to the public under Article 27-2 (1) or notified to users in a manner prescribed by Presidential Decree, such as by electronic mails. The same shall apply where there exists a change in a matter prescribed in any subparagraph of paragraph (1). <Amended by Act No. 12681, May 28, 2014; Act No. 14080, Mar. 22, 2016> |
| (3) | A provider of information and communications services or similar shall, when he/she entrusts the management of personal information to a third party, define the scope of purposes, in advance, within which the trustee is allowed to manage personal information of users, and the trustee shall not manage the personal information of users beyond the scope of purposes. <Amended by Act No. 14080, Mar. 22, 2016> |
| (4) | A provider of information and communications services or similar shall control, supervise and educate the trustee to ensure that the trustee does not violate any provision of this Chapter. <Amended by Act No. 14080, Mar. 22, 2016> |
| (5) | If the trustee violates any provision of this Chapter in connection with the business affairs related to the entrustment of management of personal information and inflicts damages upon a user, the trustee shall be deemed an employee of the provider of information and communications services or similar in determining liability for such damages. <Amended by Act No. 14080, Mar. 22, 2016> |
| (6) | A provider, etc. of information and communications shall, when entrusting a trustee with management of personal information, do so in writing. <Added by Act No. 14080, Mar. 22, 2016> |
| (7) | A trustee may re-entrust a third party with affairs entrusted pursuant to paragraph (1) only where the trustee obtains consent from the provider, etc. of information and communications services. <Added by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 26 (Transfer of Personal Information Following Transfer of Business) |
| (1) | Where a provider of information and communications services or similar transfers personal information of users to a third party due to transfer of business, in whole or in part, merger, or any similar cause, he/she shall notify the users of all the following matters by publishing them on its internet homepage or by electronic mail or any other means specified by Presidential Decree: |
| 1. | The fact that the personal information is to be transferred; |
| 2. | The name (referring to the name of a legal corporation, if the person is a legal corporation; hereafter the same shall apply in this Article), address, and telephone number of a person to whom the personal information is to be transferred (hereinafter referred to as a "transferee of business or similar"), and other contact information of the person; |
| 3. | The methods and procedures available for revocation of consent, where a user does not want his/her personal information transferred to a third party. |
| (2) | If any personal information is transferred to a transferee of business, etc., he/she shall immediately notify the users of such fact and his/her name, domicile, telephone number and other contact details according to methods prescribed by Presidential Decree, such as the posting of such information on the Internet homepage or email. <Amended by Act No. 12681, May 28, 2014> |
| (3) | A transferee of business or similar may use or furnish personal information only within the scope of purposes originally defined for which any provider of information and communications services or similar uses or furnishes the personal information of users: |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 26-2 (Method Applicable in Obtaining Consent) |
The method applicable in obtaining the consent under Article 22 (1), the proviso to Article 23 (1), Article 24-2 (1) or (2), Article 25 (1), the proviso to Article 26 (3), or Article 63 (2) (hereinafter referred to as "consent to collection, use, provision, and similar disposition of personal information") shall be prescribed by Presidential Decree, considering media for collection of personal information, peculiarities of each type of business, number of users, and other related factors.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
Section 2 MANAGEMENT, DESTRUCTION, ETC. OF PERSONAL INFORMATION
| Article 27 (Designation of Person Responsible for Management of Personal Information) |
| (1) | Every provider of information and communications services or similar shall designate a person responsible for protection of personal information so that he/she protects the personal information of users and process complaints from users in connection with the personal information: |
| (2) | If a provider of information and communications services or similar does not designate a person responsible for protection of personal information under the proviso to paragraph (1), the business owner or representative of the provider or similar shall be the person responsible for protection of personal information. <Amended by Act No. 14080, Mar. 22, 2016> |
| (3) | The qualification requirements for a person responsible for protection of personal information and other matters necessary for designation of such person shall be prescribed by Presidential Decree. <Amended by Act No. 14080, Mar. 22, 2016> |
| (4) | Where a person responsible for protection of personal information becomes aware of a fact of violation of this Act or other relevant statute, he/she shall take measures for improvement immediately, and if necessary, report the measures for improvement to the business owner or representative of the provider, etc. of information and communications services: |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 27-2 (Public Disclosure of Policy on Managing Personal Information) |
| (1) | Every provider of information and communications services or similar shall, when he/she manages personal information of users, establish and disclose its policy on managing personal information to the public in a manner specified by Presidential Decree so that users become aware of the policy easily at any time. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | The policy on managing personal information under paragraph (1) shall include descriptions of all the following matters: <Amended by Act No. 11322, Feb. 17, 2012; Act No. 14080, Mar. 22, 2016> |
| 1. | Purposes of collection and use of personal information, items of personal information collected, and methods of collection; |
| 2. | The name of the person (referring to the name of a legal entity, if the person is a legal entity) to whom personal information is furnished, if the personal information is furnished to a third party, purposes of use of the person to whom the personal information is furnished, and items of the personal information furnished; |
| 3. | The period of time during which the personal information is possessed and used, and the procedure and method for destruction of the personal information (including the ground for preservation and items of preserved personal information, if it is required to preserve the personal information in accordance with the proviso to the part above subparagraphs of Article 29 (1)); |
| 4. | Details of business affairs subject to the entrustment of management of personal information and the trustee (they shall be included in the policy on management, only where this subparagraph is applicable); |
| 5. | Rights of users and their legal representatives and methods for the exercise of such rights; |
| 6. | Matters concerning installation, operation, and denial of a device that collect personal information automatically, such as an information file for access to internet; |
| 7. | The name and address of the person responsible for protection of personal information or the department responsible for business affairs related to the protection of personal information and processing related complaints and other contact information of such person or department. |
| (3) | Every provider of information and communications services or similar shall, when he/she revises the policy on managing personal information under paragraph (1), give public notice of the reasons for and details of such revision without delay in a manner specified by Presidential Decree, and take measures to make users aware of the details of the revision easily at any time. <Amended by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 27-3 (Notification/Reports on Leakage of Personal Information) |
| (1) | When a provider of information and communications services or similar becomes aware of the loss, theft, or leakage of personal information (hereinafter referred to as “leakages, etc.”), he/she shall immediately inform the relevant users of all the following matters and report to the Korea Communications Commission or the Korea Internet Security Agency, and shall not notify or report them after 24 hours have elapsed since he/she became aware of such fact without any justifiable cause: |
| 1. | Each item of the personal information leaked; |
| 2. | Point of time the personal information is leaked; |
| 3. | Measures available for users to take; |
| 4. | Countermeasures to be taken by a provider of information and communications services or similar; |
| 5. | Responsible departments and contact information to be used for the users who seek consultations, etc., to submit their application for such consultations. |
| (2) | The Korea Internet Security Agency in receipt of a report under paragraph (1) shall immediately inform the Korea Communications Commission of such fact. <Added by Act No. 12681, May 28, 2014> |
| (3) | A provider of information and communications services, etc. shall explain just cause under the main sentence of and proviso to paragraph (1) to the Korea Communications Commission. <Added by Act No. 12681, May 28, 2014> |
| (4) | Matters necessary for methods and procedures, etc., for the notification and report pursuant to paragraph (1) shall be prescribed by Presidential Decree. |
| (5) | A provider of information and communications services, etc. shall prepare countermeasures against the leakages, etc. of personal information, and shall seek measures to minimize any damage thereof. <Amended by Act No. 14080, Mar. 22, 2016> |
[This Article Added by Act No. 11322, Feb. 17, 2012]
| Article 28 (Protective Measures for Personal Information) |
| (1) | Every provider of information and communications services or similar shall, when he/she manages personal information of users, take the following technical and administrative measures in accordance with the guidelines prescribed by Presidential Decree to prevent loss, theft, leakage, forgery or alteration of or damage to personal information and secure the safety of personal information: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Establishment and implementation of an internal control plan for managing personal information in a safe way; |
| 2. | Installation and operation of an access control device, such as a system for blocking intrusion to cut off illegal access to personal information; |
| 3. | Measures for preventing fabrication and alteration of access records; |
| 4. | Measures for security by using encryption technology and other methods for safe storage and transmission of personal information; |
| 5. | Measures for preventing intrusion of computer viruses, including installation and operation of vaccine software; |
| 6. | Other protective measures necessary for securing safety of personal information. |
| (2) | Every provider of information and communications services or similar shall restrict the persons who may manage users' personal information to the minimum extent. <Amended by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 28-2 (Prohibition on Disclosure of Personal Information) |
| (1) | A person who manages or has ever manages personal information of users shall not damage, intrude on, or disclosed personal information that he/she learned in the course of performing his/her duty. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | No one shall be knowingly provided with any disclosed personal information for profit or any unlawful purpose. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 29 (Destruction of Personal Information) |
| (1) | A provider of information and communications services or similar shall, if any of the followings occurs, destroy the relevant personal information without delay so that such personal information cannot be recovered or reproduced: |
| 1. | When the purpose of collection and use of personal information with consent obtained in accordance with Article 22 (1), the proviso to Article 23 (1), or Article 24-2 (1) or (2) or the purpose under any subparagraph of Article 22 (2) has been achieved; |
| 2. | When a period during which it is allowed to possess and use personal information with consent obtained in accordance with Article 22 (1), the proviso to Article 23 (1), or Article 24-2 (1) or (2) ends; |
| 3. | When a period during which it is allowed to possess and use personal information in accordance with Article 27-2 (2) 3 ends, if the personal information has been collected and used without consent of users under Article 22 (2); |
| 4. | When the business is permanently closed down. |
| (2) | The provider of information and communications services or similar shall, in an effort to protect personal information of the users who do not use information and communications services for a period of one year, take necessary measures, such as destruction of personal information, as prescribed by Presidential Decree: |
| (3) | The provider, etc. of information and communications services shall notify , until 30 days before expiration of the period under paragraph (2), the users of the matters prescribed by Presidential Decree such as the fact that the personal information will be destroyed, the expiration date of the period and items of personal information subject to destruction, in a manner prescribed by Presidential Decree such as by email. <Added by Act No. 13520, Dec. 1, 2015> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
Section 3 Rights of Users
| Article 30 (Rights of Users) |
| (1) | Every user may, at any time, revoke his/her consent given to a provider of information and communications services or similar to allow the provider to collect, use, or furnish his/her personal information. |
| (2) | Every user may request a provider of information and communications services or similar to allow him/her to peruse, or to furnish with any of the following subparagraphs, and may also require the provider to correct an error, if there is any error: |
| 1. | Personal information of the user, which the provider of information and communications services or similar possesses; |
| 2. | Details of which the provider of information and communications services or similar has used personal information of the user or furnished it to a third party; |
| 3. | Details of which the user has given a consent to he provider of information and communications services or similar to collect, use, or furnish his/her personal information. |
| (3) | If a user withdraws his/her consent pursuant to paragraph (1), a provider of information and communications services, etc. shall immediately take necessary measures, such as the destruction of collected personal information in an irrecoverable or in unreproducible way. <Amended by Act No. 12681, May 28, 2014> |
| (4) | A provider of information and communications services or similar shall, in receipt of a request to peruse or furnish matters in accordance with paragraph (2), take necessary measures without delay. |
| (5) | A provider of information and communications services or similar shall, in receipt of a request for correction of an error in accordance with paragraph (2), correct the error, notify the user of the reasons why it is unable to correct the error, if it is the case, or take any other necessary measures, and may not use the relevant personal information or furnish it to a third party until he/she completes taking such measures: |
| (6) | A provider of information and communications services or similar shall make how to revoke consent under paragraph (1), how to request to peruse personal information or furnish such information under paragraph (2), and how to request correction of an error, easier than how to collect personal information. |
| (7) | Paragraphs (1) through (6) shall apply |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 30-2 (Notification of Details of Use of Personal Information) |
| (1) | A provider of information and communications services or similar falling under the standards determined by Presidential Decree shall periodically notify the users of the details of using personal information of such users (including details of the provision under Article 24-2 and of the entrustment of management of personal information under Article 25) in accordance with Article 22 and the proviso to Article 23 (1): |
| (2) | Types of personal information to be notified to users, frequency and method of notifying the information pursuant to paragraph (1) and other matters necessary for notification of details of using such personal information shall be determined Presidential Decree. |
[This Article Added by Act No. 11322, Feb. 17, 2012]
| Article 31 (Rights of Legal Representative) |
| (1) | A provider of information and communications services or similar shall, if he/she desires to obtain consent of a child of less than 14 years on collection, use, furnishing, and other disposition of personal information, obtain consent from his/her legal representative. In such cases, the provider of information and communications services may demand the child to furnish minimum information, such as the legal representative’s name, necessary to obtain consent from the legal representative. |
| (2) | A legal representative may exercise rights of a user under Article 30 (1) and (2) with respect to personal information of the relevant child. |
| (3) | Article 30 (3) through (5) shall apply to a legal representative’s revocation of consent under paragraph (2) and his/her demand for perusal or correction of an error. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 32 (Compensation) |
| (1) | Where a user suffers any damage caused by a violation of any provision of this Chapter by a provider, etc. of information and communications services, he/she may claim compensation for damage against the said provider, etc. of information and communications services. In this case, that provider of information and communications services or similar shall not be exonerated from liability if failing to prove that there is neither intention nor gross negligence on the part of the said provider. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | Where any damage occurs to a user because personal information has been lost, stolen, leaked, forged, altered, or damaged due to intention or gross negligence on the part of the provider, etc. of information and communications services or similar, a court may determine the amount of compensation to the extent not exceeding three times the said damage: |
| (3) | Where a court determines the amount of compensation referred to in paragraph (2), it shall take the following matters into account: <Added by Act No. 14080, Mar. 22, 2016> |
| 1. | Degree of acknowledging the intention or the likeliness of the occurrence of damage; |
| 2. | Scale of damage sustained due to the relevant violation; |
| 3. | Economic benefits acquired by the provider, etc. of information and communications services by committing the relevant violation; |
| 4. | Fines and penalty surcharges due to violations; |
| 5. | Period, number, etc. of violations; |
| 6. | Status of assets of the provider, etc. of information and communications services; |
| 7. | Degree of efforts of the provider, etc. of information and communications services to withdraw the relevant personal information after the user’s personal information has been lost, stolen or leaked; |
| 8. | Degree of efforts of the provider, etc. of information and communications services to remedy damage to the user. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 32-2 (Claim for Statutory Damages) |
| (1) | Where a user falls under each of the following subparagraphs, he/she may claim resonable compensation not exceeding three million won as damages, in lieu of claiming damages under Article 32 from a provider of information and communications services, etc. within a period prescribed by Presidential Decree. In such cases, the relevant provider of information and communications services, etc. cannot be exempt from responsibility unless he/she proves that there is no intention or negligence: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Where the provider of information and communications services, etc. violates any of the provisions of this Chapter by intention or negligence; |
| 2. | Where personal information is lost, stolen, leaked, forged, altered or damaged. |
| (2) | Where a claim for compensation under paragraph (1) is filed, a court may acknowledge a reasonable amount of loss within the limits prescribed in paragraph (1), taking into account the relevance of all pleadings and the outcomes of examination of evidence. |
| (3) | A user claiming compensation for damage pursuant to Article 32 may change such claim to the claim referred to in paragraph (1) before the argument of the inquisition is closed. <Added by Act No. 14080, Mar. 22, 2016> |
[This Article Added by Act No. 12681, May 28, 2014]
| Article 32-3 (Deletion and Blocking of Exposed Personal Information) |
| (1) | A provider, etc. of information and communications services shall ensure that users’ personal information such as resident registration numbers, account numbers and credit cards information is not exposed to the public through information and communications networks. |
| (2) | Upon the request of the Korea Communications Commission or the Korea Internet and Security Agency, a provider, etc. of information and communications services shall take necessary measures such as deleting and blocking exposed personal information referred to in paragraph (1). |
[This Article Added by Act No. 14080, Mar. 22, 2016]
Section 4 Deleted.
| Articles 32-3 through 40 Deleted <by Act No. 10465, Mar. 29, 2011> |
CHAPTER V PROTECTION OF USERS IN INFORMATION AND COMMUNICATIONS NETWORKS
| Article 41 (Preparation of Policy on Protection of Juvenile) |
| (1) | The Korea Communications Commission shall prepare a policy on the following measures to protect juvenile from unwholesome information for juvenile (hereinafter referred to as "unwholesome information for juvenile"), such as information of obscenities and violence, circulated through information and communications networks: |
| 1. | Development and dissemination of content-screening software; |
| 2. | Development and dissemination of technology for protection of juvenile; |
| 3. | Education and public relations activities for protection of juvenile; |
| 4. | Other matters specified by Presidential Decree for protection of juvenile. |
| (2) | The Korea Communications Commission may, in an effort to implement the policy under paragraph (1), support activities conducted by the Korea Communications Standards Commission under Article 18 of the Establishment and Operation of the Korea Communications Commission Act (hereinafter referred to as the "Communications Standards Commission"), organizations of providers or users of information and communications services, and other relevant specialized institutions for protection of juvenile. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 42 (Labeling of Media Unwholesome for Juvenile) |
A person who provides information to the general public purposely to make it public through telecommunications services rendered by a telecommunications business operator (hereinafter referred to as "information provider") and who intends to provide any unwholesome medium for juvenile as defined in subparagraph 3 of Article 2 of the Juvenile Protection Act among the media under subparagraph 2 (e) of Article 2 of the aforesaid Act shall put a label indicating that the information is an unwholesome medium for juvenile by the labeling method specified by Presidential Decree. <Amended by Act No. 11048, Sep. 15, 2011>
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 42-2 (Prohibition on Advertisement of Unwholesome Media for Juvenile) |
No one may transmit, to a juvenile under subparagraph 1 of Article 2 of the Juvenile Protection Act, any information containing an advertisement of an unwholesome medium for juvenile as defined in subparagraph 3 of Article 2 of the aforesaid Act among the media under subparagraph 2 (e) of Article 2 of the aforesaid Act in the form of code, letter, voice, sound, image, or motion picture through an information and communications network or display such medium to the general public without taking any measure to restrict access by a juvenile. <Amended by Act No. 11048, Sep. 15, 2011>
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 42-3 (Designation of Person Responsible for Protection of Juvenile) |
| (1) | A provider of information and communications services whose the average number of users per day, sales, and other related factors fall under the criteria prescribed by Presidential Decree shall designate a person responsible for protection of juvenile to keep juvenile from unwholesome information to juvenile in the information and communication network. |
| (2) | The person responsible for protection of juvenile shall be chosen from among executive officers of the relevant business operator or the persons in a position equivalent to the head of a department responsible for business affairs related to protection of juvenile. |
| (3) | The person responsible for protection of juvenile shall block and control unwholesome information for juvenile in the information and communications network, and shall perform business affairs for protection of juvenile, including establishment of a plan for protection of juvenile from unwholesome information for juvenile. |
| (4) | Necessary matters concerning the designation of a person responsible for protection of juvenile under paragraph (1) shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 43 (Duty of Provider of Visual or Sound Information to Keep Information) |
| (1) | An information provider specified by Presidential Decree among those who engage in a business of providing unwholesome media for juvenile as defined in subparagraph 3 of Article 2 of the Juvenile Protection Act among the media under subparagraph 2 (e) of Article 2 of the aforesaid Act in a way to make it impossible to store or record the unwholesome media in a user's computer shall keep relevant information. <Amended by Act No. 11048, Sep. 15, 2011> |
| (2) | The period of time during which an information provider under paragraph (1) is obligated to keep relevant information shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44 (Protection of Rights in Information and Communications Network) |
| (1) | No user may circulate any information violative of other person's rights, including invasion of privacy and defamation, through an information and communications network. |
| (2) | Every provider of information and communications services shall make efforts to prevent any information under paragraph (1) from being circulated through the information and communications network operated and managed by it. |
| (3) | The Korea Communications Commission may prepare a policy on technological development, education, public relations activities, and other activities to prevent violation of other persons' rights by information circulated through information and communications networks, including invasion of privacy and defamation, and may recommend providers of information and communications services to adopt the policy. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12681, May 28, 2014> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-2 (Request for Deletion of Information) |
| (1) | Where information provided through an information and communications network purposely to be made public intrudes on other persons' privacy, defames other persons, or violates other persons' right otherwise, the victim of such violation may request the provider of information and communications services who managed the information to delete the information or publish a rebuttable statement (hereinafter referred to as "deletion or rebuttal"), presenting explanatory materials supporting the alleged violation. <Amended by Act No. 14080, Mar. 22, 2016> |
| (2) | A provider of information and communications services shall, upon receiving a request for deletion or rebuttal of the information under paragraph (1), delete the information, take a temporary measure, or any other necessary measure, and shall notify the applicant and the publisher of the information immediately. In such cases, the provider of information and communications services shall make it known to users that he/she has taken necessary measures by posting a public notification on the relevant message board or in any other way. |
| (3) | A provider of information and communications services shall, if there is any unwholesome medium for juvenile published in violation of the labeling method under Article 42 in the information and communications network operated and managed by him/her or if a content advertising any unwholesome medium for juvenile is displayed in such network without any measures to restrict access by juvenile under Article 42-2, delete such content without delay. |
| (4) | A provider of information and communications services may, if it is difficult to judge whether information violates any right or it is anticipated that there will probably be a dispute between interested parties, take a measure to block access to the information temporarily (hereinafter referred to as "temporary measures"), irrespective of a request for deletion of the information under paragraph (1). In such cases, the period of time for the temporary measure shall not exceed 30 days. |
| (5) | Every provider of information and communications services shall clearly state the details, procedure, and other matters concerning necessary measures in its standardized agreement in advance. |
| (6) | A provider of information and communications services may, if he/she takes necessary measures under paragraph (2) for the informations circulated through the information and communications network operated and managed by it, have its liability for damages caused by such informations mitigated or discharged. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-3 (Discretionary Temporary Measures) |
| (1) | A provider of information and communications services may, if it finds that information circulated through the information and communications network operated and managed by him/her intrudes on someone's privacy, defames someone, or violates someone's rights, take temporary measures at its discretion. |
| (2) | The latter part of Article 44-2 (2), the latter part of Article 44-2 (4), and Article 44-2 (5) shall apply |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-4 (Self Regulation) |
An organization of providers of information and communications services may establish and implement a code of conduct applicable to providers of information and communications services with an objective to protect users and render information and communications services in a safer and more reliable way.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-5 (Identity Verification of Users of Message Boards) |
| (1) | Any of the following persons shall, if he/she intends to install and operate a message board, take necessary measures, as prescribed by Presidential Decree (hereinafter referred to as "measures for identity verification"), including preparation of methods and procedures for verifying identity of users of the message board: |
| 1. | A State agency, local government, public enterprise, quasi-government agency under Article 5 (3) of the Act on the Management of Public Institutions, or a local government-invested public corporation or a local government public corporation under the Local Public Enterprises Act (hereinafter referred to as "public institution"); |
| 2. | Deleted. <by Act No. 12681, May 28, 2014> |
| (2) | Deleted.<by Act No. 12681, May 28, 2014> |
| (3) | The Government shall prepare a policy to develop a safer and more reliable system to verify identity of users under paragraph (1). |
| (4) | A public institution, etc. may have its liability for damages caused by fraudulent use of a user's identity by a third party mitigated or discharged, if it has taken the measures for identity verification under paragraph (1) with care as a good manager. <Amended by Act No. 12681, May 28, 2014> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-6 (Claim to Furnish User's Information) |
| (1) | A person who alleges that information published or circulated by a specific user has intruded on his/her privacy, defamed him/her, or violated his/her rights may file a claim with the defamation dispute conciliation division under Article 44-10 to demand the relevant provider of information and communications services to furnish the information he/she possesses about the alleged offender (referring to the minimum information specified by Presidential Decree, including the name and address, necessary for filing a civil or criminal complaint), along with materials supporting his/her allegation of the violation, in order to file a civil or criminal complaint against the alleged offender. |
| (2) | The defamation dispute conciliation division shall, upon receiving a claim under paragraph (1), make a decision on whether to furnish information, hearing the opinion of the relevant user, unless it is impossible to contact the relevant user or there is any particular reason otherwise. |
| (3) | A person who receives information about the relevant user under paragraph (1) may not use the information for any purpose other than the purpose of filing a civil or criminal complaint. |
| (4) | Other matters necessary for the contents of a claim to furnish information of a user and the procedure therefor shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 44-7 (Prohibition on Circulation of Unlawful Information) |
| (1) | No one may circulate information falling under any of the following subparagraphs through an information and communications network: <Amended by Act No. 11048, Sep. 15, 2011; Act No. 14080, Mar. 22, 2016> |
| 1. | Information with an obscene content distributed, sold, rented, or displayed openly in the form of code, words, sound, image, or motion picture; |
| 2. | Information with a content that defames other persons by divulging a fact, false fact, openly and purposely to disparage the person's reputation; |
| 3. | Information with a content that arouses fear or apprehension by reaching other persons repeatedly in the form of code, words, sound, image, or motion picture; |
| 4. | Information with a content that mutilates, destroys, alters, or forges an information and communications system, data, a program, or similar or that interferes with the operation of such system, data, program, or similar without a justifiable ground; |
| 5. | Information with a content that falls within an unwholesome medium for juvenile under the Juvenile Protection Act and that is provided for profit without fulfilling the duties and obligations under relevant statutes, including the duty to verify the opposite party's age and the duty of labeling; |
| 6. | Information with a content that falls within speculative activities prohibited by statutes; |
| 6-2. | Information regarding content of transactions of personal information in violation of this Act or other statutes concerning the protection of personal information; |
| 7. | Information with a content that divulges a secret classified by statutes or any other State secret; |
| 8. | Information with a content that commits an activity prohibited by the National Security Act; |
| 9. | Other information with a content that attempts, aids, or abets to commit a crime. |
| (2) | The Korea Communications Commission may order a provider of information and communications services or a manager or an operator of a message board to reject, suspend, or restrict management of information under paragraph (1) 1 through 6 and 6-2, subject to deliberation by the Communications Standards Commission: |
| (3) | The Korea Communications Commission shall order a provider of information and communications services or a manager or an operator of a message board to reject, suspend, or restrict management of information under paragraph (1) 7 through 9, if the information falls under all the following subparagraphs: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | There was a request from the head of a related central administrative agency; |
| 2. | A demand for correction was made pursuant to subparagraph 4 of Article 21 of the Act on the Establishment and Operation of Korea Communications Commission after deliberation by the Communications Standards Commission within seven days from the date on which the request under subparagraph 1 had been received; |
| 3. | The provider of information and communications services or the manager or operator of the message board has not complied with the demand for correction. |
| (4) | The Korea Communications Commission shall give an opportunity to the provider of information and communications services or the manager, operator, or relevant user of the message board to whom an order is to be issued pursuant to paragraph (2) or (3) to present his/her opinion in advance: |
| 1. | If it is necessary to make an urgent disposition for public safety and welfare; |
| 2. | If there is a ground specified by Presidential Decree to believe that it is obviously impracticable or evidently unnecessary to hear an opinion; |
| 3. | If a person concerned clearly manifests his/her intent to give up the opportunity to present his/her opinion. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Articles 44-8 and 44-9 Deleted. <by Act No. 8867, Feb. 29, 2008> |
| Article 44-10 (Defamation Dispute Conciliation Division) |
| (1) | The Communications Standards Commission shall have the defamation dispute conciliation division comprised of five members or less for efficient conciliation of disputes arising in connection with information that intrudes other persons' privacy, defames other persons, or violates other persons' rights including a member or more holding qualification of attorney-at-law. |
| (2) | The members of the defamation dispute conciliation division shall be commissioned by the chairperson of the Communications Standards Commission with consent of the Communications Standards Commission. |
| (3) | Articles 33-2 (2) and 35 through 39 shall apply |
| (4) | Necessary matters concerning the installation and operation of the defamation dispute conciliation division and the conciliation of disputes, and other related matters shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
CHAPTER VI SECURING OF STABILITY OF INFORMATION AND COMMUNICATIONS NETWORK
| Article 45 (Securing of Stability of Information and Communications Network) |
| (1) | Every provider of information and communications services shall take protective measures to secure the reliability of the information and security of the information and communications networks. |
| (2) | The Minister of Science, ICT and Future Planning may prescribe and provide a public notice of guidelines for protective measures for information (hereinafter referred to as "information protection guidelines"), specifying details of the protective measures under paragraph (1), and may recommend providers of information and communications services to observe the guidelines. <Amended by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013> |
| (3) | The information protection guidelines shall contain descriptions of the following matters: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Technical and physical protective measures, including installation and operation of an information protection system, for a person with no due authorization to prevent or counteract access to invasion upon an information and communications network; |
| 2. | Technical protective measures for preventing unlawful leakage, forgery. alteration, or deletion of information; |
| 3. | Technical and physical protective measures for securing the state of enabling continuous use of information and communications networks; |
| 4. | Administrative protective measures for stabilization of information and communications networks and protection of information, including securing human resources, organization, and expenses and establishing related plans. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 45-2 (Preliminary Examination on Information Protection) |
| (1) | A provider of information and communications services shall, if he/she intends to newly establish an information and communications network or to provide information and communications services, take the matters regarding information protection into account in planning or designing thereof. |
| (2) | The Minister of Science, ICT and Future Planning may recommend a person who intends to implement the information and communications services or the telecommunications businesses falling under any of the following subparagraphs to take protective measures in accordance with the preliminary examination standards as determined by Presidential Decree: <Amended by Act No. 11690, Mar. 23, 2013> |
| 1. | The information and communications services or telecommunications businesses as determined by Presidential Decree, for which authorization or permission by the Minister of Science, ICT and Future Planning should be obtained or registration with or report to the Korea Communications Commission should be made pursuant to this Act or other Acts and subordinate statutes; |
| 2. | The information and communications services or the telecommunications businesses as determined by Presidential Decree and financed by the Minister of Science, ICT and Future Planning for all or part of the business expenses thereof. |
| (3) | Standards, methods, procedures, fees for the preliminary examination on protection of information pursuant to paragraph (2) and other necessary matters shall be determined by Presidential Decree. |
[This Article Added by Act No. 11322, Feb. 17, 2012]
| Article 45-3 (Designation, etc. of Chief Information Protection Officers) |
| (1) | A provider of information and communications services may designate a chief information protection officer at a level of an executive officer for security of information and communications system, etc. and for safe administration of information: |
| (2) | Methods and procedures for reporting under paragraph (1) shall be prescribed by Presidential Decree. <Added by Act No. 12681, May 28, 2014> |
| (3) | A chief information protection officer shall be responsible for the following matters: |
| 1. | Establishment and administration/operation of an administrative system for information protection; |
| 2. | Analysis/evaluation and improvement of the weakness of information protection; |
| 3. | Prevention of and response to an intrusion; |
| 4. | Preparation of preliminary measures for information protection and designing/realization, etc. of security measures; |
| 5. | Review of a preliminary security for information protection; |
| 6. | Review of the encryption of an important information and the suitability of a security server; |
| 7. | Other matters, such as taking necessary measures for protection of information pursuant to this Act or other relevant statutes. |
| (4) | A provider of information and communications services may establish and operate an association of chief information protection officers comprised of chief information protection officers prescribed in paragraph (1) in order to jointly perform prevention/response in cases of intrusion, sharing necessary information and other joint programs prescribed by Presidential Decree. |
| (5) | The Government may provide financial support to the association of chief information protection officers under paragraph (4) for expenses, in whole or in part, incurred in conducting its activities. <Amended by Act No. 12681, May 28, 2014; Act No. 13343, Jun. 22, 2015> |
[This Article Added by Act No. 11322, Feb. 17, 2012]
| Article 46 (Protection of Clustered Information and Communications Facilities) |
| (1) | Every business operator who operates and manages clustered information and communications facilities to render information and communications services on behalf of another person (hereinafter referred to as "business operator of clustered information and communications facilities") shall take protective measures as prescribed by Presidential Decree to operate the information and communications facilities stably. |
| (2) | Every business operator of clustered information and communications facilities shall purchase insurance policies as prescribed by Presidential Decree to cover damages that may be caused by destruction or damage of the clustered information and communications facilities or any other trouble in operation. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 46-2 (Emergency Countermeasures of Business Operators of Clustered Information and Communications Facilities) |
| (1) | A business operator of clustered information and communications facilities may, if any of the following events occurs, suspend rendering relevant services, in whole or in part, as stipulated in the standardized user agreement: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013> |
| 1. | If it is anticipated that an abnormality found in the information system of a person who uses clustered information and communications facilities (hereinafter referred to as "user of facilities") will probably cause a serious trouble to the information system of other users of facilities or clustered information and communications facilities; |
| 2. | If it is anticipated that an intrusion from outside will probably cause a serious trouble to the clustered information and communications facilities; |
| 3. | If there occurs a serious intrusion and the Minister of Science, ICT and Future Planning or the Korea Internet and Security Agency requests to suspend the services. |
| (2) | A business operator of clustered information and communications facilities shall, when it suspends its services in accordance with paragraph (1), immediately notify users of facilities of the suspension of services, specifically stating the reasons for the suspension, the date, time, period, and details of the suspension, and other related matters. |
| (3) | A business operator of clustered information and communications facilities shall, once the event that caused suspension of services terminates, resume its services immediately. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 46-3 Deleted. <by Act No. 11322, Feb. 17, 2012> |
| Article 47 (Certification of Information Security Management System) |
| (1) | With respect to the person who has established and operates a comprehensive management system, including administrative and technical protective measures, for securing stability and reliability of an information and communications network (hereinafter referred to as "information security management system"), the Minister of Science, ICT and Future Planning may certify as to whether he/she meets the standards under paragraph (4). <Amended by Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 13520, Dec. 1, 2015> |
| (2) | A telecommunication business operator under subparagraph 8 of Article 2 of the Telecommunications Business Act, or any of the following persons, who provides or intermediates the provision of information by using telecommunications services of any telecommunication business operator, shall receive the certification under paragraph (1): <Newly Inserted by Act No. 11322, Feb. 17, 2012; Act No. 13520, Dec. 1, 2015> |
| 1. | A person who renders information and communications services as prescribed by Presidential Decree as a person who has obtained the permission pursuant to Article 6 (1) of the Telecommunications Business Act; |
| 2. | A business operator of clustered information and communications facilities; |
| 3. | A person falling under the standards determined by Presidential Decree, whose annual sales or tax revenue, etc. is not less than 150 billion won, whose sales of the sector of information and communications services of the previous year is not less than 10 billion won, or whose average number of daily users over the past three months is not less than one million. |
| (3) | Where a person required to be certified in accordance with paragraph (2) is certified for conformity with international standards for information protection or takes measures for information protection, as prescribed by Ministerial Decree of Science, ICT and Future Planning, the Minister of Science, ICT and Future Planning may omit part of certification examination under paragraph (1). In this case, the detailed scope of omitted certification examination shall be determined and publicly notified by the Minister of Science, ICT and Future Planning. <Added by Act No. 13520, Dec. 1, 2015> |
| (4) | The Minister of Science, ICT and Future Planning may, for the purpose of certification for information security management system under paragraph (1), determine and give a public notice of other necessary matters such as certification criteria, including countermeasures for managerial, technical and physical protection. <Amended by Act No. 11322, Feb. 17, 2012; Act No.11690, Mar.23. 2013; Act No. 13520, Dec. 1, 2015> |
| (5) | The period of validity of the certification for an information security management system under paragraph (1) shall be three years: |
| (6) | The Minister of Science, ICT and Future Planning may have the Korea Internet Security Agency or any institution (hereinafter referred to as a “certification body of information security management systems”) designated by the Minister of Science, ICT and Future Planning perform the following affairs related to the certification under paragraphs (1) and (2): <Added by Act No. 11322, Feb. 17, 2012; Act No.11690, Mar.23. 2013; Act No. Act No. 13520, Dec. 1, 2015> |
| 1. | Examination (hereinafter referred to as an “examination of certification” of verifying whether the information security management systems by established by an applicant for certification meets the standards for certification under paragraph (4); |
| 2. | Review on the results of examination of certification; |
| 3. | Issuance and management of written certifications; |
| 4. | Ex post facto management of granted certifications; |
| 5. | Fosterage and qualification management of the certification examiners of information security management systems; |
| 6. | Other affairs concerning the certification for information security management systems. |
| (7) | The Minister of Science, ICT and Future Planning may, if necessary for the efficient conduct of affairs related to certification, designate an institution for performing affairs related to examination of certification (hereinafter referred to as an “examination institution for information security management systems”). <Added by Act No. 13520, Dec. 1, 2015> |
| (8) | The Korea Internet Security Agency, a certification body for information security management systems, and an examination institution for information security management systems shall, in order to enhance the efficiency of information security management systems, perform |
| (9) | A person who has received certification of an information security management systems in accordance with paragraphs (1) and (2) may indicate or publicize the content of the certification, as prescribed by Presidential Decree. <Amended by Act No. 11322, Feb. 17, 2012; Act No. 13520, Dec. 1, 2015> |
| (10) | The Minister of Science, ICT and Future Planning may revoke the certification where any of the following grounds are found: |
| 1. | Having received the certification of an information security management systems in a false or otherwise unjustifiable manner; |
| 2. | Falling short of the standards for certification under paragraph (4); |
| 3. | Refusing or obstructing the |
| (11) | Methods and procedures for, and scope and fees of, certification under paragraphs (1) and (2), methods and procedures for |
| (12) | Standards and procedures for, and period of validity, the designation of a certification body for information security management systems and an examination institution for information security management systems shall be prescribed by Presidential Decree. <Amended by Act No. 11322, Feb. 17, 2012; ct No. 13520, Dec. 1, 2015> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 47-2 (Revocation of Designation of Certification Body of and Examination Institution for Information Security Management Systems) |
| (1) | If a legal entity or organization designated as a certification body for information security management system or an examination institution for information security management systems pursuant to Article 47 falls under any of the following subparagraphs, the Minister of Science, ICT and Future Planning may revoke the designation or order it to suspend the relevant business, entirely or partially, for a prescribed period of time not exceeding one year: |
| 1. | If it has obtained the designation of a certification body or an examination institution for information security management systems by deceit or in any other fraudulent mean; |
| 2. | If it has granted or examined certification during a business suspension period; |
| 3. | If it has not performed certification or examination of certification without justifiable grounds; |
| 4. | If it has performed certification or examination of certification, in violation of Article 47 (11); |
| 5. | If it no longer meets the criteria for designation under Article 47 (12). |
| (2) | Matters necessary for the revocation of designation and suspension of business under paragraph (1) and other related matters shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 47-3 (Certification of Personal Information Management System) |
| (1) | With respect to a person who established and is operating a comprehensive management system including administrative, technical and physical protective measures in order to systematically and continuously perform the activities for protection of personal information in the information and communications network (hereinafter referred to as “personal information management system”), the Korea Communications Commission may certify as to whether the management system meets the standards pursuant to paragraph (2). |
| (2) | The Korea Communications Commission may, for the certification of personal information management system pursuant to paragraph (1), determine and give a public notice of standards for the certification including administrative, technical and physical protective measures and other necessary matters. |
| (3) | Concerning the institutions which implement the personal information management system and the follow-up management, etc., Article 47 (6) through (12) shall apply |
| (4) | Concerning the revocation of designation, etc. of a certifying institution of the personal information management system, Article 47-2 shall apply |
[This Article Added by Act No. 11322, Feb. 17, 2012]
| Article 47-4 (Protection of User Information) |
| (1) | The Government may prescribe guidelines necessary for protection of information of users to recommend users to observe the guidelines, and may take necessary measures for preventing intrusions and precluding spread of intrusions, such as inspection of weaknesses and technical support. |
| (2) | A major provider of information and communications services may, if it is foreseen that a serious problem is likely to occur in the information system of a user who uses the services, the information and communications network, or similar provided by it because of an occurrence of a serious intrusion on its information and communications network, request the user to take necessary protective measures as stipulated by the standard user agreement, and may place a temporary restriction on access to the relevant information and communications network if the user does not perform as requested. |
| (3) | A software business operator under Article 2 of the Software Industry Promotion Act shall, when he/she produced a program that improves weaknesses in security, notify the Korea Internet and Security Agency of its production, and shall notify users of the software of the production at least twice within one month from the date of production. <Amended by Act No. 9637, Apr. 22, 2009> |
| (4) | Specific details that shall be stipulated by the standard user agreement with respect to the request for protective measures under paragraph (2) and other related matters shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 47-5 (Management Rating for Information Protection) |
| (1) | A person who has obtained the certification for information security management system pursuant to Article 47 is entitled to receive the management rating for information protection from the Minister of Science, ICT and Future Planning in order to enhance level of a corporate’s management of its comprehensive information protection and to secure users’ reliability on information protection services. <Amended by Act No. 11690, Mar. 23, 2013> |
| (2) | The Minister of Science, ICT and Future Planning may authorize the Korea Internet and Security Agency to perform the affairs of rating under paragraph (1). <Amended by Act No. 11690, Mar. 23, 2013> |
| (3) | A person who has obtained the management rating for information protection pursuant to paragraph (1) may indicate the obtained rating or advertise details of such rating as determined by Presidential Decree. |
| (4) | In cases where the Minister of Science, ICT and Future Planning finds causes falling under any of the following subparagraphs, the Minister may revoke the aforementioned rating: |
| 1. | Where a person obtained the management rating for information protection, by fraud or other improper means; |
| 2. | Where falling short of the standards of rating pursuant to paragraph (5). |
| (5) | Standards of review in assigning the rating pursuant to paragraph (1), the method, procedure and fee of assigning the rating, the effective term of rating, the method/procedure of revocation of rating pursuant to paragraph (4) and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Added by Act No. 11322, Feb. 17, 2012]
| Article 48 (Prohibition on Intrusive Acts, etc. on Information and Communications Network) |
| (1) | No one shall intrude on an information and communications network without a rightful authority for access or beyond a permitted authority for access. |
| (2) | No one shall mutilate, destroy, alter, or forge an information and communications system, data, program, or similar without a justifiable grounds, nor shall convey or spread a program that is likely to interrupt operation of such system, data, program, or similar (hereinafter referred to as "malicious program"). |
| (3) | No one shall cause a trouble to an information and communications network to interfere with stable operation of the information and communications network in purpose by sending a large amount of signals or data, letting the network process an illegitimate order or doing the similar actions. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 48-2 (Countermeasures, etc. against Intrusion Cases) |
| (1) | The Minister of Science, ICT and Future Planning shall perform the following business affairs to take proper countermeasures against intrusion, and may have the Korea Internet and Security Agency perform all or part of the business affairs, if necessary to do so: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013> |
| 1. | Collection and spread of information about intrusion; |
| 2. | Precaution and warning of intrusion; |
| 3. | Emergency measures against intrusion; |
| 4. | Other countermeasures against intrusion prescribed by Presidential Decree. |
| (2) | A person falling under any of the following subparagraphs shall furnish the Minister of Science, ICT and Future Planning or the Korea Internet and Security Agency with the information related to intrusion cases, including statistics by type of intrusion cases, statistics of traffic of the relevant information and communications network, and statistics of use by access channel, as prescribed by Presidential Decree: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013> |
| 1. | A major provider of information and communications services; |
| 2. | A business operator of clustered information and communications facilities; |
| 3. | Other persons specified by Presidential Decree among those who operate an information and communications network. |
| (3) | The Korea Internet and Security Agency shall analyze the information under paragraph (2) and report it to the Minister of Science, ICT and Future Planning. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013> |
| (4) | If a business operator who is obligated to furnish the information in accordance with paragraph (2) refuses to do without a justifiable ground or furnishes false information, the Minister of Science, ICT and Future Planning may order the business operator to make a correction within a reasonable period of time prescribed by the Commission. <Amended by Act No. 11690, Mar. 23, 2013> |
| (5) | The Minister of Science, ICT and Future Planning or the Korea Internet and Security Agency shall use the information furnished in accordance with paragraph (2) properly within the extent necessary for taking countermeasures against intrusion. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013> |
| (6) | The Minister of Science, ICT and Future Planning or the Korea Internet and Security Agency may, if necessary to take countermeasures against intrusion, request a person falling under any subparagraph of paragraph (2) to provide human resources for assistance. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 48-3 (Report, etc. on Intrusion Cases) |
| (1) | A person falling under any of the following subparagraphs shall, where he/she discovers an intrusion, immediately report it to the Minister of Science, ICT and Future Planning or the Korea Internet and Security Agency. In such cases, a notice given in accordance with Article 13 (1) of the Act on the Protection of Information and Communications Infrastructure shall be deemed a report under the foregoing sentence: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013> |
| 1. | A provider of information and communications services; |
| 2. | A business operator of clustered information and communications facilities. |
| (2) | The Minister of Science, ICT and Future Planning or the Korea Internet and Security Agency shall, upon receiving a report of intrusion under paragraph (1) or being aware of an intrusion, take necessary measures under subparagraphs of Article 48-2 (1). <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11690, Mar. 23, 2013> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 48-4 (Analysis, etc. of Cause of Intrusion Cases) |
| (1) | A person who operates an information and communications network, including a provider of information and communications services, shall analyze causes of intrusion and keep damage from intrusion at bay, whenever an intrusion occurs. |
| (2) | The Minister of Science, ICT and Future Planning may, when a serious intrusion occurs in an information and communications network operated by a provider of information and communications services, organize a private-public joint investigation team having expertise in protection of information to conduct an analysis on causes of such intrusion in order to preclude spread of damage, take countermeasures against the intrusion, recover from damage and prevent recurrence of such intrusion. <Amended by Act No. 11690, Mar. 23, 2013> |
| (3) | The Minister of Science, ICT and Future Planning may, if deemed necessary for analyzing causes of an intrusion pursuant to paragraph (2), order a provider of information and communications services and a business operator of clustered information and communications facilities to preserve relevant data, such as access records of the relevant information and communications network. <Amended by Act No. 11690, Mar. 23, 2013> |
| (4) | The Minister of Science, ICT and Future Planning may, if deemed necessary for analyzing causes of an intrusion, demand a provider of information and communications services and a business operator of clustered information and communications facilities to submit data related to the intrusion, and also may order the private-public joint investigation team under paragraph (2) to enter into a place of business of a person involved to conduct investigation into the causes of the intrusion: |
| (5) | The Minister of Science, ICT and Future Planning or the private-public joint investigation team shall not use the information learned through the data submitted and the investigation conducted in accordance with paragraph (4) for any purpose other than analysis of causes of the intrusion and preparation of countermeasures, and shall destroy it immediately after the analysis of causes is completed. <Amended by Act No. 11690, Mar. 23, 2013> |
| (6) | Necessary matters concerning the organization of the private-public joint investigation team under paragraph (2) and the protection of data submitted in relation to an intrusion in accordance with paragraph (4), and other related matters shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 49 (Protection of Secrets, etc.) |
No one shall mutilate another person's information processed, stored, or transmitted through an information and communications network, nor shall infringe, misappropriate, or divulge another person's secret.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 49-2 (Prohibition on Collection, etc. of Personal Information by Acts of Deceit) |
| (1) | No one shall collect another person's information through an information and communications network by an act of deceit, nor shall entice another person by an act of deceit to furnish information. |
| (2) | A provider of information and communications services shall, whenever it discovers a violation of paragraph (1), immediately report it to the Minister of Science, Information and Communications Technology (ICT) and Future Planning, the Korea Communications Commission, or the Korea Internet and Security Agency. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 14080, Mar. 22, 2016> |
| (3) | The Minister of Science, Information and Communications Technology (ICT) and Future Planning, the Korea Communications Commission, or the Korea Internet and Security Agency shall, upon receiving a report under paragraph (2) or becoming aware of a violation of paragraph (1), take the following measures as may be necessary: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 14080, Mar. 22, 2016> |
| 1. | Collection and diffusion of the information related to the violation; |
| 2. | Precaution and warning of similar damage; |
| 3. | Emergency Measures to prevent damage and spread thereof, including requesting the relevant provider of information and communications services to block access paths or to inform the users of the fact that they are exposed to an act of violating paragraph (1). |
| (4) | The Minister of Science, Information and Communications Technology (ICT) and Future Planning, or the Korea Communications Commission may, for taking measures referred to in paragraph (3) 3, order providers of information and communications services to take necessary measures, such as sharing among themselves information regarding acts of deceit through information and communications networks. <Added by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50 (Restrictions on Transmission of Advertising Information for Profit) |
| (1) | If any person intends to transmit advertising information for profit by using an electronic transmission medium, he/she shall obtain explicit prior consent from an addressee to whom such information is addressed: |
| 1. | Where a person who has directly collected contact details from the addressee in his/her dealings of goods, etc. intends to transmit advertising information for profit on the same kinds of goods, etc. as those he/she manages and has dealt with the addressee within a period prescribed by Presidential Decree; |
| 2. | Where a telemarketer under the Act on Door-to-Door Sales, Etc. informs prospective customers of the collection source of their personal information by voice, and solicits them to buy products or services by means of telephone call. |
| (2) | Notwithstanding paragraph (1), where an addressee expresses his/her intention to refuse to receive information or revokes his/her prior consent, no person who intends to transmit advertising information for profit by using an electronic transmission medium shall transmit advertising information for profit. |
| (3) | Notwithstanding paragraph (1), a person who intends to transmit advertising information for profit by using an electronic transmission medium during the time between 9:00 pm and 8:00 am of the following day shall obtain express prior consent from the addressee of such information: |
| (4) | A person who transmits advertising information for profit by using an electronic transmission medium shall specify the following matters in advertising information, as prescribed by Presidential Decree: |
| 1. | The name and contact details of a sender; |
| 2. | Matters concerning measures and methods by which an addressee can easily express his/her intention to refuse to receive information or to revoke his/her consent to receive information. |
| (5) | No person who transmits advertising information for profit by using an electronic transmission medium shall take any of the following measures: |
| 1. | Measures to avoid or interfere with an addressee's refusal to receive or revocation of his/her consent to receive advertising information; |
| 2. | Measures to automatically generate an addressee's contact information, such as telephone numbers and email addresses, by combining figures, codes, or letters; |
| 3. | Measures to automatically register telephone numbers or email addresses for the purpose of transmitting advertising information for profit; |
| 4. | Various measures to hide the identity of the sender of advertising information or the source from which advertising is transmitted; |
| 5. | Various measures to induce an addressee to reply by deceiving him/her for the purpose of transmitting advertising information for profit. |
| (6) | A person who transmits advertising information for profit by using an electronic transmission medium shall take necessary measures so that an addressee does not incur any cost, such as telephone charges, when the addressee refuses to receive or revokes his/her consent to receive such information, as prescribed by Presidential Decree. |
| (7) | Where an addressee gives prior consent under paragraph (1) or expresses his/her intention to refuse to receive or revoke his/her consent to receive advertising information under paragraph (2), a person who intends to transmit advertising information for profit by using an electronic transmission medium shall inform the relevant addressee of the outcomes of measures taken in relation to consent to receive, refusal to receive, or revocation of consent to receive advertising information, as prescribed by Presidential Decree. |
| (8) | A person who obtains consent to receive advertising information pursuant to paragraph (1) or (3) shall regularly verify whether an addressee of advertising information consents to receive such information, as prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 12681, May 28, 2014]
| Article 50-2 Deleted. <by Act No. 12681, May 28, 2014> |
| Article 50-3 (Commissioned Transmission of Advertising Information for Profit) |
| (1) | A person who has commissioned a third party to transmit advertising information for profit on his/her behalf shall control and oversee the person to whom the transmission was commissioned to ensure that the person does not violate Article 50. <Amended by Act No. 12681, May 28, 2014> |
| (2) | A person to whom transmission of advertising information for profit has been commissioned under paragraph (1) shall be deemed an employee of the person who has commissioned the transmission of information in determining liability for damages caused by a violation of an Act related to such business affair. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50-4 (Restrictions on Rendering Information Transmission Services) |
| (1) | A provider of information and communications services may take measures to refuse rendering corresponding services in any of the following cases: |
| 1. | If transmission or reception of advertising information hinders or is likely to hinder rendering the services; |
| 2. | If a user does not want to receive advertising information; |
| 3. | Deleted. <by Act No. 12681, May 28, 2014> |
| (2) | If a provider of information and communications services intends to take any measure for refusal under paragraph (1) or (4), he/she shall include matters concerning the refusal of the relevant services in the terms and conditions of a contract for use of information and communications services which he/she concludes with the user of such services. <Amended by Act No. 12681, May 28, 2014> |
| (3) | A provider of information and communications services shall inform interested persons, such as users to whom such services are provided, of the fact that he/she has taken measures for refusal under paragraph (1) or (4): |
| (4) | Where services which a provider of information and communications services provides to users under a contract for use are used for transmitting advertising information for profits, in violation of Article 50 or 50-8, the relevant provider of information and communications services shall formulate necessary measures, such as refusal to provide the relevant services or fix of problmes of information and communications networks or services. <Added by Act No. 12681, May 28, 2014> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50-5 (Installation of Advertising Program for Profit) |
A provider of information and communications services shall, when it intends to install a program designed to display advertising information or collect personal information in a user's computer or any other information processing device specified by Presidential Decree, obtain consent from the user. In such cases, it shall notify the purpose of use of the program and the method of deletion.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50-6 (Distribution of Software Designed to Block Transmission of Advertising Information for Profit) |
| (1) | The Korea Communications Commission may develop and distribute software or computer programs designed for addressees to conveniently block or report any advertising information for profit when it is transmitted in violation of Article 50. |
| (2) | The Korea Communications Commission may provide necessary support to related public agencies, legal entities, organizations, or similar for facilitating the development and distribution of software or computer programs for cutting off or reporting transmission under paragraph (1). |
| (3) | If telecommunications services rendered by a provider of information and communications services are used in transmitting advertising information for profit in violation of Article 50, the Korea Communications Commission may recommend the provider of information and communications services to take necessary measures, such as development of technology, education, and public relations activities to protect addressees. |
| (4) | The method of the development and distribution under paragraph (1) and the matters necessary for the support under paragraph (2) shall be prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 50-7 (Restrictions on Posting of Advertising Information for Profit) |
| (1) | Where any person intends to post advertising information for profit on an Internet website, he/she shall obtain prior consent from the operator or the manager of an Internet website: |
| (2) | Notwithstanding paragraph (1), where the operator or the manager of an Internet website explicitly expresses his/her intention to refuse to post a notice or to revoke his/her prior consent, no person who intends to post advertising information for profit shall post advertising information for profit. |
| (3) | The operator or the manager of the Internet website may take measures, such as deletion of advertising information for profit posted, in violation of paragraph (1) or (2). |
[This Article Wholly Amended by Act No. 12681, May 28, 2014]
| Article 50-8 (Prohibition on Transmission of Advertising Information for Unlawful Act) |
No one shall transmit any advertising information for goods or services prohibited by this Act or any other Act through an information and communications network.
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 51 (Restriction, etc. on Outflow of Important Information to Abroad) |
| (1) | The Government may have providers or users of information and communications services to take necessary measures to prevent outflow abroad of any important information about industry, economy, science, technology, etc. of this county through information and communications networks. |
| (2) | The scope of the important information under paragraph (1) shall be as follows: |
| 1. | Information related to the national security and major policies; |
| 2. | Information about details of cutting-edge science and technology or equipment developed within this country. |
| (3) | The Government may have the providers of information and communications services that manage the information under subparagraphs of paragraph (2) take the following measures: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Installation of a systematic or technical device for preventing unlawful use of information and communications networks; |
| 2. | Systematic and technical measures for preventing unlawful destruction or manipulation of information; |
| 3. | Measures for preventing leakage of important information that providers of information and communications services have learned while managing the information. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 52 (Korea Internet and Security Agency) |
| (1) | The Government shall establish the Korea Internet and Security Agency (hereinafter referred to as the "Internet and Security Agency") to upgrade the information and communications network (excluding matters concerning establishment, improvement and management of information and telecommunications network), encourage the safe use thereof, and promote the international cooperation and advancement into the overseas market in relation to broadcasting and communications. <Amended by Act No. 9637, Apr. 22, 2009> |
| (2) | The Internet and Security Agency shall be a legal entity. <Amended by Act No. 9637, Apr. 22, 2009> |
| (3) | The Internet and Security Agency shall perform the following business affairs: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014; Act No.13343 Jun. 22, 2015> |
| 1. | Survey and research of laws, policies and systems for the use and protection of the information and telecommunications network, promotion of the international cooperation and advancement into the overseas market in relation to broadcasting and communications, etc.; |
| 2. | Survey and research of statistics concerning the use and protection of the information and telecommunications network; |
| 3. | Analysis of negative effects arising from the use of the information and telecommunications network and research on countermeasures; |
| 4. | Public relations activities, education, and training for using and protecting the information and telecommunications network; |
| 5. | Information protection for the information and telecommunications network, development of technologies concerning the Internet address resources and standardization thereof; |
| 6. | Support for policies for the information security industry, development of relevant technology and fostering of human resources; |
| 7. | Certification of the information security management system, implementation of and support for certification, evaluation, etc. of the information protection, such as evaluation or certification of the information security system; |
| 8. | Research of measures to protect personal information and support for development and proliferation of protection technology; |
| 9. | Support for the operation of the Dispute Mediation Committee and operation of the privacy call center; |
| 10. | Transmission of promotional information and consultation on and processing of complaints related to Internet advertisements; |
| 11. | Operation of a system to deal with intrusion cases of information and telecommunications network, analyze the causes thereof, and respond thereto; |
| 12. | Management of certification of digital signatures under Article 25 (1) of the Digital Signature Act; |
| 13. | Support for an efficient operation of the Internet and encouragement of wider use thereof; |
| 14. | Support for the protection of stored information of the Internet users; |
| 15. | Support for service policies pertaining to the Internet; |
| 16. | Protection of users and support for the proliferation of sound information on the Internet; |
| 17. | Affairs related to the management of Internet address resources under the Internet Address Resources Act; |
| 18. | Support for the operation of the Internet Address Dispute Resolution Committee under Article 16 of the Internet Address Resources Act; |
| 19. | Support for operation of the conciliation committee under Article 25 (7) of the Act on the Promotion of Information Security Industry; |
| 20. | Support for such international cooperation, overseas expansion and overseas publicity activities as are concerning broadcasting and communications; |
| 21. | Businesses incidental to those referred to in subparagraphs 1 through 20; |
| 22. | Other businesses determined to fall under the affairs of, or entrusted to, the Internet and Security Agency in accordance with this Act, or any other statute, or other businesses entrusted by the Minister of Science, ICT and Future Planning, the Minister of Interior, the Korea Communications Commission, or the head of any other administrative agency. |
| (4) | Expenses necessary for the business affairs of the Internet and Security Agency shall be funded by the following financial resources: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | Government’s contributions; |
| 2. | Revenues accrued from businesses referred to in each subparagraph of paragraph (3); |
| 3. | Other revenues accrued from operating the Internet and Security Agency. |
| (5) | The provisions governing incorporated foundations under the Civil Act shall apply |
| (6) | Any person, other than the Internet and Security Agency, shall not use the name called "Korea Internet and Security Agency." <Amended by Act No. 9637, Apr. 22, 2009> |
| (7) | Matters necessary for the operation of the Internet and Security Agency and performance of its business affairs shall be prescribed by Presidential Decree. <Amended by Act No. 9637, Apr. 22, 2009> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
CHAPTER VII TELECOMMUNICATIONS BILLING SERVICES
| Article 53 (Registration, etc. of Provider of Telecommunications Billing Services) |
| (1) | A person who intends to render telecommunications billing services shall meet the following requirements and complete registration with the Minister of Science, ICT and Future Planning as prescribed by Presidential Decree: <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11690, Mar. 23, 2013> |
| 1. | Financial soundness; |
| 2. | A plan for protection of users of telecommunications billing services; |
| 3. | Human resources and physical facilities required for carrying on the business; |
| 4. | A business plan. |
| (2) | A person eligible for the registration under paragraph (1) shall be either a company under Article 170 of the Commercial Act or a legal entity under Article 32 of the Civil Act and the total amount of its capital, contributions, or fundamental property shall not be less than the amount specified by Presidential Decree and more than 500 million won. |
| (3) | Notwithstanding Article 22 of the Telecommunications Business Act, a provider of telecommunications billing services may omit reporting as a value-added telecommunications business operator. <Amended by Act No. 10166, Mar. 22, 2010> |
| (4) | Articles 23 through 26 of the Telecommunications Business Act shall apply |
| (5) | Detailed requirements and procedure for the registration under paragraph (1) and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Added by Act No. 8778, Dec. 21, 2007]
| Article 54 (Disqualification from Registration) |
A person falling under any of the following subparagraphs shall be disqualified for the registration under Article 53: <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11690, Mar. 23, 2013>
| 1. | A legal entity in which case one year has not elapsed since its business was discontinued pursuant to Article 53 (4) or a person who was a major shareholder of such legal entity at the time when its business was discontinued (referring to an investor specified by Presidential Decree; hereinafter the same shall apply), if one year has not elapsed since the date of discontinuance; |
| 2. | A legal entity in which case three years have not elapsed since its registration was revoked pursuant to Article 55 (1) or a person who was a major shareholder of such legal entity at the time when its registration was revoked, if three years have not elapsed since the date of revocation; |
| 3. | A legal entity that are still under rehabilitation proceedings under the Debtor Rehabilitation and Bankruptcy Act or a major shareholder of such legal entity; |
| 4. | A person who did not perform his/her obligations within an agreed time limit in a banking transaction or any other commercial transaction and who is specified by the Minister of Science, ICT and Future Planning; |
| 5. | A legal entity any of whose major shareholders falls under any provision of subparagraphs 1 through 4. |
[This Article Added by Act No. 8778, Dec. 21, 2007]
| Article 55 (Order to Revoke Registration) |
| (1) | Where a provider of telecommunications billing services makes a registration by fraud or other improper means, the Minister of Science, ICT and Future Planning shall revoke the registration. <Amended by Act No.13343 Jun.22, 2015> |
| (2) | The procedure for the disposition under paragraph (1) and other necessary matters shall be prescribed by Presidential Decree. |
[This Article Added by Act No. 8778, Dec. 21, 2007]
| Article 56 (Reporting on Standard Contract Form) |
| (1) | Every provider of telecommunications billing services shall prepare a standard contract form on telecommunications billing services and report it to the Minister of Science, ICT and Future Planning (including reporting on a revision thereto). <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11690, Mar. 23, 2013> |
| (2) | The Minister of Science, ICT and Future Planning may, if it is found that a standard contract form under paragraph (1) is likely to undermine users’ interest of telecommunications billing services, recommend the relevant provider of telecommunications billing services to revise the standard contract form. <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11690, Mar. 23, 2013> |
[This Article Added by Act No. 8778, Dec. 21, 2007]
| Article 57 (Securing Safety in Telecommunications Billing Services) |
| (1) | Every provider of telecommunications billing services shall perform his/her duty to pay attention as a good manager so that telecommunications billing services may be provided in a safe manner. <Amended by Act No. 12681, May 28, 2014> |
| (2) | Every provider of telecommunications billing services shall take administrative measures, including formulation of guidelines for work process and classification of accounts, and technical measures, including establishment of an information protection system, to secure safety and reliability of transactions through telecommunications billing services as prescribed by Presidential Decree. |
[This Article Added by Act No. 8778, Dec. 21, 2007]
| Article 58 (Rights of Providers of Telecommunications Billing Services) |
| (1) | When the price for goods, etc. sold or provided must be paid, or a provider of telecommunications billing services charges the price therefor, it shall notify the users of telecommunications billing services of the following matters: <Amended by Act No. 10560, Apr. 5, 2011; Act No. 12681, May 28, 2014> |
| 1. | Date and time telecommunications billing services are used; |
| 2. | Trade name and contact information of the other party (referring to a person who sells and/or provides goods/services in a transaction through telecommunications billing services; hereinafter referred to as “other party to a transaction”); |
| 3. | Amount purchased/used through telecommunications billing services and details thereof; |
| 4. | Methods of raising an objection and contact information. |
| (2) | A provider of telecommunications billing services shall provide users of telecommunications billing services with a method by which users can verify the details of purchase and use, and shall also furnish a user, upon request, with a written statement on the details of purchase and use (including an electronic document; hereinafter the same shall apply) within two weeks from the date requested. |
| (3) | A user of telecommunications billing services discovers that the telecommunications billing services have been rendered against his/her will, he/she may request the provider of telecommunications billing services to make corrections (excluding cases where there is an intentional act or negligence on the part of the user of the telecommunications billing services), and where the provider of telecommunications billing services finds that the user's request for making corrections is reasonable, he/she shall withhold the payment of the price for use to a seller and notify the user of the results thereof within two weeks from the date such correction was requested. <Amended by Act No. 12681, May 28, 2014> |
| (4) | Every provider of telecommunications billing services shall preserve records of telecommunications billing services during the period, within the limit of five years, prescribed by Presidential Decree. |
| (5) | Where a provider of telecommunications billing services (a person who provides services under Article 2 (1) 10 (a)) provides telecommunications billing services or increases the upper limits of use, it shall obtain consent from a user of the relevant telecommunications billing services in advance. <Added by Act No. 12681, May 28, 2014> |
| (6) | When a provider of telecommunications billing services (a person who provides services under Article 2 (1) 10 (a)) amends any of the contractual terms and conditions, he/she shall notify users of the amendment thereof one month prior to the effective date of the amended contractual terms and conditions. In such cases, a user who has an objection to the amended contractual terms and conditions may terminate the contract for telecommunications billing services. <Added by Act No. 12681, May 28, 2014> |
| (7) | The period, types, and scope of the details of purchase and use which a provider of telecommunications billing services should provide pursuant to paragraph (2), types and methods of preservation of the records which a provider of telecommunications billing services should preserve pursuant to paragraph (4), and matters necessary for the termination of the contract, such as methods of notifying amendment to the contractual terms and conditions, the period and procedures for raising an objection, shall be prescribed by Presidential Decree. <Amended by Act No. 12681, May 28, 2014> |
| (8) | The Minister of Science, ICT, and Future Planning shall prescribe and provide a public notice of matters necessary for methods for giving consent, etc. under paragraph (5). <Added by Act No. 12681, May 28, 2014> |
| (9) | The Minister of Science, ICT, and Future Planning may prescribe and give a public notice of detailed matters concerning methods for settling accounts, etc. so that telecommunications billing services are not provided against the will of users of telecommunications billing services. <Added by Act No. 12681, May 28, 2014> |
[This Article Added by Act No. 8778, Dec. 21, 2007]
| Article 59 (Dispute Resolution) |
| (1) | Every provider of telecommunications billing services may install and operate an institution or organization that voluntary resolves disputes to protect rights and interests of users. |
| (2) | Every provider of telecommunications billing services shall prepare a procedure for raising an objection by users of telecommunications billing services in connection with the services and redressing damages to their rights, as prescribed by Presidential Decree, and where he/she enters into a contract for telecommunications billing services, he/she shall stipulate such procedure in the terms and conditions of the contract. <Amended by Act No. 12681, May 28, 2014> |
[This Article Added by Act No. 8778, Dec. 21, 2007]
| Article 60 (Liability for Damages) |
| (1) | A provider of telecommunications billing services shall be liable for damages caused to a user of the telecommunications billing services while rendering the services: |
| (2) | A provider of telecommunications billing services shall negotiate with the claimant to damages for agreement on compensation for the damages under paragraph (1). |
| (3) | If parties fail to or are unable to reach an agreement on compensation for damages under paragraph (2), either party may file an application for decision with the Korea Communications Commission. <Amended by Act No. 8867, Feb. 29, 2008> |
[This Article Added by Act No. 8778, Dec. 21, 2007]
| Article 61 (Restriction on Use of Telecommunications Billing Services) |
The Minister of Science, ICT and Future Planning may order a provider of telecommunications billing services to deny, suspend, or place a restriction on the services against a person falling under any of the following subparagraphs: <Amended by Act No. 8867, Feb. 29, 2008; Act No. 11048, Sep. 15, 2011; Act No. 11690, Mar. 23, 2013>
| 1. | A person who sells, lends, provides any unwholesome medium for juvenile to juvenile in violation of Article 16 of the Juvenile Protection Act; |
| 2. | A person who undermines interests of users of telecommunications billing services seriously by enticing the users to purchase or use goods or services in any of the following means: |
| (a) | Transmitting any advertising information for profit in violation of Article 50; |
| (b) | Deceiving or enticing users of telecommunications billing services wrongfully; |
| 3. | A person who sells or renders goods or services prohibited by this Act or any other Act. |
[This Article Added by Act No. 8778, Dec. 21, 2007]
CHAPTER VIII INTERNATIONAL COOPERATION
| Article 62 (International Cooperation) |
The Government shall maintain cooperate reciprocally with other nations or international organizations in carrying out the following affairs:
| 1. | Affairs related to the transfer of personal information between nations and the protection of personal information; |
| 2. | Affairs for the protection of juvenile in information and communications networks; |
| 3. | Affairs for the prevention of acts that undermine safety of information and communications networks; |
| 4. | Other affairs for the facilitation of sounder and safer use of information and communications services. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 63 (Protection of Personal Information Transferred Abroad) |
| (1) | Any provider of information and communications services or similar shall not conclude an international contract with any term or condition in violation of this Act with respect to personal information of users. |
| (2) | A provider, etc. of information and communications services shall obtain consent of the users in the case of intending to provide (including being inquired of), entrust management of, or deposit, such users’ personal information, to overseas (hereafter referred to as “transfer” in this Article): |
| (3) | A provider of information and communications services or similar who desires to obtain the consent under paragraph (2) shall notify the relevant user of all the following matters in advance: |
| 1. | Items of the personal information transferred; |
| 2. | A nation to which the personal information is to be transferred, the date and time, and methods of transfer; |
| 3. | The name of the person to whom the personal information is to be transferred (referring to the name of a legal entity and the contact information of the person responsible for management of information, if the person is a legal entity); |
| 4. | The purposes of use of the person to whom the personal information is to be transferred, and the period of time for possession and use of the personal information. |
| (4) | A provider of information and communications services or similar shall, when it transfers personal information to abroad with consent under paragraph (2), take protective measures, as prescribed by Presidential Decree. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
CHAPTER IX SUPPLEMENTARY PROVISIONS
| Article 64 (Submission of Data) |
| (1) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission may require a provider of information and communications services or similar (including a person to whom this Article shall apply |
| 1. | If he/she becomes aware of a violation or suspected violation of this Act; |
| 2. | If he/she receives a report or petition on a violation of this Act; |
| 2-2. | If it occurs, or is likely to occur, an event/accident or others which noticeably damages safety and reliability of users’ information; |
| 3. | If there is any other ground specified by Presidential Decree to believe that it is necessary for the protection of users. |
| (2) | The Korea Communications Commission may, when it intends to take the following measures against a person who transmitted any advertising information for profit in violation of this Act, request a provider of information and communications services or similar to let it peruse or to submit data of the person who transmitted the advertising information, such as the name, address and national identification number of the person and the period of time of access: |
| 1. | Corrective measures under paragraph (4); |
| 2. | Imposition of administrative fines under Article 76; |
| 3. | Any similar measures. |
| (3) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission may, if a provider, etc. of information and communications services fails to submit data under paragraph (1) or (2) or if it is found that a provider of information and communications services or similar has violated this Act, assign public officials under his/her control to enter the place of business of the person concerned related to the such violation of this Act, including the provider, etc. of information and communications services, to inspect the current status of business, account books, documents, and others. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013; Act No. 14080, Mar. 22, 2016> |
| (4) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission may order a provider of information and communications services or similar who violated this Act to take corrective measures as may be necessary to stop or correct the violation, and may also require a provider of information and communications services or similar to whom it was ordered to take corrective measures to announce to the public the fact that it received the order to take such corrective measures. In such cases, the matters necessary for the method, guidelines, and procedure for the public announcement and other related matters shall be prescribed by Presidential Decree. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (5) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission may, when he/she issued an order to take corrective measures as may be necessary pursuant to paragraph (4), disclose to the public the fact that he/she issued the order to take corrective measures. In such cases, the matters necessary for the method, guidelines, and procedure for the public disclosure and other related matters shall be prescribed by Presidential Decree. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (6) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission shall, when he/she demands submission or inspection of data or other materials pursuant to paragraph (1) or (2), give a written notice (including an electronic document), specifically stating the reasons and legal authority for such demand, the time limit for submission or the date and time for inspection, the details of data subject to the submission or inspection, and other related matters. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (7) | When a inspection under paragraph (3) is to be conducted, the plan for the inspection, including the date and time of, and the reasons for and details of the inspection, shall be notified to the relevant provider of information and communications services or similar no later than seven days before the commencement of the inspection: |
| (8) | The public officials who inspect pursuant to paragraph (3) shall carry an identification indicating their authority with them to present it to people concerned, and shall deliver to the people concerned a document stating their names, the time and purposes of access, and other related matters, whenever they access to a place of business. |
| (9) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission shall, where he/she receives, peruses, or inspects data or any other material submitted pursuant to any provision of paragraphs (1) through (3), notify the relevant provider of information and communications services or similar of the results thereof (including the details of disposition, in cases where he/she intends to make a disposition, such as an order to take corrective measures, as a result of the inspection) in writing. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (10) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission may ask technical advice or any other support of the head of the Internet and Security Agency as may be necessary in demanding submission of data or conducting an inspection pursuant to paragraphs (1) through (4). <Amended by Act No. 9637, Apr. 22, 2009; Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (11) | The demand for submission of data or any other materials and the inspections under paragraphs (1) through (3) shall be limited to the least extent necessary for the enforcement of this Act, and shall be not abused for any other purpose. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 64-2 (Protection and Destruction of Data, etc.) |
| (1) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission shall not, if asked by a provider of information and communications services or similar to protect documents, data, or any other materials submitted or collected pursuant to Article 64, furnish them to a third party or disclose them to the general public. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (2) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission shall, when having received data submitted through an information and communications network or converted collected data or any other materials into an electronic format, take systematic and technical measures for security to protect personal information, trade secret, or similar from being leaked. <Amended by Act No. 10465, Mar 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (3) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission shall, if any of the following events occurs, immediately destroy documents, data, or any other materials submitted or collected pursuant to Article 64, except as specifically provided for otherwise by any other Act. The same shall apply to a person to whom the authority of the Minister of Science, ICT and Future Planning or the Korea Communications Commission has been delegated or entrusted in whole or in part under Article 65: <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| 1. | If the objectives of demanding submission of data, conducting a field inspection, or issuing an order to take corrective measures pursuant to Article 64 have been achieved; |
| 2. | If an administrative trial or administrative litigation is filed against an order issued to take corrective measures pursuant to Article 64 (4), when proceedings of such administrative trial are completed; |
| 3. | If a disposition is made to impose an administrative fine under Article 76 (4) and there is no objection to it, when the time period to raise an objection under paragraph (5) ends; |
| 4. | If there is an objection filed against disposition of an administrative fine under Article 76 (4), when the proceedings for the non-contentious case procedure are closed at the competent court. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 64-3 (Imposition, etc. of Penalty Surcharges) |
| (1) | The Korea Communications Commission may impose, on a provider of information and communications services or similar, an amount equivalent to 3/100 or less of its sales related to a violation as a penalty surcharge, where he/she performs any of the following acts: <Amended by Act No. 11322, Feb. 17, 2012; Act No. 12681, May 28, 2014; Act No. 14080, Mar. 22, 2016> |
| 1. | Where he/she collects personal information without consent of the relevant user in violation of Article 22 (1) (including cases where Article 22 (1) shall apply |
| 2. | Where he/she collects personal information that is likely to seriously undermine rights, interests, or privacy of a person without consent of the relevant user in violation of Article 23 (1) (including cases where Article 23 (1) shall apply |
| 3. | Where he/she uses personal information in violation of Article 24 (including cases where Article 24 shall apply |
| 4. | Where he/she furnishes a third party with personal information in violation of Article 24-2 (including cases where Article 24-2 shall apply |
| 5. | Where he/she entrusts a third party with the management of personal information without consent of the relevant user in violation of Article 25 (1) (including cases where Article 25 (1) shall apply |
| 5-2. | Where a trustee violates the provisions of Chapter IV because it has neglected its control, supervision or education under Article 25 (4) (including cases where Article 25 (4) shall apply |
| 6. | Where he/she has lost, stolen, divulged, forged, altered, or mutilated a user's personal information, and not taken measures under Article 28 (1) 2 through 5 (including cases where Article 28 (1) 2 through 5 shall apply |
| 7. | Where he/she collects personal information of a child under 14 years old without consent of his/her legal representative in violation of Article 31 (1) (including cases where Article 31 (1) shall apply |
| 8. | Where he/she provides any user’s personal information to overseas without obtaining consent from the user in violation of the main sentence of Article 63 (2). |
| (2) | Where a provider of information and communications services or similar on whom penalty surcharge under paragraph (1) has been imposed refuses to submit data for computation of its sales or submits any false data, the sales may be estimated on the basis of accounting records such as financial statements, and the current status of business, such as the number of subscribers and the service charges of other providers of information and communications services which is similar in size: |
| (3) | The Korea Communications Commission shall, when it intends to impose penalty surcharge under paragraph (1), take the following factors into consideration: |
| 1. | The substance and degree of the violation; |
| 2. | The duration and frequency of the violation; |
| 3. | The amount of profits acquired by the violation. |
| (4) | The penalty surcharge under paragraph (1) shall be computed by taking the factors under paragraph (3) into consideration, but the specific guidelines and procedures for the computation shall be prescribed by Presidential Decree. |
| (5) | The Korea Communications Commission shall, if a person who is obligated to pay penalty surcharges under paragraph (1) fails to pay them by a deadline, collect an additional charge equivalent to 6/100 of the unpaid penalty surcharge per annum beginning on the day immediately following the deadline. |
| (6) | The Korea Communications Commission shall, if a person who is obligated to pay penalty surcharges under paragraph (1) fails to pay them by a deadline, remind the person to pay them within a period of time prescribed by the Commission, and shall collect them in accordance with the precedents for disposition against default on national taxes, if the person fails to pay the penalty surcharges and the additional charges under paragraph (5) within the prescribed period of time. |
| (7) | Where penalty surcharges imposed pursuant to paragraph (1) shall be refunded due to a judgment of a court or any other reason, an additional amount equivalent to 6/100 of the penalty surcharge per annum shall be paid from the date the penalty surcharges are paid and until the date they are refunded. |
[This Article Added by Act No. 9119, Jun. 13, 2008]
| Article 64-4 (Hearing) |
The Minister of Science, ICT and Future Planning or the Korea Communications Commission shall hold a hearing in cases falling under any of the following subparagraphs:
| 1. | in the case of intending to revoke the designation of a certification body in accordance with Article 9 (2); |
| 2. | in the case of intending to revoke the designation of an identification service agency in accordance with Article 23-4 (1); |
| 3. | in the case of intending to revoke certification of an information security management system in accordance with Article 47 (10) (including cases where Article 47 (10) applies |
| 4. | in the case of intending to revoke the designation of a certification body for information security management system in accordance with Article 47-2 (1) (including cases where Article 47-2 (1) applies |
| 5. | in the case of intending to revoke any rate of information security management system in accordance with Article 47-5 (4); |
| 6. | in the case of intending to revoke the registration in accordance with Article 55 (1). |
[This Article Added by Act No. 13520, Dec. 1, 2015]
| Article 65 (Delegation and Entrustment of Authority) |
| (1) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission may delegate or entrust part of his/her authority under this Act to the heads of agencies under the control of the Ministry of Science, ICT and Future Planning or the presidents of the regional Korea posts, as prescribed by Presidential Decree. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (2) | The Minister of Science, ICT and Future Planning may entrust projects under Article 13 for facilitating the use of information and communications networks to the National Information Society Agency under Article 14 of the Framework Act on National Informatization, as prescribed by Presidential Decree. <Amended by Act No. 11690, Mar. 23, 2013> |
| (3) | The Minister of Science, ICT and Future Planning or the Korea Communications Commission may entrust the Internet and Security Agency with business affairs related to demanding submission of data and conducting inspections pursuant to Article 64 (1) and (2), as prescribed by Presidential Decree. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (4) | Article 64 (8) shall apply |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 65-2 Deleted. <by Act No. 7812, Dec. 30, 2005> |
| Article 66 (Confidentiality. etc.) |
A person who engages or engaged in a job related to any of the following business affairs shall not divulge to another person any secret that he/she has learned while performing his/her duties, nor use it for any purpose other than performance of his/her duties: Provided , That the same shall not apply if any other Act specifically provides otherwise: <Amended by Act No. 11322, Feb. 17, 2012>
| 1. | Deleted; <by Act No. 10465, Mar. 29, 2011>; |
| 2. | Certification of information security management system under Article 47; |
| 2-2. | Affairs of the certification of personal information management system pursuant to Article 47-3; |
| 3. | Assessment of information protection systems under Article 52 (3) 4; |
| 4. | Deleted; <by Act No. 11322, Feb. 17, 2012> ; |
| 5. | Conciliation of disputes by the defamation dispute conciliation division under Article 44-10. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 67 (Application Mutatis Mutandis to Broadcasting Business Operator) |
| (1) | Chapter 4 shall apply |
| (2) | Articles 22, 23, 23-2 through 23-4, 24, 24-2, 26, 26-2, 27, 27-2, 27-3, 28, 28-2, 29, 30, 30-2 and 31 shall apply |
[This Article Added by Act No. 11322, Feb. 17, 2012]
| Article 68 Deleted. <by Act No. 10165, Mar. 22, 2010> |
| Article 68-2 Deleted <by Act No. 13343, Jun. 22, 2015> |
| Article 69 (Legal Fiction as Public Official in Application of Penalty Provisions) |
Executives and employees of the National Information Society Agency and the Internet and Security Agency who engage in the business affairs entrusted by the Minister of Science, ICT and Future Planning or the Korea Communications Commission pursuant to Article 65 (2) or (3) shall be deemed public officials in applying Articles 129 through 132 of the Criminal Act. <Amended by Act No. 9637, Apr. 22, 2009; Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013>
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 69-2 (Accusation) |
| (1) | In cases where an act falling under any subparagraph of Article 64-3 (1) is deemed existing, the Korea Communications Commission may accuse the responsible provider of information and communications services or similar to the local prosecutor’s office or other investigative agencies. |
| (2) | The Korea Communications Commission may recommend a provider, etc. of information and communications services violating this Act with respect to the protection of personal information to take disciplinary action against the responsible person (including its representative and responsible executive officers). In this case, the person in receipt of such recommendation shall have regard thereto and notify the Korea Communications Commission of the result thereof. <Added by Act No. 14080, Mar. 22, 2016> |
[This Article Added by Act No. 11322, Feb. 17, 2012>
CHAPTER X PENALTY PROVISIONS
| Article 70 (Penalty Provisions) |
| (1) | A person who commits defamation of another person by disclosing a fact to the public through an information and communications network purposely to disparage his/her reputation shall be punished by imprisonment with labor for up to three years, or by fine not exceeding 30 million won. <Amended by Act No. 12681, May 28, 2014> |
| (2) | A person who commits defamation of another person by disclosing a false fact to the public through an information and communications network purposely to disparage his/her reputation shall be punished by imprisonment with labor for up to seven years, by suspension of qualification for up to ten years, or by fine not exceeding 50 million won. |
| (3) | The public prosection may not prosecute a person who committed a crime under paragraph (1) or (2) against the victim's will explicitly manifested. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 70-2 (Penalty Provisions) |
A person who conveys or spread a malicious program in violation of Article 48 (2) shall be punished by imprisonment with labor of up to seven years or by fine not exceeding 70 million won.
[This Article Added by Act No. 14080, Mar. 22, 2016]
| Article 71 (Penalty Provisions) |
Any of the following persons shall be punished by imprisonment with labor for up to five years or by fine not exceeding 50 million won: <Amended by Act No. 14080, Mar. 22, 2016>
| 1. | A person who collects personal information without consent of the relevant user in violation of Article 22 (1) (including cases to which the aforesaid provision shall apply |
| 2. | A person who collects personal information that is likely to seriously undermine rights, interests, or privacy of an individual without consent of the relevant user in violation of Article 23 (1) (including cases to which the aforesaid provision shall apply |
| 3. | A person who uses or furnishes a third party with personal information, or who knowingly received such personal information for profit or for any other wrongful purpose, in violation of Article 24, 24-2 (1) or (2), or 26 (3) (including cases to which any of the aforesaid provisions shall apply |
| 4. | A person who entrusts someone with management of personal information without consent of the relevant user in violation of Article 25 (1) (including cases to which the aforesaid provision shall apply |
| 5. | A person who mutilates, infringes, or divulges personal information in violation of Article 28-2 (1) (including cases to which the aforesaid provision shall apply |
| 6. | A person who knowingly receives any divulged personal information for profit or for any other wrongful purpose in violation of Article 28-2 (2); |
| 7. | A person who furnishes someone with personal information or uses thereof without taking necessary measures in violation of Article 30 (5) (including cases to which the aforesaid provision shall apply |
| 8. | A person who collects personal information of a child under 14 years old without consent of his/her legal representative in violation of Article 31 (1) (including cases to which the aforesaid provision shall apply |
| 9. | A person who intrudes on an information and communications network in violation of Article 48 (1); |
| 10. | A person who causes a trouble to an information and communications network in violation of Article 48 (3); |
| 11. | A person who mutilates another person's information or who infringes, misappropriates, or divulges another person's secret in violation of Article 49. |
| (2) | An attempt to commit a crime referred to in paragraph (1) 9 shall be punished. <Added by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 72 (Penalty Provisions) |
| (1) | A person falling under any of the following subparagraphs shall be punished by imprisonment with labor for up to three years or by a fine not exceeding 30 million won: <Amended by Act No. 12014, Jan. 20, 2015; Act No .13343 Jun. 22, 2015> |
| 1. | Deleted; <by Act No. 14080, Mar. 22, 2016> |
| 2. | A person who collects another person's personal information in violation of Article 49-2 (1); |
| 2-2. | A person who transmits any advertising information in violation of Article 50-8 by using the situation of any large-scale disaster under Article 14 (1) of the Framework Act on the Management of Disasters and Safety; |
| 3. | A person who carries on a business without the registration under Article 53 (1); |
| 4. | A person who lends a loan to someone or intermediates such loan by committing any of the following acts: |
| (a) | Conducting, or engaging someone to conduct vicariously, a transaction through telecommunications billing services by pretending sale or supply of goods or services or billing more than an actual selling price; |
| (b) | Engaging a user of telecommunications billing services to purchase or use certain goods or services through telecommunications billing services and then purchasing, at a discount, the goods or services purchased or used by the user of telecommunications billing services; |
| 5. | A person who divulges to another person any secret known to him/her while performing his/her duties or uses such secret for any purpose other than his/her duties in violation of Article 66. |
| (2) | Deleted. <by Act No. 14080, Mar. 22, 2016> |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 73 (Penalty Provisions) |
Any of the following persons shall be punished by imprisonment with labor for not more than two years or by a fine not exceeding 20 million won: <Amended by Act No. 12681, May 28, 2014; Act No. 14080, Mar. 22, 2016>
| 1. | A person who has a user's personal information lost, stolen, leaked, forged, altered, or damaged because he/she has not taken technical and administrative measures under any provision of Article 28 (1) 2 through 5 (including cases where the aforesaid provision is applied |
| 1-2. | A person who fails to destroy personal information, in violation of Article 29 (1) (including cases where the aforesaid provision is applied |
| 2. | A person who provides an unwholesome medium for juveniles for profit without labeling it as an unwholesome medium in violation of Article 42; |
| 3. | A person who transmits to a juvenile any information containing advertisement of an unwholesome medium for juveniles or displays such information openly without taking any measures to restrict access by juveniles in violation of Article 42-2; |
| 4. | A person who uses a user's information for any purpose other than filing a civil or criminal lawsuit in violation of Article 44-6 (3); |
| 5. | A person who fails to perform an order of the Korea Communications Commission under Article 44-7 (2) or (3); |
| 6. | A person who fails to preserve relevant data in violation of an order issued pursuant to Article 48-4 (3); |
| 7. | A person who entices another person to furnish him/her with personal information in violation of Article 49-2 (1); |
| 8. | A person who fails to perform an order issued pursuant to Article 61. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 74 (Penalty Provisions) |
| (1) | Any of the following persons shall be punished by imprisonment with labor for up to one year or by a fine not exceeding 10 million won: <Amended by Act No. 11322, Feb. 17, 2012; Act No. 12681, May 28, 2014> |
| 1. | A person who puts any similar label on a product or sells a product bearing any similar label, or who displays such product with intent to sell it, in violation of Article 8 (4); |
| 2. | A person who distributes, sells, lends, or openly displays any obscene codes, letters, sound, images, or motion pictures in violation of Article 44-7 (1) 1; |
| 3. | A person who makes any codes, letters, sound, images, or motion pictures arousing fear or apprehension reach another person repeatedly in violation of Article 44-7 (1) 3; |
| 4. | A person who takes measures, in violation of Article 50 (5); |
| 5. | Deleted. <by Act No. 12681, May 28, 2014> |
| 6. | A person who transmits any advertising information, in violation of Article 50-8; |
| 7. | A person who fails to file for any revision to registration, or who fails to file a report on transfer, acquisition, merger, or inheritance of business, in violation of Article 53 (4). |
| (2) | The public prosecution may not prosecute a person who committed a crime under paragraph (1) 3 against the victim's will explicitly manifested. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
| Article 75 (Joint Penalty Provisions) |
If a representative of a corporation, or an agent, an employee, or other servant of the corporation commits a violation under Articles 71 through 73 or 74 (1) in connection with the business of the corporation or the individual, not only shall such violator be punished accordingly, but the corporation or the individual shall be punished by a fine under the relevant Article: Provided , That this shall not apply where the corporation or individual has not been negligent in giving the due attention and supervision concerning the relevant duties to prevent such violation.
[This Article Amended by Act No. 10138, Mar. 17, 2010]
| Article 75-2 (Confiscation and Additional Collection) |
Money and goods, or other profits received by a person committing any offence referred to in Article 71 (1) 1 through 8, Article 72 (1) 2, and subparagraphs 1, 1-2 and 7 of Article 73 with respect to the relevant violation may be confiscated, and if impossible to confiscate such money and goods or other profits, the value thereof may be additionally collected. In this case, the penalty of confiscation or additional collection may be imposed in addition to any other penalty.
[This Article Added by Act No. 14080, Mar. 22, 2016]
| Article 76 (Administrative Fines) |
| (1) | Any of the following persons and a person who made a third party commit an act falling under subparagraphs 7 through 11, shall be punished by an administrative fine not exceeding 30 million won: <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11322, Feb. 17, 2012; Act No. 11690, Mar. 23, 2013; Act No. 12681, May 28, 2014; Act No. 13520, Dec. 1, 2015; Act No. 14080, Mar. 22, 2016> |
| 1. | A person who refuses to provide services, in violation of Article 22-2 (2), or Article 23 (3) (including where the aforesaid provisions shall apply |
| 1-2. | A person who fails to take measures necessary to protect users’information such as devising methods for users to give or revoke consent to access authority, in violation of Article 22-2 (3) (including where the aforesaid provision shall apply |
| 2. | A person who collects or uses resident registration numbers in violation of Article 23-2 (1) or fails to take necessary measures in violation of Article 23-2 (2) (including cases where the aforesaid provision applies |
| 2-2. | A person who either fails, in obtaining consent to provision of personal information or entrustment of management thereof, to obtain it separately from consent to collection and use of personal information, or refuses to provide services on the ground that there exists no consent to such provision or entrustment, in violation of Article 24-2 (3) (including cases where Article 24-2 (3) shall apply |
| 2-3. | A person who fails to give notice or report to users, the Korea Communications Commission, and the Korea Internet Security Agency, in violation of Article 27-3 (1) (including where the aforesaid provision shall apply |
| 2-4. | A person who fails to provide an explanation under Article 27-3 (3) or makes a false explanation; |
| 3. | A person who fails to take technical and administrative measures under Article 28 (1) (including cases to which the aforesaid provisions shall apply |
| 4. | A person who fails to take measures, such as the destruction of personal information, in violation of Article 29 (2) (including cases where the aforesaid provision apply |
| 5. | A person who fails to take necessary measures, in violation of Article 30 (3), (4), or (6) (including cases to which the aforesaid provisions shall apply |
| 5-2. | A person who fails to notify details of personal information used, in violation of the main sentence of Article 30-2 (1) (including cases to which the aforesaid provisions shall apply |
| 6. | Deleted. <by Act No. 12681, May 28, 2014> |
| 6-2. | A person who fails to report the designation of the chief information protection officer, in violation of Article 45-3 (1); |
| 6-3. | A person who fails to receive certification of an information security management system in violation of Article 47 (2); |
| 7. | A person who transmits any advertising information for profit, in violation of Article 50 (1) through (3); |
| 8. | A person who fails to state the matters required to be stated, or who states false information on such matters, when he/she transmitted any advertising information, in violation of Article 50 (4); |
| 9. | A person who makes an addressee bear the burden of any expense, in violation of Article 50 (6); |
| 9-2. | A person who fails to verify whether an addressee gives consent to receive advertising information, in violation of Article 50 (8); |
| 10. | A person who installs a program without consent of the relevant user, in violation of Article 50-5; |
| 11. | A person who posts any advertising information for profit on an Internet webpage, in violation of Article 50-7 (1) or (2); |
| 12. | A person who fails to observe an order issued by the Minister of Science, ICT and Future Planning or the Korea Communications Commission pursuant to Article 64 (4) in violation of this Act. |
| (2) | Any of the following persons shall be punished by an administrative fine not exceeding 20 million won: <Amended by Act No. 14080, Mar. 22, 2016> |
| 1. | A person who fails to disclose or notify the matters concerning the entrustment of management of personal information to users, in violation of Article 25 (2) (including cases to which the aforesaid provision shall apply |
| 1-2. | A person who re-entrusts a third party with the management of personal information without obtaining a consent from a provider, etc. of information and communications, in violation of Article 25 (7) (including cases to which the aforesaid provision shall apply |
| 2. | A person who fails to notify a user of transfer of personal information in violation of Article 26 (1) or (2) (including cases to which the aforesaid provision shall apply |
| 3. | A person who fails to designate a person responsible for protection of personal information, in violation of Article 27 (1) (including cases to which the aforesaid provision shall apply |
| 4. | A person who fails to disclose the policy on managing personal information, in violation of Article 27-2 (1) (including cases to which the aforesaid provision shall apply |
| 5. | A person who discloses all the matters referred to in each subparagraph of Article 63 (3) in violation of the proviso to Article 63 (2) or entrusts the management of, or deposits, user’s personal information, to overseas without informing the user. |
| (3) | Any of the following persons shall be punished by an administrative fine not exceeding 10 million won: <Amended by Act No. 9637, Apr. 22, 2009; Act No. 10560, Apr. 5, 2011; Act No. 11322, Feb. 17, 2012; Act No. 12681, May 28, 2014; Act No. 13520, Dec. 1, 2015; Act No. 14080, Mar. 22, 2016> |
| 1. | and 2. Deleted; <by Act No. Act No.13343 Jun. 22, 2015> |
| 2-2. | A person who engages in the identification service without being designated as the identification service agency, in violation of Article 23-3 (1); |
| 2-3. | A person who fails to notify the suspension of identification service under Article 23-3 (2) or the discontinuation of identification service under Article 23-3 (3) to users or report the same to the Korea Communications Commission; |
| 2-4. | A person who continuously engages in identification service notwithstanding disposition for suspension of identification service and cancelation of the identification service agency under Article 23-4 (1); |
| 2-5. | A person who fails to entrust in writing the management of personal information in violation of Article 25 (6) (including cases to which the aforesaid provision shall apply |
| 3. | A person who fails to designate a person responsible for protection of juveniles in violation of Article 42-3 (1); |
| 4. | A person who fails to preserve information, in violation of Article 43; |
| 5. | A person who fails to be subscribed insurance, in violation of Article 46 (2); |
| 6. | Deleted; <by Act No. 13520, Dec. 1, 2015>; |
| 7. | A person who falsely advertises details of the certification he/she has obtained, in violation of Article 47 (9); |
| 8. | and 9. Deleted; <by Act No. 11322, Feb. 17, 2012> |
| 10. | A person who fails to give notice to users of software, in violation of Article 47-4 (3); |
| 11. | A person who fails to comply with an order issued pursuant to Article 48-2 (4) to take corrective measures; |
| 11-2. | A person who fails to report any intrusion, in violation of Article 48-3 (1); |
| 12. | A person who interferes with, refuses, or evades access to the place of business to conduct an inspection under Article 48-4 (4); |
| 12-2. | A person who fails to comply with an order issued by the Minister of Science, Information and Communications Technology (ICT) and Future Planning, or the Korea Communications Commission, in violation of Article 49-2 (4); |
| 12-3. | A person who fails to inform the results of handling the consent to receive, refusal to receive, or revocation of consent to receive, advertising information, in violation of Article 50 (7); |
| 12-4. | A person who fails to take necessary measures, in violation of Article 50-4 (4); |
| 13. | A person who uses the name of the Korea Internet and Security Agency, in violation of Article 52 (6); |
| 14. | A person who fails to file a report on cessation, discontinuance, or dissolution of business, in violation of Article 53 (4); |
| 15. | A person who fails to report a standard contract form, in violation of Article 56 (1); |
| 16. | A person who fails to take administrative or technical measures, in violation of Article 57 (2); |
| 17. | A person who fails to notify a user of telecommunications billing services of the date and time, etc. when the aforementioned services are used, in violation of Article 58 (1); |
| 18. | A person who fails to provide a user of telecommunications billing services with the method by which the user can verify the details of purchase or use, or who fails to comply with a request by a user of telecommunications billing services to provide such method, in violation of Article 58 (2); |
| 19. | A person who fails to withhold the payment of the price though a request for making a correction on a telecommunications bill which he/she has received from a user of telecommunications billing services is reasonable or to notify the user of telecommunications billing services of the results of the measures taken in response to a request of the user, in violation of Article 58 (3); |
| 20. | A person who fails to preserve records of telecommunications billing services, in violation of Article 58 (4); |
| 20-2. | A person who provides telecommunications billing services or increases the amount of the upper limits of use without obtaining consent from a user of telecommunications billing services, in violation of Article 58 (5); |
| 20-3. | A person who fails to give notice concerning amendment to the contractual terms and conditions of telecommunications billing services, in violation of Article 58 (6); |
| 21. | A person who fails to prepare the procedure for raising an objection by users of telecommunications billing services and redressing their infringed rights, or to stipulate such procedure when he/she enters into a contract for telecommunications billing services, in violation of Article 59 (2); |
| 22. | A person who fails to submit, or who falsely submitted, goods, documents, or any other material under Article 64 (1); |
| 23. | A person who fails to comply with a request for inspection or submission of data under Article 64 (2); |
| 24. | A person who refuses, interferes with, or evades the access and inspection under Article 64 (3). |
| (4) | The administrative fines prescribed in paragraphs (1) through (3) shall be imposed and collected by the Minister of Science, ICT and Future Planning or the Korea Communications Commission, as prescribed by Presidential Decree. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (5) | A person who is dissatisfied with disposition to impose a fine for negligence under paragraph (4) may file an objection with the Minister of Science, ICT and Future Planning or the Korea Communications Commission within 30 days from the date which he/she is notified of such disposition. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (6) | The Minister of Science, ICT, and Future Planning, or the Korea Communications Commission shall, upon receiving an objection filed in accordance with paragraph (5) by a person dissatisfied with the disposition for an administrative fine under paragraph (4), notify the competent court of the objection without delay, and the competent court shall, upon receiving such notice, put the case to trial on fines for negligence pursuant to the Non-Contentious Case Procedure Act. <Amended by Act No. 10465, Mar. 29, 2011; Act No. 11690, Mar. 23, 2013> |
| (7) | Where neither objection is raised nor an administrative fine paid within a period prescribed in paragraph (5), the administrative fine shall be collected in the same manner as delinquent national taxes are collected. |
[This Article Wholly Amended by Act No. 9119, Jun. 13, 2008]
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force on July 1, 2001.
Article 2 (Transitional Measures following Change of Basis for Establishing Korea Information Security Center and of Its Name)
| (1) | The Korea Information Security Center established pursuant to Article 14-2 of the Framework Act on National Informatization at the time that this Act enters into force shall be deemed the Korea Information Security Agency established pursuant to Article 52 of this Act. |
| (2) | Any act performed by and any legal relations maintained by the Korea Information Security Center at the time when this Act enters into force shall be deemed performed and maintained by the Korea Information Security Agency. |
| (3) | The name of the Korea Information Security Center on the register book and other public registers at the time when this Act enters into force shall be deemed the name of the Korea Information Security Agency. |
Article 3 (Transitional Measures Following Change of Name of Korea Information and Communications Promotion Association)
| (1) | The Korea Information and Communications Promotion Association as at the time when this Act enters into force shall be deemed the Korea Association of Information and Telecommunication. |
| (2) | Any act performed and any legal relations maintained by the Korea Information and Communications Promotion Association at the time when this Act enters into force shall be deemed performed and maintained by the Association. |
| (3) | The name of the Korea Information and Communications Promotion Association on the register book and other public registers at the time that this Act enters into force shall be deemed the name of the Korea Association of Information and Telecommunication. |
Article 4 (Transitional Measures concerning Application of Penalty Provisions)
The application of the penal provisions to any act committed prior to the enforcement of this Act shall be governed by the previous provisions.
Article 5 Omitted.
Article 6 (Relations to Other Statutes)
If other Acts and subordinate statutes cite the former Act on Promotion, etc. of Utilization of Information System or the provisions thereof at the time this Act enters into force and if there exist corresponding provisions thereto in this Act, this Act or the corresponding provisions in this Act shall be regarded as being cited.
ADDENDA <Act No. 6585, Dec. 31, 2001>
Article 1 (Enforcement Date)
This Act shall enter into force on April 1, 2002.
Articles 2 through 4 Omitted.
ADDENDA <Act No. 6797, Dec. 18, 2002>
| (1) | (Enforcement Date) This Act shall enter into force after the lapse of one month from the date of its promulgation: |
| (2) | (Transitional Measures concerning Application of Administrative Fine) The application of the administrative fine to the act of violation committed prior to the enforcement of this Act shall be governed by the previous provisions. |
ADDENDA <Act No. 7139, Jan. 29, 2004>
| (1) | (Enforcement Date) This Act shall enter into force on the date of its promulgation: |
| (2) | (Transitional Measures concerning Application of Administrative Fines) The application of the administrative fine to the act of violation committed prior to the enforcement of this Act shall be governed by the previous provisions. |
ADDENDA <Act No. 7142, Jan. 29, 2004>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Articles 2 through 4 Omitted.
ADDENDUM <Act No. 7262, Dec. 30, 2004>
This Act shall enter into force three months after the date of its promulgation.
ADDENDA <Act No. 7796, Dec. 29, 2005>
Article 1 (Enforcement Date)
This Act shall enter into force on July 1,2006.
Articles 2 through 6 Omitted.
ADDENDUM <Act No. 7812, Dec. 30, 2005>
This Act shall enter into force three months after the date of its promulgation.
ADDENDA <Act No. 7917, Mar. 24, 2006>
| (1) | (Enforcement Date) This Act shall enter into force three months after the date of its promulgation. |
| (2) | (Transitional Measures concerning Safety Check of Information Protection) Where a company specializing in information protection consulting under Article 17 of the Act on the Protection of Information and Communications Infrastructure has commenced the works of safety check of information protection before the enforcement of this Act, it may continue to perform the works of safety check of information protection pursuant to the previous provisions, notwithstanding the amended provisions of Article 46-3 (1). |
ADDENDUM <Act No. 8030, Oct. 4, 2006>
This Act shall enter into force three months after the date of its promulgation.
ADDENDA <Act No. 8031, Oct. 4, 2006>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 6 Omitted.
ADDENDA <Act No. 8289, Jan. 26, 2007>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Article 2 (Transitional Measures for Prohibition on Illegal Communications)
The orders issued by the Minister of Information and Communication to reject, suspend or restrict handling of telecommunications services pursuant to Article 53 of the Telecommunications Business Act before this Act enters into force shall be deemed to have been issued pursuant to the amended provisions of Article 44-7 of this Act.
Article 3 (Transitional Measures for Change in Authority for Establishment of Information and Communications Ethics Committee)
| (1) | The Information and Communications Ethics Committee established pursuant to Article 53-2 of the former Telecommunications Business Act as of the enforcement date of this Act shall be deemed the Information and Communications Ethics Committee established pursuant to the amended provisions of Article 44-8 of this Act. |
| (2) | The acts done by or against the Information and Communications Ethics Committee and other legal relationships with the Information and Communications Ethics Committee under the former provisions before this Act enters into force shall be deemed the acts done by or against the Information and Communications Ethics Committee and other legal relationships with the Information and Communications Ethics Committee under the amended provisions of Article 44-8 of this Act. |
Article 4 (Transitional Measures for Collection, Use, and Provision of Personal Information)
| (1) | Consent obtained from a user in relation to collection, use, provision, or similar of personal information in accordance with the former provisions of Article 22, 23, 24, or 54 as of the enforcement date of this Act shall be deemed consent obtained lawfully in accordance with the amended provisions of Article 22, 23, 24, 24-2, or 54. |
| (2) | Handling of personal information, which has been entrusted lawfully in accordance with the former provisions of Article 25 as of the enforcement date of this Act shall be deemed to have been entrusted with consent obtained lawfully in accordance with the amended provision of Article 25 (1). |
| (3) | An act performed by a person who succeeded rights and obligations of a provider of information and communications services or similar in accordance with the former provisions of Article 26 as of the enforcement of this Act to use or provide personal information shall be deemed to have been performed with consent obtained lawfully in accordance with the amended provision of Article 26 (3). |
Article 5 (Transitional Measures for Application of Penalty Provisions)
Acts committed before this Act enters into force shall be governed by the former penal provisions.
Article 6 Omitted.
ADDENDA <Act No. 8486, May 25, 2007>
Article 1 (Enforcement Date)
This Act shall enter into force one year after the date of its promulgation.
Articles 2 through 10 Omitted.
ADDENDA <Act No. 8778, Dec. 21, 2007>
Article 1 (Enforcement Date)
This Act shall enter into force three months after the date of its promulgation.
Article 2 (Transitional Measures for Registration of Providers of Telecommunications Billing Services)
| (1) | A person who renders telecommunications billing services at the time when this Act enters into force shall complete the registration with the Minister of Information and Communication in accordance with the amended provision of Article 53 (1) within three months from the date this Act enters into force. |
| (2) | A provider of telecommunications billing services who is registered in accordance with Article 28 (2) of the Electronic Financial Transaction Act at the time when this Act enters into force shall submit a written statement certifying the registration with the Minister of Information and Communication within three months from the date this Act enters into force. |
| (3) | A person who submits a written statement in accordance with paragraph (2) shall be deemed to have been registered in accordance with the amended provision of Article 53 (1). |
ADDENDA <Act No. 8852, Feb. 29, 2008>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 7 Omitted.
ADDENDA <Act No. 8867, Feb. 29, 2008>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 12 Omitted.
ADDENDA <Act No. 9119, Jun. 13, 2008>
| (1) | (Enforcement Date) This Act shall enter into force six months after the date of its promulgation. |
| (2) | (Transitional Measures for Application of Penalty Provisions and Administrative Fines) An act committed before this Act enters into force shall be governed by the former penal provisions and the former provisions concerning administrative fines. |
ADDENDA <Act No. 9637, Apr. 22, 2009>
Article 1 (Enforcement Date)
This Act shall enter into force three months after the date of its promulgation.
Article 2 (Preparation for Establishment of Korea Internet and Security Agency)
| (1) | The Korea Communications Commission may perform preparatory activities to establish the Korea Internet and Security Agency by commissioning not less than five incorporators before this Act enters into force. |
| (2) | The incorporators shall prepare the articles of incorporation of the Korea Internet and Security Agency and obtain approval from the Korea Communications Commission. |
| (3) | The incorporators, upon obtaining approval under paragraph (2), shall register the incorporation of the Korea Internet and Security Agency by joint signature and turn over the administrative responsibility to the President of Korea Internet and Security Agency. |
| (4) | The incorporators shall be deemed decommissioned at the time the take-over of the administrative responsibility is complete pursuant to paragraph (3). |
Article 3 (Transitional Measures concerning Succession of Korea Information Security Agency, Korea Internet and Security Agency and Korea IT International Cooperation Agency)
| (1) | The administrative responsibilities of the Korea Information Security Agency under Article 52 of the Act on Promotion of Information and Communications Infrastructure (hereinafter referred to as the "Korea Information Security Agency"), the Korea Internet and Security Agency under Article 9 of the Internet Address Resources Act (hereinafter referred to as the "Korea Internet and Security Agency"), and the Korea IT International Cooperation Agency under Article 24-2 of the Framework Act on Informatization Promotion (hereinafter referred to as the "Korea IT International Cooperation Agency"), which are governed by the previous provisions at the time this Act enters into force, shall be comprehensively succeeded to the Korea Internet and Security Agency under this Act. |
| (2) | The previous rights, obligations, properties of the Korea Information Security Agency, the Korea Internet and Security Agency and the Korea IT International Cooperation Agency as at the time this Act enters into force shall be comprehensively succeeded to the Korea Internet and Security Agency under this Act. |
| (3) | The previous employment relationship covering the employees of the Korea Information Security Agency, the Korea Internet and Security Agency and the Korea IT International Cooperation Agency as at the time this Act enters into force shall be comprehensively succeeded to the Korea Internet and Security Agency under this Act. |
| (4) | The previous activities performed by or in relation to the Korea Information Security Agency, the Korea Internet and Security Agency and the Korea IT International Cooperation Agency as at the time this Act enters into force shall be deemed to have been performed by or in relation to the Korea Internet and Security Agency under this Act. |
| (5) | The titles of the Korea Information Security Agency, the Korea Internet and Security Agency and the Korea IT International Cooperation Agency indicated on the register as at the time this Act enters into force or other public books shall be deemed to be those of the Korea Internet and Security Agency under this Act. |
Article 4 Omitted.
Article 5 (Relations with Other Statutes)
Where the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. or the provisions thereof are cited in other statutes as at the time this Act enters into force, and any provision corresponding thereto exists in this Act, this Act or the corresponding provision of this Act shall be deemed to have been cited in lieu of the previous provision.
ADDENDUM <Act No. 10138, Mar. 17, 2010>
This Act shall enter into force three months after the date of its promulgation.
ADDENDA <Act No. 10165, Mar. 22, 2010>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation. (Proviso Omitted.)
Articles 2 through 7 Omitted.
ADDENDA <Act No. 10166, Mar. 22, 2010>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Articles 2 through 9 Omitted.
ADDENDA <Act No. 10465, Mar. 29, 2011>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
(Proviso Omitted.)
Articles 2 through 7 Omitted.
ADDENDA <Act No. 10560, Apr. 5, 2011>
Article 1 (Enforcement Date)
This Act shall enter into force three months after the date of its promulgation.
Article 2 (General Transitional Measures)
Previous acts of the identification service agency which developed and provided the previous identification affairs as at the time of enforcement of this Act shall be deemed to have been legitimately developed and provided if the agency obtains the designation of identification service agency pursuant to this Act.
Article 3 (Transitional Measures concerning Designation of Identification Service Agency)
A person who was conducting the identification service as at the time of enforcement of this Act shall be designated, within three months after enforcement date of this Act, as an identification service agency by the Korea Communications Commission pursuant to the amended provision of Article 23-3 (1).
ADDENDA <Act No. 11048, Sep. 15, 2012>
Article 1 (Enforcement Date)
This Act shall enter into force one year after the date of its promulgation.
(Proviso Omitted.)
Articles 2 through 5 Omitted.
ADDENDA <Act No. 11322, Feb. 17, 2012>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation: Provided , That the amended provisions of Articles 45, 45-2, 45-3, 46-3, 47, 47-2, 47-3, 47-5, 52 (3) 7, 66 and 76 (3) 6 through 9 shall enter into force after the lapse of one year from the date of its promulgation.
Article 2 (Transitional Measures concerning Restriction on Collection/Use of Resident Registration Number)
| (1) | A provider of information and communications services who provides methods of subscription for membership by using the subscriber’s resident registration number as at the time of enforcement of this Act shall destroy all the resident registration numbers possessed by the provider within two years after enforcement date of this Act: |
| (2) | In cases where a provider of information and communications services fails to destroy the resident registration numbers possessed by him/her within the period under paragraph (1), the amended provisions of Article 23-2 (1) shall be deemed violated. |
Articles 3 (Transitional Measures concerning Abolition of the Safety Inspection on Protection of Information)
A business operator who received a safety inspection on the protection of information pursuant to previous provisions as at the time of enforcement of this Act shall be deemed, during the concerning year in which he/she received the safety inspection on the protection of information, as the business operator who received the certification of an information security management system pursuant to the amended provisions of Article 47 (2).
Articles 4 (Transitional Measures concerning Certification of Personal Information Management System)
A person who received the certification personal information management system from the Korea Internet and Security Agency as at the time of enforcement of this Act shall be deemed to have received the certification of personal information management system pursuant to the amended provisions of Article 47-3.
Articles 5 (Transitional Measures concerning Administrative Fine)
Upon imposing administrative fine with respect to any violative acts committed before enforcement of this Act, the previous provisions shall apply thereto.
ADDENDA <Act No. 11690, Mar. 23, 2013>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation.
Articles 2 through 7 Omitted.
ADDENDA <Act No. 12681, May 28, 2014>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation:
Provided, That the amended provisions of Articles 44 (3), 44-5 and 76 (1) 6 shall enter into force on the date of their promulgation.
Article 2 (Transitional Measures concerning Penalty Surcharges and Penalty Provisions)
When penalty surcharges and penalty provisions apply to offenses committed before this Act enters into force, the former provisions shall apply thereto.
ADDENDA <Act No. 12844, Nov. 19, 2014>
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation: Provided That, among the Acts amended pursuant to Article 6 of Addenda, the amended parts of the Acts that were promulgated before this Act enters into force but their enforcement dates have yet to arrive shall enter into force on their respective dates of enforcement.
Articles 2 through 7 Omitted.
ADDENDUM <Act No. 13014, Jan. 20, 2015>
This Act shall enter into force three months after the date of its promulgation.
ADDENDUM <Act No. 13280, Mar. 27, 2015>
This Act shall enter into force on the date of its promulgation.
ADDENDA <Act No. 13343, Jun. 22, 2015>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Articles 2 through 3 Omitted.
ADDENDA <Act No. 13344, Jun. 22, 2015>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Article 2 (Applicability concerning Administrative Dispositions)
The amended provisions of Article 55 (1) shall apply even to administrative dispositions against violations committed before this Act enters intro force.
ADDENDA <Act No. 13520, Dec. 1, 2015>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation:
Provided, That the amended provisions of Articles 29 (2) and (3) shall enter into force on the date of its promulgation.
Article 2 (Applicability concerning Destruction, etc. of Personal Information)
The amended provisions of Article 29 (2) and (3) shall apply even to the personal information collected or provided before such amended provisions enter into force.
Article 3 (Applicability concerning Omission of Examination of Certification for Information Security Management System)
The amended provisions of Article 47 (3) shall apply even to persons who have made an application for the certification for an information security management system, procedures for which are underway.
Article 4 (Transitional Measures concerning Certification of Information Security Management System)
A person who has not received the certification for an information security management system shall receive the certification within six months after this Act enters into force, in accordance with the amended provisions of Article 47 (2).
Article 5 (Transitional Measures concerning Administrative Fines)
When applying administrative fines to the violations committed before this Act enters into force, the previous provisions of this Act shall apply.
ADDENDA <Act No. 14080, Mar. 22, 2016>
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation:
Provided, That the amended provisions of Articles 22-2 and 76 (1) 1 and 1-2 shall enter into force one year after the date of its promulgation, the amended provisions of Article 32 (2) and (3) and 32-2 (3) shall enter into force on July 25, 2016, and the amended provision of Article 52 (4) shall enter into force on the date of its promulgation.
Article 2 (Applicability concerning Compensation for Damage)
The amended provisions of Articles 32 (2) and (3), and 32-2 (3) shall apply beginning from the first claim for compensation for damage against any information lost, stolen, leaked, forged, altered or damaged after the said amended provisions enter into force.
Article 3 (Transitional Measures concerning Informing Fact of Exposure to Act of Violation)
A provider of information and communications services shall, no later than six months after this Act enters into force, establish equipment, by means of which informing messages can be sent to users pursuant to the amended provisions of Article 49-2 (3).
Article 4 (Transitional Measures concerning Penalty Provision)
The former provisions shall govern when applying penalty provisions to the act committed before this Act enters into force.
Article 5 Omitted.
ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.36502 | 20260707 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.36220 | 20260324 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.35837 | 20251104 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.35810 | 20251001 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.35533 | 20250520 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.35172 | 20241231 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.34821 | 20240814 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.34723 | 20240724 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.34258 | 20240227 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.34024 | 20231226 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.33039 | 20221209 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.32868 | 20220809 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.32274 | 20211230 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.32179 | 20211209 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.31429 | 20210205 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.31380 | 20210105 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.31247 | 20201210 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.31221 | 20201210 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.30894 | 20200805 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.30691 | 20200611 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.30509 | 20200303 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.29886 | 20190625 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.29852 | 20190611 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.29633 | 20190319 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.29339 | 20181213 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.29192 | 20180928 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.29053 | 20180717 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.28919 | 20180528 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.28283 | 20170905 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.28210 | 20170726 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.27951 | 20170323 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.27751 | 20170101 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.27510 | 20160923 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.27188 | 20160602 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.25789 | 20141129 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.25751 | 20141119 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.25532 | 20140807 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.25050 | 20140401 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.24445 | 20130323 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.24102 | 20120916 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.24076 | 20120902 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.24047 | 20130218 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.23876 | 20120625 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.23169 | 20110930 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.23104 | 20110829 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.22773 | 20110329 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.22550 | 20101227 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.22467 | 20101102 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.22424 | 20101001 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.22423 | 20101001 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.22151 | 20100505 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.22003 | 20100201 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.21719 | 20131113 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.21692 | 20090823 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.21278 | 20090128 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20947 | 20090204 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20896 | 20080703 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20756 | 20080328 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20668 | 20080229 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.20199 | 20070727 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.19719 | 20061029 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.19424 | 20060331 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.18759 | 20050331 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.18505 | 20040730 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.18312 | 20040317 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.18100 | 20030915 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.17344 | 20010825 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.16883 | 20000701 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.16456 | 19990701 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.15282 | 19970222 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.14947 | 19960314 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.14847 | 19960101 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13674 | 19920630 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13558 | 19911231 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13413 | 19910708 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.13282 | 19910201 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.12680 | 19890404 |
| ENFORCEMENT DECREE OF THE ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION | No.12049 | 19870101 |
CHAPTER I GENERAL PROVISIONS
| Article 1 (Purpose) |
The purpose of this Decree is to prescribe matters mandated by the Act on Promotion of Information and Communications Network Utilization and Information Protection and those necessary for enforcing said Act.
| Article 2 (Code of ethics) |
| (1) | The providers of information and communications services, defined under Article 2(1)3 of the Act on Promotion of Information and Communications Network Utilization and Information Protection (hereinafter referred to as the "Act"), and an association of such providers may establish and enforce a code of ethics in order to protect users and to ensure soundness and safety in providing information and communications services. <Amended on Jan. 28, 2009; Aug. 4, 2020> |
| (2) | An association of users defined under Article 2(1)4 of the Act may establish and enforce a users’ code of ethics for the establishment of a sound information society. |
| (3) | The Government may provide assistance to activities for the establishment and enforcement of the code of ethics under paragraph (1) or (2). |
| Article 3 Deleted. <Aug. 4, 2020> |
CHAPTER II PROMOTION OF UTILIZATION OF INFORMATION AND COMMUNICATIONS NETWORKS
| Article 4 Deleted. <Aug. 18, 2009> |
| Article 5 Deleted. <Aug. 18, 2009> |
| Article 6 (Measures for establishment of system for sharing information) |
| (1) | Pursuant to Article 12 of the Act, the head of a central administrative agency may formulate and provide a public notice of a plan for sharing information about matters under his or her jurisdiction. <Amended on May 4, 2010> |
| (2) | If the head of a central administrative agency deems it necessary to efficiently implement a plan for sharing information pursuant to paragraph (1), he or she may assist a person in conducting the following business activities: |
| 1. | Selection of information to be shared, among the information possessed and managed; |
| 2. | Establishment and operation of a system for interconnecting different information and communications networks; |
| 3. | Adjustment of expenses allotted to each agency in connection with the interconnection of different information and communications networks; |
| 4. | Other activities necessary for the establishment of the system for sharing information. |
| Article 7 (Implementation of projects for promoting utilization of information and communications networks) |
Projects that the Minister of Science and Information Communications Technology (ICT) may implement pursuant to Article 13(1) of the Act are as follows: <Amended on Mar. 23, 2013; Jul. 26, 2017>
| 1. | Pilot projects for the establishment and operation of information and communications networks; |
| 2. | Pilot projects for the commercialization of new media; |
| 3. | Advanced application projects for nurturing the informatization industry and projects for supporting related research projects; |
| 4. | Projects to lay a foundation for the development of technologies for electronic transactions and the invigoration of electronic transactions; |
| 5. | Supportive projects for the improvement of statutes and systems for promoting the utilization of information and communications networks; |
| 6. | Other pilot projects for the efficient utilization and dissemination of technologies, devices, and application services. |
CHAPTER III Deleted.
| Article 8 Deleted. <Dec. 22, 2015> |
| Article 9 Deleted. <Dec. 22, 2015> |
CHAPTER IV CREATION OF SAFE ENVIRONMENT FOR USE OF INFORMATION AND COMMUNICATIONS SERVICES
| Article 9-2 (Extent of access authority) |
| (1) | A case where a provider of information and communications services shall obtain consent from the users pursuant to Article 22-2(1) of the Act means a case where such provider needs authority of access to the following information and functions (hereafter referred to as "access authority" in this Article) through the software of mobile devices; provided, this shall not apply to the information and functions accessed by any software, which has been installed in mobile devices in the course of manufacturing and supplying them, to perform their intrinsic functions such as communications, photography, and audio and video replay: |
| 1. | Information stored by the users on their mobile devices such as contact points, schedules, videos, communications, biometric information (referring to information concerning physical or behavioral characteristics with which an individual can be identified, such as fingerprints, iris, voice, and handwriting; hereinafter the same shall apply); |
| 2. | Information automatically stored on mobile devices in the course of using them, such as location information, communication logs, authentication information, and physical activity records; |
| 3. | Unique information assigned to identify mobile devices, including unique international identification number under Article 60-2(1) of the Telecommunications Business Act; |
| 4. | Input and output functions, such as photography, speech recognition, and biometric or health information detecting sensor. |
| (2) | A provider of information and communications services shall, in the course in which the users install or run a software of mobile devices, inform the users of the matters referred to in each subparagraph of Article 22-2(1) of the Act in a manner displaying such matters on a software’s guidance information screen or other separate screen and shall obtain consent of the users according to the following classifications in the same manner: |
| 1. | Where the basic operating system of mobile devices (referring to the based environment in which the software can be executed in mobile devices; hereinafter referred to as "operating system") is an operating system in which the users can individually choose whether to consent to the access authority: A method by which, after the provider of information and communications services informs the users about the both access authorities under Article 22-2(1)1 and 2 of the Act separately from each other, the users choose whether to consent when for the first time they access any information or function the access authority for which is set; |
| 2. | Where the operating system of mobile devices is an operating system by which the users cannot individually choose whether to consent to the access authority: A method by which, after the provider of information and communications services only sets the access authority under Article 22-2(1)1 of the Act and informs the users thereof, the users choose whether to consent to the access authority when they install the software; |
| 3. | Where the method referred to in subparagraph 1 or 2 is impossible though the operating system of mobile devices falls within the operating system described in subparagraph 1 or 2: A method similar to the method referred to in subparagraph 1 or 2, by which the provider of information and communications services informs the users of the content of consent so that they can definitely acknowledge such content and choose whether to give consent. |
| (3) | When determining whether a matter requiring consent of the users pursuant to Article 22-2(1) of the Act falls under any access authority under subparagraph 1 or 2 of that Article, the following shall be taken into consideration: The extent of information and communications services as disclosed through the terms of service, the privacy policy prescribed in Article 30(1) of the Personal Information Protection Act, or any separate guidelines; whether such information and communications services are actually provided; the users’ reasonable foreseeability for the relevant information and communications services; and technical relevance between the relevant information and communications services and the access authority, and other factors. <Amended on Aug. 4, 2020> |
| (4) | Persons manufacturing and supplying the operating system of mobile devices, manufacturers of mobile devices, and persons manufacturing and supplying software of mobile devices shall take necessary measures according to the following classifications in order to protect information on the users referred to in Article 22-2(3) of the Act: |
| 1. | Persons manufacturing and supplying the operating system of mobile devices: They shall manufacture and provide the operating system in which there are embedded functions by which the providers of information and communications services can obtain the consent of the users by the methods classified in the subparagraphs of paragraph (2) and the users can revokes their consent, and they also shall prepare and disclose operating standards for the access authority set in the operating system so that the persons manufacturing and supplying the software of mobile devices can easily understand such standards; |
| 2. | Manufacturers of mobile devices: They shall install on mobile devices the operating system in which functions to give and revoke the consent under subparagraph 1 are embedded; |
| 3. | Persons manufacturing and providing software of mobile devices: They shall embed in the software the operating system for which the measures under subparagraphs 1 and 2 are taken and the methods for giving and revoking consent which are suitable for mobile devices. |
[This Article Added on Mar. 22, 2017]
| Article 9-3 (Criteria for standard subject to review) |
| (1) | Detailed examination criteria for each item of under Article 23-3(1) of the Act shall be as follows: <Amended on Aug. 17, 2012; Aug. 4, 2020; ; Oct. 1, 2025> |
| 1. | A plan for physical, technical, and administrative measures: A plan to take measures regarding the following shall be formulated: |
| a. | The management and operation of facilities related to the identity verification service under Article 23-3(1) of the Act (hereinafter referred to as "identity verification service"); |
| b. | The prevention of a breach on information and communications networks; |
| c. | The operation, security, and management of systems and networks; |
| d. | The protection of users and the settlement of complaints; |
| e. | The response to urgency and emergency; |
| f. | The formulation and implementation of internal regulations on the identity verification service; |
| g. | The securement of safety of an alternative means under Article 23-2(2) of the Act (hereinafter referred to as "alternative means"); |
| h. | The prevention of fabrication and alteration of access records; |
| i. | Other matters determined and publicly notified by the Korea Media and Communications Commission for the identity verification service; |
| 2. | Technical capability: An identification service agency shall have at least 8 persons who meet any of the following requirements: |
| a. | Each person shall have a national technical qualification of information and communications engineer, information processing engineer, or electronic computer system application engineer or higher, or a qualification recognized by the Korea Media and Communications Commission as equivalent or higher; |
| b. | Each person shall have work experience of at least 2 years in the field of information protection or information and communications operation and management as prescribed and publicly notified by the Korea Media and Communications Commission; |
| 3. | Financial capability: An identification service agency's equity capital shall be at least 8 billion won (excluding national agencies and local governments); |
| 4. | Adequacy of the size of facilities: An identification service agency shall possess the following facilities that shall be at least the size necessary to properly provide identity verification services: |
| a. | Facilities for the verification, management, and protection of users' personal information (referring to personal information defined in subparagraph 1 of Article 2 of the Personal Information Protection Act; hereafter in Article 9-6 the same shall apply); |
| b. | Facilities for the generation, issuance, and management of alternative means; |
| c. | Security facilities for controlling and restricting access; |
| d. | Facilities for the protection of systems and networks; |
| e. | Facilities for the prevention of fire, flood, power failure, and other disasters. |
| (2) | Matters necessary for guidelines and methods for the evaluation of criteria for each standard subject to the review under paragraph (1) shall be prescribed and publicly notified by the Korea Media and Communications Commission. <Amended on Oct. 1, 2025> |
[This Article Added on Aug. 29, 2011]
| Article 9-4 (Procedures for designation of identification service agencies) |
| (1) | A person who seeks to be designated as an identity verification agency under Article 23-3(1) of the Act shall file an application for the designation of an identity verification agency (including in electronic form) with the Korea Media and Communications Commission, along with the following documents (including electronic documents): <Amended on Oct. 1, 2025> |
| 1. | A business plan describing the current conditions of its organization, human resources, facilities, etc.; |
| 2. | Documents certifying that criteria for each standard subject to the review under Article 9-3 are satisfied; |
| 3. | Articles of incorporation or bylaws of organization (applicable only if an applicant is a legal person or organization); |
| 4. | Other documents specified and publicly notified by the Korea Media and Communications Commission as documents necessary for ascertaining the expertise in providing identity verification services, the soundness of the financial structure, etc. |
| (2) | Upon receipt of an application for the designation of an identity verification agency under paragraph (1), the Korea Media and Communications Commission shall verify the relevant corporate registration certificate (applicable only if such applicant is a corporation) through administrative data matching under Article 36(1) of the Electronic Government Act. <Amended on Oct. 1, 2025> |
| (3) | If the Korea Media and Communications Commission deems it necessary to review an application under paragraph (1), it may request the applicant to submit data or may hear the applicant's opinion. <Amended on Oct. 1, 2025> |
| (4) | Upon receipt of an application under paragraph (1), the Korea Media and Communications Commission shall examine whether the application meets criteria for each standard subject to the review under Article 9-3 and shall notify the applicant of the outcomes of the review within 90 days from the date when such application is filed; provided, the period may be extended by up to 30 days in special circumstances by giving notice of the reasons therefor. <Amended on Oct. 1, 2025> |
| (5) | Where the Korea Media and Communications Commission designates an identity verification agency based on the results of the examination under paragraph (4), it shall issue a certificate of designation as an identity verification agency to the applicant and shall publish a public notice of the details of designation, including the name, location, and date of designation of the identity verification agency, in the Official Gazette. <Amended on Oct. 1, 2025> |
| (6) | Matters necessary for procedures and methods for the application for designation and the review on the designation under the provisions of paragraphs (1) through (5) shall be prescribed and publicly notified by the Korea Media and Communications Commission. <Amended on Oct. 1, 2025> |
[This Article Added on Aug. 29, 2011]
| Article 9-5 (Identification service agency’s request for verifying electronic data for resident registration) |
When a person designated as an identity verification agency under Article 23-3(1) of the Act (hereinafter referred to as "identity verification agency") needs to verify the identities of a child under 14 years of age and the legal representative of the child, it may request the Minister of the Interior and Safety to verify relevant electronic data on resident registration under Article 30(1) of the Resident Registration Act.
[This Article Added on Jul. 17, 2018]
[Previous Article 9-5 moved to Article 9-6 <Jul. 17, 2018>]
| Article 9-6 (Suspension or discontinuation of identification services) |
| (1) | When an identity verification agency intends to disclose its service temporarily or permanently in accordance with Article 23-3(2) or (3) of the Act, it shall notify users of the following matters: |
| 1. | The reasons for the temporary or permanent discontinuation; |
| 2. | The date and time of the temporary or permanent discontinuation (in the case of temporary discontinuation, including the date and time of resumption of the service); |
| 3. | Restrictions on the use of alternative means and personal information (only applicable to the temporary discontinuation); |
| 4. | The destruction of alternative means and personal information (applicable only to permanent discontinuation). |
| (2) | When an identity verification agency reports the temporary or permanent discontinuation of its identity verification service in accordance with Article 23-3(2) or (3) of the Act, it shall submit a report on the temporary or permanent discontinuation of identity verification service to the Korea Media and Communications Commission, along with the following documents: <Amended on Oct. 1, 2025> |
| 1. | A notice of the matters under paragraph (1); |
| 2. | A document concerning a plan to restrict the use or to destroy alternative means and personal information; |
| 3. | A document regarding a plan for protective measures to be taken by users; |
| 4. | The certificate of designation as an identity verification agency (applicable only to permanent discontinuation). |
| (3) | Detailed matters related to procedures, guidelines, methods, etc. for notification and reporting of temporary or permanent discontinuation under paragraph (1) or (2) shall be determined and publicly notified by the Korea Media and Communications Commission. <Amended on Oct. 1, 2025> |
[This Article Added on Aug. 29, 2011]
[Moved from Article 9-5; previous Article 9-6 Is moved to Article 9-7 <Jul. 17, 2018>]
| Article 9-7 (Suspension of identification services or cancellation of designation) |
| (1) | The criteria for suspension of the identity verification service or revocation of designation of an identity verification agency under Article 23-4(1) of the Act are as shown in Appendix 1. |
| (2) | Where the Korea Communications Commission suspends the identity verification service or revokes the designation of the identity verification agency pursuant to paragraph (1), it shall publish a public notice thereof in the Official Gazette. <Amended on Oct. 1, 2025> |
[This Article Added on Aug. 29, 2011]
[Moved from Article 9-6 <Jul. 17, 2018>]
| Article 10 (Information and communication services requiring creation and processing of connecting information) |
| (1) | "Information and communications services prescribed by Presidential Decree" in Article 23-5(1)4 of the Act means any of the following information and communication services: <Amended on Oct. 1, 2025> |
| 1. | The service of notifying users of matters to be notified in accordance with statutes and regulations through a certified electronic document intermediary under subparagraph 10 of Article 2 of the Framework Act on Electronic Documents and Transactions; |
| 2. | The service of transmitting personal credit information about an individual to the credit data subject himself or herself through a MyData company as defined in subparagraph 9-3 of Article 2 of the Credit Information Use and Protection Act upon a request for transmission under Article 33-2(1) of that Act; |
| 3. | Other services similar to those under subparagraphs 1 and 2, which are publicly notified by the Korea Media and Communications Commission as the Commission deems it essential to create, provide, use, compare, or link connecting information (hereinafter referred to as "connecting information") or perform other similar acts (hereinafter referred to as "processing") under the provisions, with the exception of the subparagraphs, of Article 23-5 (1) of the Act. |
| (2) | Where the Korea Media and Communications Commission intends to publicly notify the services under paragraph (1)3, it shall reach an agreement with the Personal Information Protection Commission. <Amended on Oct. 1, 2025> |
[This Article Added on May 20, 2025]
| Article 11 (Approval procedures for creation and processing of connecting information) |
| (1) | Where an identity verification agency and a provider of information and communications services intend to obtain approval for the creation and processing of connecting information together under Article 23-5(1)4 of the Act, they shall submit to the Korea Media and Communications Commission an application for approval for creation and processing of connecting information as prescribed and publicly notified by the Korea Media and Communications Commission, along with the following documents: <Amended on Oct. 1, 2025> |
| 1. | A business plan stating the current status of the organization, human resources, facilities, etc. of the identity verification agency and the provider of information and communications services; |
| 2. | Documents proving that detailed review criteria for each item subject to review under Article 9-3 are met; |
| 3. | Articles of incorporation or bylaws of organization (applicable only to corporations or organizations) of the identity verification agency and the provider of information and communications services; |
| 4. | Other documents prescribed and publicly notified by the Korea Media and Communications Commission, which are necessary for ascertaining the expertise in creating and processing connecting information, the soundness of the financial structure, etc. |
| (2) | Upon receipt of an application for approval for the creation and processing of connecting information under paragraph (1), the Korea Media and Communications Commission shall verify the relevant corporation registration certificate (applicable only to corporations) through administrative data matching under Article 36(1) of the Electronic Government Act. <Amended on Oct. 1, 2025> |
| (3) | If the Korea Media and Communications Commission deems it necessary to review an application under paragraph (1), it may request the applicant to submit data or may hear the applicant's opinion. <Amended on Oct. 1, 2025> |
| (4) | Upon receipt of an application under paragraph (1), the Korea Media and Communications Commission shall examine whether the application meets the detailed examination criteria for each matter for approval under Article 12 within 90 days from the date of receipt of the application and notify the applicant of whether the application has been approved; provided, in the event of unavoidable circumstances, the period may be extended up to 30 days after informing the applicant of the reason. <Amended on Oct. 1, 2025> |
| (5) | Except as provided in paragraphs (1) through (4), details necessary for approval for the creation and processing of connecting information shall be determined and publicly notified by the Korea Media and Communications Commission. <Amended on Oct. 1, 2025> |
[This Article Added on May 20, 2025]
| Article 12 (Detailed review criteria for each items subject to review for approval) |
| (1) | The detailed review criteria for each items subject to review for approval under Article 23-5(2) of the Act shall be as follows: |
| 1. | Appropriateness and innovativeness of the realization of services to be provided: |
| a. | Necessity of creating and processing connecting information for the realization of services to be provided; |
| b. | Differentiation from existing similar services; |
| 2. | Adequacy of procedures for creating and processing connecting information: Adequacy of procedures for creating and processing connecting information under relevant statutes, regulations, and internal regulations; |
| 3. | Plans for physical, technical, and administrative measures to ensure safety in creating and processing connecting information: Feasibility of plans for the measures under the subparagraphs of Article 13(1); |
| 4. | Adequacy of measures to protect the rights of users: |
| a. | Measures to protect users' rights, such as suspension of creation and processing of connecting information and deletion of connecting information; |
| b. | Procedures for receipt and handling of user complaints; |
| c. | Measures to prevent user damage and secure safety; |
| 5. | Impacts and effects on relevant markets and user benefits: |
| a. | Impacts and effects of services to be provided on the relevant markets, including the invigoration of relevant industries and the reduction of costs; |
| b. | Impacts and effects of services to be provided on user benefits, including convenience of use and economic benefits. |
| (2) | Matters necessary for guidelines and methods for the evaluation of the detailed review criteria for each items subject to review for approval under paragraph (1) shall be prescribed and publicly notified by the Korea Media and Communications Commission. <Amended on Oct. 1, 2025> |
[This Article Added on May 20, 2025]
| Article 13 (Physical, technical, and administrative measures by identity verification agencies) |
| (1) | An identity verification agency shall take the following physical, technical and administrative measures to ensure the safety of the creation and processing of connecting information under Article 23-6(1) of the Act; <Amended on Oct. 1, 2025> |
| 1. | Measures regarding the matters specified in the items of Article 9-3(1)1; |
| 2. | Formulation and implementation of internal regulations for the creation and processing of connecting information, such as designation of a person in charge of overall physical, technical and administrative measures; |
| 3. | Security control of connecting information creating software; |
| 4. | Measures to prevent forgery or falsification of connecting information; |
| 5. | Recording and storage of verification data on creation and processing of connecting information; |
| 6. | Other measures determined and publicly notified by the Korea Media and Communications Commission in relation to ensuring safety in the creation and processing of connecting information. |
| (2) | An entity using connecting information referred to in the main clause of Article 23-5(4) of the Act (hereinafter referred to as "entity using connecting information") shall store and manage the connecting information separately from resident registration numbers under Article 23-6(2) of the Act and shall take the following measures (hereinafter referred to as "security measures") to prevent the connecting information from being lost, stolen, leaked, forged, falsified, or damaged: <Amended on Oct. 1, 2025> |
| 1. | Establishment and implementation of internal regulations for secure processing of connecting information, such as designation of a person in charge of general supervision and control of security measures; |
| 2. | Processing of connecting information within the scope of the purpose for which the connecting information is provided; |
| 3. | Separation, storage, and management of resident registration numbers and connecting information where storing resident registration numbers; |
| 4. | Application of encryption technology to safely store and transmit connecting information; |
| 5. | Formulation and implementation of a response plan in case of a cyber security incident, such as loss or theft of connecting information; |
| 6. | Recording and retention of data regarding entities providing connecting information, the time connecting information is provided, etc.; |
| 7. | Other measures determined and publicly notified by the Korea Media and Communications Commission to prevent the loss, theft, leakage, forgery, falsification, or damage of connecting information. |
| (3) | Except as provided in paragraphs (1) and (2), detailed matters necessary for the physical, technical, and administrative measures taken by identity verification agencies and for the security measures taken by entities using connecting information shall be determined and publicly notified by the Korea Media and Communications Commission. <Amended on Oct. 1, 2025> |
[This Article Added on May 20, 2025]
| Article 14 (Entities subject to inspection of operational and managerial status) |
An identity verification agency or an entity using connecting information subject to inspection of current status under Article 23-6(3) of the Act (hereinafter referred to as "inspection of current status") shall be as follows:
| 1. | In the case of an identity verification agency: A person who has created or processed connecting information in accordance with Article 23-5(1) of the Act and has created or processed 1,000 or more connecting information cases; |
| 2. | In the case of an entity using connecting information: A person who has received at least 1,000 connecting information cases from an identity verification agency under Article 23-5(1) of the Act. |
[This Article Added on May 20, 2025]
| Article 15 (Procedures for inspection of current status) |
A public official who inspects the current status with regard to the physical, technical, and administrative measures taken by an identity verification agency and the security measures taken by an entity using connecting information under Article 23-6(3) of the Act shall notify the agency of the following matters by no later than 7 days prior to the inspection; provided, if it is deemed urgent or if it is deemed impractical to achieve the purpose of the inspection of the current status due to evidence destruction, etc., prior notice may be omitted:
| 1. | Grounds for and purpose of the inspection; |
| 2. | Date and time of the inspection; |
| 3. | Personal information of the inspecting person; |
| 4. | Details of the inspection. |
[This Article Added on May 20, 2025]
| Article 16 (Specialized organization for inspection of current status) |
"Specialized organization prescribed by Presidential Decree" in Article 23-6(4) of the Act means the Korea Internet and Security Agency under Article 52 of the Act (hereinafter referred to as the "Internet and Security Agency").
[This Article Added on May 20, 2025]
| Article 16-2 Deleted. <Aug. 4, 2020> |
| Article 17 Deleted. <Aug. 4, 2020> |
| Article 17-2 Deleted. <Aug. 4, 2020> |
| Article 18 Deleted. <Aug. 4, 2020> |
| Article 18-2 Deleted. <Aug. 4, 2020> |
| Article 19 (Scope of persons required to designate domestic agents) |
| (1) | "Person who meets the criteria prescribed by Presidential Decree" in Article 32-5(1) of the Act means any of the following persons: <Amended on Aug. 4, 2020; Oct. 1, 2025> |
| 1. | A person whose sales for the preceding year (if the person is a corporation, referring to the preceding business year) reach or exceed one trillion won; |
| 2. | A person whose sales from information and telecommunications services for the preceding year (if the person is a corporation, referring to the preceding business year) reach or exceed 10 billion won; |
| 3. | Deleted; <Aug. 4, 2020> |
| 4. | A person who caused or is likely to cause an incident or accident significantly undermining security in using information and communication services in violation of this Act and has been consequently required by the Korea Media and Communications Commission to submit relevant articles, documents, etc. under Article 64(1) of the Act. |
| (2) | Sales referred to in paragraphs (1)1 and 2 shall be based on the amount determined by converting sales into Korean won at the average foreign exchange rate for the preceding year (if the person is a corporation, referring to the preceding business year). |
[This Article Added on Mar. 19, 2019]
| Article 20 Deleted. <Sep. 29, 2011> |
| Article 21 Deleted. <Sep. 29, 2011> |
| Article 22 Deleted. <Sep. 29, 2011> |
CHAPTER V PROTECTION OF USERS IN INFORMATION AND COMMUNICATIONS NETWORKS
| Article 23 (Policy on protection of youths) |
"Matters prescribed by Presidential Decree" in Article 41(1)4 of the Act means the following measures: <Amended on Jan. 28, 2009; Aug. 29, 2011>
| 1. | Promotion of the development and dissemination of information useful to youths; |
| 2. | Encouragement of and support for youths’ voluntary activities for protecting themselves from harmful information, such as information of obscenity or violence, circulated through information and communications networks; |
| 3. | Encouragement of and support for voluntary activities conducted by parents, teachers, or nongovernmental organizations for surveillance, counseling, and remedial measures for the protection of youths; |
| 4. | Assistance in the establishment of a system for the cooperation of providers of information and communications services for the protection of youths; |
| 5. | Other measures incidental to the implementation of policy measures under Article 41(1) of the Act. |
| Article 24 (Labeling of media product harmful to youths) |
| (1) | A person who provides a media product harmful to youths, as defined under Article 42 of the Act, shall label it with an easily noticeable audio, text, or video warning stating that no person under 19 years shall use the same. |
| (2) | If a person who shall put a label required by paragraph (1) provides information through the Internet, he or she shall also put an electronic label warning that it is a media product harmful to youths with symbols, marks, letters, or numbers. |
| (3) | The Korea Media and Communications Commission shall prescribe specific methods for labeling under paragraphs (1) and (2), taking into consideration the categories of information, etc., and shall publish a public notice of the methods in the Official Gazette. <Amended on Oct. 1, 2025> |
| Article 25 (Scope of persons obliged to designate persons responsible for protection of youths) |
"Who meets the criteria prescribed by Presidential Decree, such as the average number of daily users and sales" in Article 42-3(1) of the Act means a person who meets all the following criteria: <Amended on Aug. 29, 2011; Sep. 14, 2012>
| 1. | A person falling under either of the following: |
| a. | A person in whose case the average number of users per day during 3 months immediately before the end of the immediately preceding year is at least 100,000 persons; |
| b. | A person whose sales in the previous year (in the case of a corporation, the previous business year) in the information and communications service sector were at least one billion won; |
| 2. | A person who has at least 3 years of work experience (including work experience prior to obtaining a degree) in the field of information security or information technology, after obtaining a bachelor's degree in the field of information security or information technology in the Republic of Korea or abroad. |
| Article 26 (Duties of persons responsible for protection of youths) |
A person responsible for protection of youths under Article 42-3(1) of the Act shall perform the following duties in order to protect youths from information harmful to youths on information and communications networks (hereinafter referred to as "harmful information"):
| 1. | Formulation of a plan for protection of youths from harmful information; |
| 2. | Measures for restricting or controlling youths’ access to harmful information; |
| 3. | Education of persons engaged in information and communications services for the protection of youths from harmful information; |
| 4. | Counseling on damage inflicted by harmful information and the settlement of grievances; |
| 5. | Other matters necessary to protect youths from harmful information. |
| Article 27 (Deadline for designation of persons responsible for protection of youths) |
A person responsible for protection of youths under Article 42-3(1) of the Act shall be designated by no later than the end of April each year.
| Article 28 (Preservation of video or audio information) |
| (1) | "Information provider prescribed by Presidential Decree" in Article 43(1) of the Act means a person who distributes information through telecommunications lines; provided, broadcasting business operators, CATV relay broadcasting business operators, and electronic signboard broadcasting business operators under subparagraphs 3, 6, and 12 of Article 2 of the Broadcasting Act, among persons who distribute information according to a certain program schedule, using the word "broadcasting", "television" or "radio" in their names, shall be excluded herefrom. <Amended on Aug. 29, 2011> |
| (2) | An information provider under Article 43 of the Act shall preserve relevant information for 6 months from the time when the information is provided for use. |
| Article 29 Deleted. <Nov. 28, 2014> |
| Article 30 Deleted. <Nov. 28, 2014> |
| Article 31 (Scope of user information that may be requested) |
"Minimum information prescribed by Presidential Decree" in Article 44-6(1) of the Act means the following information: <Amended on Aug. 29, 2011>
| 1. | Name; |
| 2. | Address; |
| 3. | Other information that the defamation dispute conciliation division under Article 44-10 of the Act (hereinafter referred to as "defamation dispute conciliation division") deems necessary for filing a civil or criminal complaint, including the contact information of users involved. |
| Article 32 (Procedures for requesting provision of information) |
| (1) | A person who intends to request the provision of the information of users involved pursuant to Article 44-6(1) of the Act (hereinafter referred to as "claimant") may file a claim with the defamation dispute conciliation division, stating the following matters therein, along with supporting materials: |
| 1. | The claimant’s name, address, and contact information (referring to telephone numbers, e-mail addresses, etc.); |
| 2. | The category of the lawsuit to be filed and remedies sought; |
| 3. | The type of violated rights and specific facts relevant to the violation of rights by users involved. |
| (2) | Where the defamation dispute conciliation division finds it necessary to make a decision on whether to provide information under Article 44-6(2) of the Act, it may permit the claimant to present his or her arguments. |
| Article 33 (Procedures for provision of information) |
| (1) | Upon receipt of a request from a claimant to provide information, the defamation dispute conciliation division shall make a decision on whether to provide the information of users involved and shall notify the claimant of its decision. |
| (2) | When the defamation dispute conciliation division decides to provide information, it shall request the relevant provider of information and communications services to provide information under Article 31. In such cases, the provider of information and communications services shall comply with such request, unless there is a compelling reason not to do so. <Amended on Jan. 28, 2009> |
| (3) | A provider of information and communications services shall notify the users involved of such provision of information under paragraph (2). <Amended on Jan. 28, 2009> |
| (4) | The defamation dispute conciliation division shall keep documents relating to the provision of user information for 5 years. |
| Article 34 (Requests to order restrictions on handling unlawful information) |
| (1) | When the head of a related central administrative agency (including the head of an investigative agency with regard to a photograph or its duplicate (including duplicates of duplicates) under Article 14 of the Act on Special Cases concerning the Punishment of Sexual Crimes out of information provided in Article 44-7(1)9 of the Act; hereafter in this Article the same shall apply) intends to request the Korea Media and Communications Commission pursuant to Article 44-7(3) of the Act to order a provider of information and communications services or the manager or operator of a message board to refuse, suspend, or restrict the management of the information specified in Article 44-7(1)7 through 9 of the Act, he or she shall submit to the Korea Media and Communications Commission a written request stating the following matters, along with evidentiary materials: <Amended on Jan. 28, 2009; Sep. 22, 2016; Jun. 11, 2019; Oct. 1, 2025> |
| 1. | The purpose of and reasons for a request; |
| 2. | Relevant statutes or regulations and the details of violations; |
| 3. | A list of relevant information and a person by whom the relevant information is provided; |
| 4. | The titles or names and contact information, such as addresses, telephone numbers, and e-mail addresses, of the provider of information and communications services or the manager or operator of the message board and users involved. |
| (2) | If the Korea Media and Communications Commission finds any defect in the documents submitted pursuant to paragraph (1), it may request the head of a related central administrative agency to rectify the defect immediately. In such cases, at least 5 more days shall be given for rectification. <Amended on Oct. 1, 2025> |
| (3) | If the head of a related central administrative agency fails to rectify a defect even until the end of a period given for the rectification requested under paragraph (2), the Korea Media and Communications Commission may return the request and evidential materials submitted pursuant to paragraph (1) to the head of the related central administrative agency. <Amended on Oct. 1, 2025> |
[Title Amended on Sep. 22, 2016]
| Article 35 (Grounds for exception from submission of opinions) |
"Ground prescribed by Presidential Decree" in Article 44-7(4)2 of the Act means any of the following cases: <Amended on Aug. 29, 2011>
| 1. | Where a user involved is not identifiable (limited to the submission of a user’s opinion); |
| 2. | Where the facts relevant to an order have already been proved objective by a final judgment of a court or by other decisions and thus issuing the order to hear an opinion is unnecessary. |
| Article 35-2 (Technical and administrative measures to prevent circulation of unlawful information) |
| (1) | "Provider that ... meets the criteria prescribed by Presidential Decree" in the provisions, with the exception of the subparagraphs, of Article 44-7(5) of the Act means a person who engages in the business of transmitting data to users by temporarily storing copies of data, received from an original server, on domestic servers in order to provide another party's information and communications services and whose sales in the information and communications service sector for the previous year (in the case of a corporation, referring to the previous fiscal year) were 1 billion won or more. |
| (2) | "Period prescribed by Presidential Decree" in Article 44-7(5)3 of the Act means 2 years. |
| (3) | "Measures prescribed by Presidential Decree" in Article 44-7(5)4 of the Act means the following measures: <Amended on Oct. 1, 2025> |
| 1. | Designation of a person in charge of preventing the circulation of information prescribed in each subparagraph of Article 44-7(1) of the Act (hereafter referred to as "illegal information" in this paragraph); |
| 2. | Notifying the Korea Media and Communications Commission of the circulation of illegal information, if he or she becomes aware thereof; |
| 3. | Stipulating matters regarding the prevention of circulation of illegal information in the terms and conditions of use or in contract documents. |
[This Article Added on May 20, 2025]
[Previous Article 35-2 moved to Article 35-3 <May 20, 2025>]
| Article 35-2 (Persons responsible for preventing circulation of illegally filmed materials or the like) |
| (1) | A provider of information and communications services obligated to designate a person responsible for preventing the circulation of illegally filmed materials or the like pursuant to Article 44-9(1) of the Act shall be the following persons: |
| 1. | A person who provides value-added telecommunications services defined in subparagraph 14a of Article 2 of the Telecommunications Business Act among special value-added telecommunications business operators referred to in Article 22-3(1) of that Act; |
| 2. | Any of the following persons, who has filed a report on the value-added telecommunications business under Article 22(1) of the Telecommunications Business Act (including a person who falls under any of the subparagraphs of Article 22(4) of that Act): |
| a. | A person who provides information and communication services under Appendix 1-2, posting at least 10 billion won in sales of information and communication services over the preceding year (referring to the preceding business year, in the case of a corporation); |
| b. | A person who provides information and telecommunications services under Appendix 1-2 with an average number of users per day of at least 100,000 during the immediately preceding 3 months as of the end of the previous year. |
| (2) | A provider of information and communications services under the subparagraphs of paragraph (1) (hereinafter referred to as "person obligated to designate a person responsible for preventing the circulation of illegally filmed materials or the like") shall designate at least 1 person responsible for preventing the circulation of illegally filmed materials (hereinafter referred to as "illegally filmed materials or the like") under Article 44-9(1) of the Act (hereinafter referred to as "person responsible for preventing the circulation of illegally filmed materials or the like"). |
| (3) | Persons responsible for preventing the circulation of illegally filmed materials or the like shall be any of the following persons: |
| 1. | An executive officer who belongs to the person obligated to designate a person responsible for preventing the circulation of illegally filmed materials or the like; |
| 2. | The head of the division in charge of preventing the circulation of illegally filmed materials or the like, that is under the control of the person obligated to designate a person responsible for preventing the circulation of illegally filmed materials or the like |
| (4) | A person responsible for preventing the circulation of illegally filmed materials or the like shall receive education (including distance education using information and communications networks) for at least 2 hours every year, including the following, which is delivered by the Korea Media and Communications Commission in cooperation with relevant agencies and organizations: <Amended on Oct. 1, 2025> |
| 1. | Matters regarding systems and statutes and regulations relating to preventing the circulation of illegally filmed materials or the like; |
| 2. | Matters regarding measures necessary to prevent circulation under Article 44-9(2) of the Act; |
| 3. | Matters regarding the criteria for deliberation on illegally filmed materials or the like by the Korea Communications Standards Commission under Article 18 of the Act on the Establishment and Operation of Korea Media and Communications Commission (hereinafter referred to as the "Korea Communications Standards Commission"); |
| 4. | Other matters deemed by the Korea Media and Communications Commission necessary for preventing the circulation of illegally filmed materials or the like. |
[This Article Added on Dec. 8, 2020]
[Moved from Article 35-2 <May 20, 2025>]
| Article 36 (Establishment and management of defamation dispute conciliation division, and conciliation of disputes) |
| (1) | A meeting of the defamation dispute conciliation division shall be convened by the head of the defamation dispute conciliation division. |
| (2) | When the head of the defamation dispute conciliation division intends to hold a meeting of the division, he or she shall determine the date, time, and place of meeting and items on the agenda and shall notify the conciliators thereof by no later than 7 days before the opening of the meeting, except in unavoidable circumstances. |
| (3) | A majority of the conciliators of the defamation dispute conciliation division shall constitute a quorum, and any resolution thereof shall require the concurring votes of at least a majority of those present. |
| (4) | The head of the defamation dispute conciliation division shall be appointed by the Chairman of the Korea Communications Standards Commission, from among conciliators. <Amended on Dec. 8, 2020> |
| (5) | No meeting of the defamation dispute conciliation division shall be open to the public; provided, if it is deemed necessary, the defamation dispute conciliation division may resolve to permit parties to a dispute or interested parties to sit in on a meeting. |
| (6) | Deleted. <Sep. 29, 2011> |
| (7) | Except as provided in this Decree, the establishment, organization, and management of the defamation dispute conciliation division and other matters necessary for the conciliation of disputes shall be determined by the resolution of the Korea Communications Standards Commission. |
CHAPTER VI SECURING OF STABILITY OF INFORMATION AND COMMUNICATIONS NETWORKS
| Article 36-2 (Scope of equipment connected to information and communications networks) |
"Devices, equipment, and facilities prescribed by Presidential Decree" in Article 45(1)2 of the Act means the following devices, equipment, and facilities (hereinafter referred to as "devices and the like connected to information and communications networks") in any field specified in Appendix 1-3:
| 1. | Devices, equipment, and facilities that have caused or are likely to cause a cyber security incident; |
| 2. | Devices, equipment, and facilities that pose a serious risk to ensuring the security of information and communications networks and the reliability of information, if a cyber security incident occurs. |
[This Article Added on Dec. 8, 2020]
[Previous Article 36-2 moved to Article 36-3 <Dec. 8, 2020>]
| Article 36-3 (Preliminary examination standards on protection of information) |
The pre-inspection standards for information security under Article 45-2(2) of the Act shall be determined and publicly notified by the Minister of Science and ICT in consideration of the following matters: <Amended on Mar. 23, 2013; Jul. 26, 2017>
| 1. | The structure and operating environment of the system for building information and communication networks or providing information and communication services; |
| 2. | Identification and risk of assets to be protected, such as hardware, programs, and content for the operation of the system under subparagraph 1; |
| 3. | Current status of establishment and implementation of countermeasures. |
[This Article Added on Aug. 17, 2012]
[Moved from Article 36-2; Previous Article 36-3 moved to Article 36-4 <Dec. 8, 2020>]
| Article 36-4 (Business subject to recommendation of preliminary examination on protection of information) |
| (1) | "Information and communications services or telecommunications business determined by Presidential Decree" in Article 45-2(2)1 of the Act means the information and communications services or telecommunications businesses that require at least 500 million won (referring to an amount exclusive of costs incurred in merely purchasing hardware and software) for investment in information systems. |
| (2) | "Information and communications services or telecommunications business determined by Presidential Decree" in Article 45-2(2)2 of the Act means the information and communications services or the telecommunications businesses that the Minister of Science and ICT fully or partially subsidizes projects for searching for and nurturing new information and communications services or the telecommunications businesses. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
[This Article Added on Aug. 17, 2012]
[Moved from Article 36-3; previous Article 36-4 moved to Article 36-5 <Dec. 8, 2020>]
| Article 36-5 (Methods and procedures for preliminary examinations on protection of information) |
| (1) | The information security pre-inspection under Article 45-2(2) of the Act shall be conducted by means of written inspection, on-site inspection, or remote inspection (referring to the inspection of security-related matters by accessing the system under subparagraph 1 of Article 36-3 through an information and communications network from the outside). <Amended on Dec. 8, 2020> |
| (2) | The information security pre-inspection under Article 45-2(2) of the Act shall be conducted in the following order: |
| 1. | Preparation for the pre-inspection; |
| 2. | Review on designs; |
| 3. | Application of countermeasures for protection; |
| 4. | Current status of establishment and implementation of countermeasures for protection. |
| 5. | Arrangement of results of the pre-inspection. |
| (3) | Upon recommendation from the Minister of Science and ICT under Article 45-2(2) of the Act, a person may conduct the information security pre-inspection by himself or herself or request the Korea Internet and Security Agency or an external specialized organization to conduct the information security pre-inspection on his or her behalf. In such cases, only persons who meet the qualification standards for technical human resources for information security shown in Appendix 2 may conduct the information security pre-inspection. <Amended on Mar. 23, 2013; Jul. 26, 2017; May 20, 2025> |
| (4) | Except as provided in paragraphs (1) through (3), detailed matters related to methods and procedures for information security pre-inspection shall be determined and publicly notified by the Minister of Science and ICT. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
[This Article Added on Aug. 17, 2012]
[Moved from Article 36-4; previous Article 36-5 moved to Article 36-6 <Dec. 8, 2020>]
| Article 36-6 (Fees for preliminary examinations on protection of information) |
| (1) | Where a person who has received a recommendation from the Minister of Science and ICT under Article 45-2(2) of the Act requests the Korea Internet and Security Agency or an external specialized organization to conduct the information security pre-inspection on his or her behalf, the person shall pay fees therefor to the Korea Internet and Security Agency or the external specialized organization. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
| (2) | The Minister of Science and ICT shall determine and publicly notify the calculation criteria for information security pre-inspection in consideration of the following matters: <Amended on Mar. 23, 2013; Jul. 26, 2017> |
| 1. | The scale of information and communications services or telecommunications businesses subject to information security pre-inspection; |
| 2. | Expertise of persons participating in information security pre-inspection; |
| 3. | The period required for information security pre-inspection. |
[This Article Added on Aug. 17, 2012]
[Moved from Article 36-5; previous Article 36-6 moved to Article 36-7 <Dec. 8, 2020>]
| Article 36-7 (Designation of chief information security officers and prohibition on dual office holding) |
| (1) | "Executive officers and employees meeting the criteria prescribed by Presidential Decree" in the main clause of Article 45-3(1) of the Act means persons categorized as follows: <Add on Dec. 7, 2021; Dec. 31, 2024> |
| 1. | Any of the following providers of information and telecommunications services: The business owner or its representative: |
| a. | A person whose capital (referring to the paid-in capital in cases of a corporation and the appraised value of assets for business use if the person is not a corporation) is not more than 100 million won; |
| b. | A small enterprise set forth in Article 2(2) of the Framework Act on Small and Medium Enterprises; |
| c. | A medium enterprise defined in Article 2(2) of the Framework Act on Small and Medium Enterprises, which does not fall under any of the following: |
1) A telecommunications business operator under the Telecommunications Business Act;
2) A person required to obtain certification of an information security management system pursuant to Article 47(2) of the Act;
3) A personal information controller required to disclose its privacy policy under Article 30(2) of the Personal Information Protection Act;
4) A mail order distributor required to file a report under Article 12 of the Act on the Consumer Protection in Electronic Commerce;
| 2. | Any of the following providers of information and communications services: Directors (including persons under Article 401-2(1)3 of the Commercial Act and executive directors under Article 408-2 of that Act): |
| a. | A person whose total assets as of the end of the immediately preceding business year amount to at least 5 trillion won; |
| b. | A person whose total assets as of the end of the immediately preceding business year amount to at least 500 billion won, among those required to obtain certification of an information security management system under Article 47(2) of the Act; |
| 3. | A provider of information and communications services who does not fall under subparagraph 1 or 2: Any of the following persons: |
| a. | The business owner or representative; |
| b. | Directors (including persons prescribed in Article 401-2(1)3 of the Commercial Act and executive directors prescribed in Article 408-2 of that Act); |
| c. | The head of a department that has general supervision and control of information security-related affairs. |
| (2) | "Provider of information and communications services whose total assets, sales, and the like meet the criteria prescribed by Presidential Decree" in the proviso of Article 45-3(1) of the Act means a person referred to in any item of paragraph (1)1 as a provider of information and communications services; provided, any of the following persons shall be excluded: <Amended on Dec. 7, 2021; Nov. 4, 2025> |
| 1. | A telecommunications business operator that resells mobile telecommunications services received from a facilities-based telecommunications business operator pursuant to Article 38(1) of the Telecommunications Business Act; |
| 2. | A value-added telecommunications business operator under Article 22 of the Telecommunications Business Act that acts as an agent for the subscription of mobile telecommunications services by brokering the resale under subparagraph 1. |
| (3) | Where a person falling under the proviso of Article 45-3(1) of the Act fails to report his or her chief information security officer, he or she shall be deemed to have designated the business owner or representative as the chief information security officer. <Added on Dec. 7, 2021> |
| (4) | A chief information security officer required to be designated and reported by a provider of information and communications services pursuant to Article 45-3(1) and (7) of the Act shall have any of the following qualifications; in such cases, a degree in the field of information security or information technology refers to the completion of and graduation from courses offered by departments provided in the items of subparagraph 1 of the remarks of Appendix 1 of the Enforcement Decree of the Electronic Financial Transactions Act at a university or college defined in the subparagraphs of Article 2 of the Higher Education Act or other degrees recognized as equivalent to or higher than aforementioned degrees under other relevant statutes or regulations; and the duties in the field of information security or information technology refers to the duties provided in subparagraphs 3 and 4 of those remarks: <Amended on Dec. 7, 2021; Aug. 9, 2022> |
| 1. | A person who has obtained at least a master’s degree in the field of information security or information technology in the Republic of Korea or abroad; |
| 2. | A person who has at least three years of work experience (including work experience prior to obtaining a degree) in the field of information security or information technology, after obtaining a bachelor’s degree in the field of information security or information technology in the Republic of Korea or abroad; |
| 3. | A person who has at least 5 years of work experience (including work experience prior to obtaining a degree) in the field of information security or information technology, after obtaining an associate degree in the field of information security or information technology in the Republic of Korea or abroad; |
| 4. | A person who has at least 10 years of work experience in the field of information security or information technology; |
| 5. | A person who has obtained the qualification of a certification examiner of information security management systems under Article 47(6)5; |
| 6. | A person who has at least 1 year of work experience as the head of a department in charge of the information security-related affairs of the relevant provider of information and communications services. |
| (5) | "Provider of information and communications services whose total assets, sales, and the like meet the criteria prescribed by Presidential Decree" in Article 45-3(3) of the Act means a person specified in any item of paragraph (1)2 as a provider of information and communications services; provided, a person who is a holding company under subparagraph 2 of Article 2 of the Act on Monopoly Regulation and Fair Trade and does not engage in any other business for profit than the management and administration of its subsidiaries and the business incidental thereto shall be excluded from those specified in paragraph (1)2a. <Amended on Dec. 7, 2021; Dec. 26, 2022; Dec. 26, 2023> |
| (6) | The chief information security officer required to be designated and reported by a provider of information and communications services under paragraph (5) shall be a full-time worker with the qualifications prescribed in paragraph (4) together with any of the following qualifications; in such cases, the duties in the field of information security or information technology refer to the duties under subparagraphs 3 and 4 of the remarks of Appendix 1 of the Enforcement Decree of the Electronic Financial Transactions Act: <Amended on Dec. 7, 2021; Aug. 9, 2022> |
| 1. | A person who has at least 4 years of work experience in the field of information security (including work experience prior to obtaining any of the degrees under paragraph (4)1 through 3 or the qualification prescribed in subparagraph 5 of that paragraph); |
| 2. | A person who has at least 5 years of work experience (including work experience prior to obtaining any of the degrees under paragraph (4)1 through 3 or the qualification prescribed in subparagraph 5 of that paragraph) in the field of information security or information technology (out of the 5 years, at least 2 years of work experience in the field of information security are required). |
[This Article Wholly Amended on Jun. 11, 2019]
[Moved from Article 36-6; previous Article 36-7 moved to Article 36-8 <Dec. 8, 2020>]
| Article 36-8 (Methods and procedures for reporting on chief information security officers) |
An information and communications service provider obligated to designate and report a chief information security officer under the proviso of Article 45-3(1) of the Act shall submit to the Minister of Science and ICT a report on the designation of the chief information security officer prescribed by Decree of the Ministry of Science and ICT within 6 months from the date he or she becomes obligated to report such officer; provided, if the Minister of Science and ICT determines that any of the persons referred to in Article 36-7(2) has unavoidable reasons that prevent the person from submitting the designation report within the period specified in the main clause, the Minister may extend the submission deadline by up to 1 year. <Amended on Jul. 26, 2017; Jun. 11, 2019; Dec. 7, 2021; Nov. 4, 2025>
[This Article Added on Nov. 28, 2014]
[Moved from Article 36-7; previous Article 36-7 moved to Article 36-8 <Dec. 8, 2020>]
| Article 36-9 (Scope of programs of council of chief information security officers) |
"Joint programs prescribed by Presidential Decree" in Article 45-3(5) of the Act means the following programs: <Amended on Nov. 28, 2014; Jun. 11, 2019>
| 1. | Assistance in policy research, studies, and formulation to enable information and communications service providers to strengthen the protection of information; |
| 2. | Analysis on a cyber security incident and the study of measures following the use of information and communications services; |
| 3. | Improvement of information and communications service providers' ability and expertise of the protection of information, including education of chief information security officers; |
| 4. | International exchange and cooperation in relation to information and communications services security; |
| 5. | Other programs necessary for the security of information and communications systems and the safe management of information. |
[This Article Added on Aug. 17, 2012]
[Moved from Article 36-8 <Dec. 8, 2020>]
| Article 37 (Protective measures by integrated information and communication facility operators, etc.) |
| (1) | "Person who meets the standards prescribed by Presidential Decree" in the provisions, with exception of the subparagraphs, of Article 46(1) of the Act means a person specified in any of the following subparagraphs; provided, the foregoing shall not apply to public institutions under Article 3 of the Enforcement Decree of the Public Archives Act. <Added on Jul. 3. 2023> |
| 1. | A person specified in Article 46(1)1 of the Act whose computer room floor area in the integrated and communications facilities that the person operates and manages is at least 500 square meters; |
| 2. | A person specified in Article 46(1)2 of the Act satisfies all the following requirements: |
| a. | A person whose computer room floor area in the integrated information and communications facilities that the person operates and manages shall be at least 500 square meters; |
| b. | A person whose sales from information and telecommunications services for the preceding year (if the person is a corporation, referring to the preceding business year) shall reach or exceed 10 billion won; |
| c. | The average number of domestic users per day for 3 months immediately before the end of the preceding year shall be at least 1 million; |
| (2) | A data integrated information and communication facility operators, etc. under the provisions, with the exception of the subparagraphs, of Article 46(1) of the Act (hereinafter referred to as "integrated information and communication facility operators, etc.") shall take the following protective measures to ensure the stable operation of information and communications facilities: <Amended on Jan. 28, 2009; Jun. 11, 2019; Dec. 7, 2021; Jul. 3, 2023> |
| 1. | Technical and administrative measures for controlling and monitoring access by persons who have no authority to access information and communications facilities; |
| 2. | Physical and technical measures for uninterrupted and stable operation of information and communications facilities and for protecting information and communications facilities from various disasters and threats, such as fire, earthquake, flood, and terrorism; |
| 3. | Measures for selecting and placing personnel for the stable management of information and communications facilities; |
| 4. | Formulation and implementation of an internal control plan for the stable operation of information and communications facilities (including an emergency plan); |
| 5. | Preparation and implementation of technical and administrative measures to contain the spread of cyber security incidents. |
| (3) | The Minister of Science and ICT shall collect opinions from related business operators and determine and publicly notify detailed guidelines for protective measures under paragraph (2). <Amended on Mar. 23, 2013; Jul. 26, 2017; Jul. 3, 2023> |
[Title Amended on Jul. 3, 2023]
| Article 38 (Insurance) |
| (1) | A integrated information and communication facility operator under Article 46(1)1 of the Act (hereinafter referred to as "integrated information and communication facility operator") shall take out a liability insurance policy simultaneously with the commencement of his or her business under Article 46(2) of the Act. <Amended on Jul. 3. 2023> |
| (2) | The amount of liability insurance that a business operator is obligated to purchase under paragraph (1) shall be as specified in Appendix 3. <Amended on Aug. 29, 2011; Jun. 11, 2019; Dec. 8, 2020> |
| Article 39 (Frequency and method of inspection of implementation of protective measures) |
| (1) | The Minister of Science and ICT shall conduct an annual inspection of the implementation of protective measures pursuant to Article 46(3) of the Act (hereinafter referred to as the "inspection of implementation"). |
| (2) | If the inspection of implementation is related to the field of work of another administrative agency, the Minister of Science and ICT shall consult in advance with the head of that agency. |
[This Article Added on Jul. 3, 2023]
| Article 40 (Method of report by integrated information and communication facility operator, etc. on service interruption) |
| (1) | "Period prescribed by Presidential Decree" in Article 46(6) of the Act means the period falling under any of the following: |
| 1. | For 30 or more minutes consecutively; |
| 2. | If there are 2 or more service interruptions within a 24-hour period, the sum of the interruptions is 45 minutes or more. |
| (2) | A report under Article 46(6) of the Act shall include the following matters: |
| 1. | The date, time, and place where the provision of information and communications services is interrupted; |
| 2. | Cause for the interruption of information and communication services and the details of damage; |
| 3. | Emergency measures taken; |
| 4. | Response and recovery plans; |
| 5. | Plan for future measures; |
| 6. | Other matters necessary to cope with and recover from the interruption of the provision of information and communications services. |
| (3) | When the provision of information and communications services is interrupted as described in Article 46(6) of the Act, the integrated information and communication facility operator, etc. shall make a report in writing to the Minister of Science and ICT. |
[This Article Added on Jul. 3, 2023]
| Article 41 (Obligation of lessees of integrated information and communication facilities to take measures) |
A provider of information and communication services that leases and exclusively operates and manages integrated information and communication facilities shall take the following measures in accordance with Article 46(7) of the Act:
| 1. | The provider shall implement protective measures in accordance with Article 37(2); |
| 2. | Where information and communications services are interrupted for the period specified in each subparagraph of Article 40(1) due to a disaster, etc., the provider shall report thereon to the Minister of Science and ICT and notify the integrated information and communication facility operator who has leased the facilities thereof. In this case, Article 40(2) and (3) shall apply mutatis mutandis to the reporting method. |
[This Article Added on Jul. 3, 2023]
| Article 42 (Specialized organization for protective measures and technical support) |
| (1) | "Specialized organization prescribed by Presidential Decree" in Article 46(8) of the Act means any of the following organizations: |
| 1. | Public institutions established under Article 4 of the Act on the Management of Public Institutions; |
| 2. | A non-profit corporation established with the permission of the Minister of Science and ICT pursuant to Article 32 of the Civil Act that performs tasks related to securing the stability of integrated information and communication facilities; |
| 3. | Any other institution or organization recognized by the Minister of Science and ICT as having expertise in the stability of integrated information and communication facilities. |
| (2) | Where the Minister of Science and ICT entrusts the affairs pursuant to Article 46(8) of the Act, he or she shall give public notice of the specialized organization to be entrusted with the affairs and the details of said affairs. |
[This Article Added on Jul. 3, 2023]
| Article 43 Deleted. <Aug. 17, 2012> |
| Article 44 Deleted. <Aug. 17, 2012> |
| Article 45 Deleted. <Aug. 17, 2012> |
| Article 46 Deleted. <Aug. 17, 2012> |
| Article 47 (Methods and procedures for, and scope of, certification of information security management systems) |
| (1) | A person who intends to have his or her information security management system certified under Article 47(1) or (2) of the Act shall file an application for the certification of the information security management system (or an application in an electronic form) with the Korea Internet and Security Agency, an institution designated pursuant to Article 47(6) of the Act (hereinafter referred to as "certification body for information security management systems"), or an institution designated pursuant to Article 47(7) of the Act (hereinafter referred to as "examination institution for information security management systems"), along with a statement of the information security management system (or a statement in an electronic format) containing explanations about the following matters: <Amended on Mar. 23, 2013; May 31, 2016> |
| 1. | The scope of the information security management system; |
| 2. | A list of major information and communications facilities included in the information security management system and the system diagram; |
| 3. | The method and procedure for the establishment and operation of the information security management system; |
| 4. | A list of major documents related to the information security management system; |
| 5. | Details of domestic and foreign certifications obtained for the quality management system in connection with the information security management system. |
| (2) | Where the Korea Internet and Security Agency, a certification body for information security management systems, or an examination institution for information security management systems in receipt of an application referred to in paragraph (1) conducts an examination for certification under Article 47(6)1 of the Act (hereinafter referred to as "examination for certification"), it shall consult with the applicant about the scope, time schedule, etc. of certification in accordance with the certification standards, etc. including countermeasures for administrative, technical, and physical protection, determined and publicly notified by the Minister of Science and ICT for certification of information security systems under paragraph (4) of that Article (hereinafter referred to as "public notice of certification of management systems"). <Amended on Mar. 23, 2013; May 31, 2016; Jul. 26, 2017> |
| (3) | The Korea Internet and Security Agency, a certification body for information security management systems, or an examination institution for information security management systems shall, in the case of conducting an examination for certification, examine whether the information security management system established by the applicant for certification meets requirements for public notice of certification of management systems. In such cases, the examination for certification shall be conducted by means of a written examination or on-site examination. <Amended on May 31, 2016> |
| (4) | An examination for certification may be administered only by a certification examiner under Article 53(1)1. <Amended on May 31, 2016> |
| (5) | An examination institution for information security management systems shall submit the results of an examination for certification to the Korea Internet and Security Agency or a certification body for information security management systems. <Added on May 31, 2016> |
| (6) | The Korea Internet and Security Agency or a certification body for information security management systems shall establish and operate a certification committee composed of members having abundant knowledge and experience in the information protection field to deliberate on the results of examinations for certification. <Amended on May 31, 2016> |
| (7) | Where an information security management system is found to comply with the requirements of the public notice of certification of management systems as a result of deliberation by the certification committee under paragraph (6), the Korea Internet and Security Agency or the certification body for information security management systems shall issue a certificate of information security management system to the person who applied for certification. <Amended on May 31, 2016> |
| (8) | Except as provided in paragraphs (1) through (7), detailed matters required for application for certification, examination for certification, establishment and operation of the certification committee, issuance of certificates, and others shall be determined and publicly notified by the Minister of Science and ICT. <Amended on Mar. 23, 2013; May 31, 2016; Jul. 26, 2017> |
[This Article Wholly Amended on Aug.17, 2012]
[Moved from Article 50; previous Article 47 moved to Article 53 <Aug. 17, 2012>]
| Article 48 (Fees for certification of information security management systems) |
| (1) | A person who intends to apply for certification pursuant to Article 47(1) shall pay fees to the Korea Internet and Security Agency, a certification body for information security management systems, or an examination institution for information security management systems. <Amended on May 31, 2016> |
| (2) | The Minister of Science and ICT shall determine and give a public notice of detailed guidelines for the determination of fees for the certification of information security management systems, taking into consideration the number of certification examiners assigned to an examination for certification, the number of days required for the examination for certification, etc. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
[This Article Added on Aug. 17, 2012]
[Previous Article 48 moved to Article 53-2 <Aug. 17, 2012>]
| Article 49 (Scope of persons subject to certification of information security management systems) |
| (1) | "Person who renders information and communications network services, as prescribed by Presidential Decree" in Article 47(2)1 of the Act means any of the following persons: <Amended on Nov. 4, 2025> |
| 1. | A person who installs and maintains telecommunications line facilities under subparagraph 3 of Article 2 of the Telecommunications Business Act and provides information and communications network services in Seoul Special Metropolitan City and all Metropolitan Cities; |
| 2. | A telecommunications business operator that resells mobile communication services received from a facilities-based telecommunications operator under Article 22 of the Telecommunications Business Act; |
| (2) | "Person meeting the standards prescribed by Presidential Decree" in Article 47(2)3 of the Act means any of the following persons: <Amended on May 31, 2016; Jul. 23, 2024> |
| 1. | A person whose sales or revenues in the preceding year were at least 150 billion won and falls under any of the following categories: |
| a. | A superior general hospital under Article 3-4 of the Medical Service Act; |
| b. | A university or college under Article 2 of the Higher School Act, the number of the enrolled students of which is at least 1000 as of December 31 of the immediately preceding year; |
| 2. | A person whose sales in the information and communication service sector amounted to at least 10 billion won in the previous year (referring to the previous business year in the case of a corporation) are least 10 billion won: excluding, however, financial companies under subparagraph 3 of Article 2 of the Electronic Financial Transactions Act; |
| 3. | A person whose average daily number of users during the preceding year is at least 1 million; provided, excluding financial companies under subparagraph 3 of Article 2 of the Electronic Financial Transactions. |
[This Article Added on Aug. 17, 2012]
[Previous Article 49 moved to Article 53-3 <Aug. 17, 2012>]
| Article 49-2 (Scope of persons eligible for special cases concerning certification of information security management systems) |
| (1) | Any of the following persons that are medium enterprises defined in Article 2(2) of the Framework Act on Small and Medium Enterprises shall be eligible for the special cases concerning certification of information security management systems under Article 47-7(1)2 of the Act: |
| 1. | A person whose sales from information and telecommunications services for the preceding year (if the person is a corporation, referring to the preceding business year) are less than 30 billion won; |
| 2. | A person that does not directly install and operate major information and communications facilities and uses any of the following services (limited to services provided by a person who has obtained certification under Article 47(1) of the Act, certification under Article 32-2(1) of the Personal Information Protection Act, or certification under Article 23-2(1) of the Act on the Development of Cloud Computing and Protection of Its Users) from among persons whose sales from the information and communications service sector amount to at least 30 billion won in the preceding year (referring to the preceding business year in cases of a corporation): |
| a. | Hosting services (referring to services for building websites, maintaining web servers, etc.) |
| b. | Cloud computing services under subparagraphs 2 and 3 of Article 3 of the Enforcement Decree of the Act on the Development of Cloud Computing and Protection of Its Users; |
| (2) | Notwithstanding paragraph (1), any of the following persons shall be excluded from those eligible for special cases concerning the certification of information security management systems under Article 47-7(1)2 of the Act: |
| 1. | A person falling within Article 47(2)1 or 2 of the Act; |
| 2. | A person falling within Article 49(2)1 or 3; |
| 3. | A virtual asset service provider defined in subparagraph 1n of Article 2 of the Act on Reporting and Using Specified Financial Transaction Information; |
| 4. | A financial company defined in subparagraph 3 of Article 2 of the Electronic Financial Transactions Act. |
[This Article Added on Jul. 23, 2024]
| Article 50 |
[Moved to Article 47 <Aug. 17, 2012>]
| Article 51 (Follow-up management of certification) |
| (1) | Follow-up management under Article 47(8) of the Act shall be conducted by means of written examination or on-site examination. <Amended on May 31, 2016> |
| (2) | Where an examination institution for information security management systems finds, as a result of conducting follow-up management pursuant to Article 47(8) of the Act, that there is any of the grounds under the subparagraphs of paragraph (10) of that Article, it shall immediately submit the results of the follow-up management so conducted to the Korea Internet and Security Agency or the certification body for information security management systems. <Added on May 31, 2016> |
| (3) | The Korea Internet and Security Agency or the certification body for information security management systems shall, after deliberation by the certification committee under Article 47(6), notify the results thereof to the Minister of Science and ICT in any of the following cases: <Amended on May 31, 2016; Jul. 26, 2017> |
| 1. | Where follow-up management conducted pursuant to Article 47(8) of the Act finds any of the grounds under the subparagraph of paragraph (10) of that Article; |
| 2. | Where the Korea Internet and Security Agency or the certification body for information security management systems receives the results of follow-up management from the examination institution for information security management systems pursuant to paragraph (2). |
[This Article Wholly Amended on Aug.17, 2012]
[Moved from Article 52; previous Article 51 is deleted <Aug. 17, 2012>]
| Article 52 (Indication and public relation of certification) |
A person who obtains certification of his or her information security management system pursuant to Article 47(1) or (2) of the Act may use the information security management system certification mark determined and publicly notified by the Minister of Science and ICT when he or she indicates or publicizes the content of certification in a document, invoice, advertisement, etc. in accordance with Article 47(9) of the Act. In such cases, the scope and validity period of certification shall be indicated together with the mark. <Amended on Mar. 23, 2013; May 31, 2016; Jul. 26, 2017>
[This Article Wholly Amended on Aug.17, 2012]
[Moved from Article 53; previous Article 52 moved to Article 51 <Aug. 17, 2012>]
| Article 53 (Criteria for designation of certification institution for information protection and management systems and examination institution for information protection and management systems) |
| (1) | Standards for designating certification bodies for information security management systems and examination institutions for information security management systems shall be as follows: <Amended on Mar. 23, 2013; May 31, 2016; Jul. 26, 2017> |
| 1. | A certification body shall have at least 5 persons who meet the requirements for the qualification determined and publicly notified by the Minister of Science and ICT (hereinafter referred to as "certification examiners"); |
| 2. | A certification body shall be approved as competent in an examination administered by the Minister of Science and ICT on the requirements and competence for the performance of the duties. |
| (2) | The Minister of Science and ICT shall determine and publicly notify matters related to the education and qualification management of certification examiners and detailed standards for the examination on the requirements and competence for the performance of the duties under paragraph (1)2. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
[This Article Wholly Amended on Aug.17, 2012]
[Title Amended on May 31, 2016]
[Moved from Article 47; previous Article 53 moved to Article 52 <Aug. 17, 2012>]
| Article 53-2 (Procedures for designation of certification institution for information security management systems and examination institution for information protection and management systems) |
| (1) | A person who intends to have his or her business designated as a certification body for information security management systems or an examination institution for information security management systems pursuant to Article 47(6) or (7) of the Act shall file an application (including in electronic form) for the designation of a certification body for information security management systems or an examination institution for information security management systems with the Minister of Science and ICT, along with the following documents (or electronic documents): <Amended on Aug. 17, 2012; Mar. 23, 2013; May 31, 2016; Jul. 26, 2017> |
| 1. | Articles of incorporation, or bylaws of an association; |
| 2. | A statement of the current status of certification examiners employed and a document certifying the current status; |
| 3. | Documents determined and publicly notified by the Minister of Science and ICT as those necessary for the examination on the requirements and competence for the performance of duties, including work experience in performing duties for the protection of information and the level of expertise. |
| (2) | Upon receipt of an application for the designation under paragraph (1), the Minister of Science and ICT shall verify the relevant corporate registration by sharing administrative information under Article 36(1) of the Electronic Government Act, if the applicant is a corporation. <Amended on May 4, 2010; Nov. 2, 2010; Mar. 23, 2013; Jul. 26, 2017> |
| (3) | Upon receipt of an application for designation under paragraph (1), the Minister of Science and ICT shall examine whether the application meets the standards for designation under Article 53(1), notify the applicant of the result within 3 months from the date of receipt of the application, and issue a certificate of designation as a certification body for information security management systems or a certificate of designation as an examination institution for information security management systems to the applicant who is designated as a certification body for information security management systems or an examination institution for information security management systems. <Amended on Aug. 17, 2012; Mar. 23, 2013; May 31, 2016; Jul. 26, 2017> |
| (4) | When the Minister of Science and ICT examines whether an application meets the standards for the designation under paragraph (3), he or she may require the applicant to submit data or may conduct an on-site inspection within the necessary extent. In such cases, a person who conducts the on-site inspection shall present identification verifying his or her qualification to the applicant. <Amended on Aug. 17, 2012; Mar. 23, 2013; Jul. 26, 2017> |
| (5) | Deleted. <Jun. 25, 2012> |
[Title Amended on May 31, 2016]
[Moved from Article 48 <Aug. 17, 2012>]
| Article 53-3 (Effective period for designation of certification institution for information protection and management systems and examination institution for information protection and management systems) |
| (1) | The validity period of the designation of a certification body for information security management systems or an examination institution for information security management systems under Article 53-2 shall be 3 years. <Amended on Aug. 17, 2012; May 31, 2016> |
| (2) | A certification body may file an application for redesignation during the period from 6 months before the expiry of the validity period under paragraph (1) to the expiry date. In such cases, the designation shall be deemed to continue to be valid until the applicant for redesignation is notified of a decision on the application. |
| (3) | Articles 53 and 53-2, and paragraph (1) shall apply mutatis mutandis to the redesignation under paragraph (2). <Amended on Aug. 17, 2012> |
[Title Amended on May 31, 2016]
[Moved from Article 49 <Aug. 17, 2012>]
| Article 53-4 (Follow-up management of certification institution for information protection and management systems and examination institution for information protection and management systems) |
| (1) | Each certification body for information security management systems and examination institution for information security management systems shall submit a report according to the following classification for the previous year to the Minister of Science and ICT by January 31 each year: <Amended on May 31, 2016; Jul. 26, 2017> |
| 1. | Certification body for information security management systems: Report on the certification performance records for the previous year; |
| 2. | Examination institution for information security management systems: Report on the certification examination performance records for the previous year. |
| (2) | If the Minister of Science and ICT deems it necessary to ascertain whether a certification body for information security management systems or an examination institution for information security management systems falls under any subparagraph of Article 47-2(1) of the Act, he or she may require the certification institution or the examination institution to submit data or may conduct an on-site inspection. <Amended on Mar. 23, 2013; May 31, 2016; Jul. 26, 2017> |
[This Article Added on Aug. 17, 2012]
[Title Amended on May 31, 2016]
| Article 54 (Guidelines for revocation of designation) |
Guidelines for administrative dispositions rendered for the revocation of designation or the suspension of business under Article 47-2 of the Act are as prescribed in Appendix 4.
| Article 54-2 Deleted. <Dec. 9, 2022> |
| Article 54-3 (Entrustment of affairs regarding measures to prevent computer security incidents and preclude spread thereof) |
| (1) | The head of a central administrative agency may entrust affairs regarding measures to be taken under Article 47-4(1) of the Act to the Korea Internet and Security Agency or an organization that specializes in protecting users' information, which the head of the central administrative agency determines in consultation with the Minister of Science and ICT. <Amended on Dec. 9, 2022> |
| (2) | Where the head of the central administrative agency designates an entrusted agency pursuant to paragraph (1), he or she shall publicly notify the entrusted agency and the details of the affairs to be entrusted. |
[This Article Added on Dec. 8, 2020]
| Article 55 (Standard agreements on requests to users for protective measures) |
Matters that shall be stipulated in the terms and conditions of use with respect to a request to users for protective measures under Article 47-4(3) of the Act shall be as follows: <Amended on Aug. 17, 2012; Dec. 8, 2020>
| 1. | Grounds for requesting users to take protective measures and a method of making such request; |
| 2. | Details of protective measures that users shall take; |
| 3. | The period during which access to an information and communications network is restricted, if a user fails to take protective measures; |
| 4. | Procedures for filing a user’s objection and for compensation therefor, if a user’ access is unreasonably restricted on the grounds of the user’s failure to take protective measures. |
| Article 55-2 (Criteria for examination for rating management of information protection) |
| (1) | The criteria for examination for the assignment of an information security management grade under Article 47-5(1) of the Act shall be as follows: |
| 1. | The scope and period of operation of the information security management system; |
| 2. | An organization exclusively dedicated to information security and the budget therefor; |
| 3. | Information security management activities and security measure level. |
| (2) | Matters necessary for the detailed evaluation criteria, evaluation methods, etc. for each examination criterion listed under paragraph (1) shall be determined and publicly notified by the Minister of Science and ICT. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
[This Article Added on Aug. 17, 2012]
| Article 55-3 (Methods and procedures for rating management of information protection) |
| (1) | A person who intends to obtain an information security management grade under Article 47-5(1) of the Act shall file an application (including in electronic form) for an information security management grade with the Korea Internet and Security Agency, along with a copy of the certificate of information security management system. |
| (2) | The examination for assignment of an information security management grade shall be conducted by means of reviewing documents or through an on-site examination. |
| (3) | The examination under paragraph (2) may be conducted only by certification examiners. |
| (4) | If the results of an examination administered under paragraph (2) meet the criteria for examination under Article 55-2, the Korea Internet and Security Agency shall issue a certificate of information security management grade to the applicant for the grade qualified for management. |
| (5) | Except as provided in paragraphs (1) through (4), detail matters necessary for applying for and examining the assignment of an information security management grade, issuing a certificate of information security management grade, and performing relevant affairs shall be determined and publicly notified by the Minister of Science and ICT. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
[This Article Added on Aug. 17, 2012]
| Article 55-4 (Fees for rating management of information protection) |
The provisions of Articles 48 and 52 shall apply mutatis mutandis to fees for information security management grades and indication and publicity thereof.
[This Article Added on Aug. 17, 2012]
| Article 55-5 (Effective period of rating for management of information protection) |
The validity period of an information security management grade under Article 55-3 shall be one year.
[This Article Added on Aug. 17, 2012]
| Article 55-6 (Awards to disclosers of information security vulnerabilities) |
| (1) | Persons entitled to monetary awards and the criteria and procedures for the payment thereof under Article 47-6(1) of the Act shall be as specified in Appendix 4-2. |
| (2) | Where the Minister of Science and ICT entrusts duties related to the payment of monetary awards to the Korea Internet and Security Agency pursuant to Article 47-6(3) of the Act, he or she shall publicly notify the details of the entrusted duties. |
[This Article Added on Dec. 9, 2022]
| Article 56 (Countermeasures against computer security incidents) |
"Other countermeasures against cyber security incidents prescribed by Presidential Decree" in Article 48-2(1)4 of the Act means the following measures: <Amended on Jan. 28, 2009; Dec. 8, 2020>
| 1. | Requesting a major provider of information and communications services or a business operator who operates and manages integrated information and telecommunications facilities for the provision of information and communications services of other persons under Article 46(1) of the Act to cut off access channels (limited to access channels that have been used, or are likely to be used, for spreading cyber security incidents); |
| 2. | Requesting a software business operator, defined under subparagraph 4 of Article 2 of the Software Promotion Act, who produced or distributed the software involved in a cyber security incident, to produce and distribute a program by which the vulnerability in security of the software is cured and corrected (hereinafter referred to as "program for curing the vulnerability in security") and requesting the provider of information and communications services to release the program for curing the vulnerability in security through information and communications networks; |
| 3. | Spreading forecasts and warnings of cyber security incidents under Article 48-2(1)2 of the Act to mass media and providers of information and communications services; |
| 4. | Providing information about cyber security incidents to the heads of related agencies, if necessary for the security of national information and communications networks. |
| Article 57 (Persons providing information about computer security incidents) |
"Persons prescribed by Presidential Decree from among those who operate an information and communications network" in Article 48-2(2)3 of the Act means any of the following persons among those who operate an information and communications network: <Amended on Mar. 28, 2008; Jan. 28, 2009; Oct. 1, 2010; Aug. 29, 2011; Mar. 23, 2013; Jul. 26, 2017>
| 1. | An institution subject to a protection plan and protection guidelines on critical information and communications infrastructure, formulated and established by the Minister of Science and ICT pursuant to Articles 6 and 10 of the Act on the Protection of Information and Communications Infrastructure; |
| 2. | A person who periodically observes the current status of operation of information and communications networks by providers of information and communications services and provides information on cyber security incidents; |
| 3. | A person specified and publicly notified by the Minister of Science and ICT among private business operators who operate information and communications networks independently with Internet protocol addresses allocated by the Korea Internet and Security Agency under subparagraph 1a of Article 2 of the Internet Address Resources Act; |
| 4. | A producer of antivirus software against computer viruses among persons who engage in the information protection industry. |
| Article 58 (Provision of information on computer security incidents) |
A person who provides information on cyber security incidents under Article 48-2(2) of the Act shall comply with the following subparagraphs in providing information on cyber security incidents: <Amended on Mar. 23, 2013; Jul. 26, 2017>
| 1. | A method which a person applies to providing such information shall conform to a method determined by the Minister of Science and ICT, taking into consideration characteristics of information and communications networks, trends in cyber security incidents, etc.; |
| 2. | The person shall take measures to prevent the destruction, obliteration, and alteration of information on cyber security incidents; |
| 3. | The person shall adopt encryption techniques determined by the Minister of Science and ICT; |
| 4. | The person shall comply with other methods and procedures determined and publicly notified by the Minister of Science and ICT. |
| Article 58-2 (Time, methods, and procedures for reporting of cyber security incidents) |
| (1) | Where a provider of information and communications services intends to report a cyber security incident pursuant to the former part of Article 48-3(1) of the Act, he or she shall report the following matters to the Minister of Science and ICT or the Korea Internet and Security Agency within 24 hours from the time he or she becomes aware of the occurrence of the cyber security incident: |
| 1. | The date, time, cause, and details of damage caused by the cyber security incident; |
| 2. | Current status of responses, such as measures to be taken against the cyber security incident; |
| 3. | The department and contact information in charge of responding to the cyber security incident. |
| (2) | The provider of information and communications service shall, if there is any additionally verified fact regarding the cyber security incident after filing a report pursuant to paragraph (1), report it within 24 hours from the time it is verified. |
| (3) | A report under paragraphs (1) and (2) may be made in writing, by e-mail, by telephone, by inputting it into the website of the Ministry or the Agency, or through other means. |
[This Article Added on Aug. 13, 2024]
| Article 58-3 (Procedures for inspection of implementation of measures on cyber security incidents) |
Where the Minister of Science and ICT intends to inspect the implementation of measures under Article 48-4(2) of the Act in accordance with Article 48-4(3) of the Act, he or she shall notify the relevant provider of information and communications services of an inspection plan including the purpose, date and time, method, details, etc. of the inspection by no later than 7 days prior to the inspection; provided, he or she need not notify the provider of information and communications services in advance if it is deemed urgent, such as the expected occurrence of additional cyber security incidents or if it is deemed impractical to achieve the purpose of inspection due to destruction of evidence, etc. by prior notification.
[This Article Added on Aug. 13, 2024]
| Article 59 (Organization and operation of private-public joint investigation team) |
| (1) | A private-public joint investigation team referred to in Article 48-4(4) of the Act (hereinafter referred to as the "Investigation Team") shall be comprised of approximately 20 investigation members, including the head and the deputy head, and the number of such members may be adjusted based on the scale and type of a cyber security incident. <Amended on Aug. 13, 2024> |
| (2) | Members of the Investigation Team shall be appointed or commissioned by the Minister of Science and ICT from among the following persons; and the head shall be designated by the Minister of Science and ICT from among public officials of at least Grade IV specified in subparagraph 1 and the deputy head shall be nominated by the Minister of Science and ICT from among persons specified in subparagraph 3: |
| 1. | Public officials of the Ministry of Science and ICT in charge of investigation of cyber security incidents; |
| 2. | Persons who have expertise and experience in relation to cyber security incidents; |
| 3. | Executive officers and employees of the Korea Internet and Security Agency; |
| 4. | Other persons deemed necessary for analyzing the causes of cyber security incidents. |
| (3) | The Investigation Team shall be comprised of an investigation task force that analyzes the causes of cyber security incidents and a verification task force that verifies the analysis results; provided, the head of the Investigation Team may operate a task force by integrating such investigation and verification task forces or organize another task force if it is deemed necessary. |
| (4) | The head of the Investigation Team may seek advice from relevant experts or companies specializing in information security, if necessary for analyzing the causes of a cyber security incident. |
| (5) | Allowances, travel expenses, and other necessary expenses may be paid within the budget to the members of the Investigation Team who are not public officials and relevant experts, etc. referred to in paragraph (4). |
| (6) | Upon completing the analysis of the causes of a cyber security incident, the head of the Investigation Team shall prepare a report on the results thereof without delay and report it to the Minister of Science and ICT. |
| (7) | Where the purpose of organizing the Investigation Team is deemed accomplished, the Minister of Science and ICT may dissolve the Investigation Team. |
| (8) | Except as provided in paragraphs (1) through (7), matters necessary for the composition and operation of the Investigation Team shall be determined by the Minister of Science and ICT. |
[This Article Wholly Amended on Dec. 9, 2022]
| Article 60 (Protection of data related to computer security incidents and methods and procedures for investigation) |
| (1) | The Minister of Science and ICT and the Investigation Team shall keep the data submitted or information learned through investigation under Article 48-4(6) of the Act in a safe manner to prevent such data or information from being stolen, divulged, damaged, or altered. <Amended on Aug. 13, 2024> |
| (2) | When a public official under the Minister's jurisdiction or a member of the Investigation Team enters the place of business of a relevant person pursuant to the main clause of Article 48-4(6) of the Act, he or she shall present identification in the form specified in Appendix 5 verifying his or her authority to the relevant person. <Amended on Aug. 13, 2024> |
[This Article Wholly Amended on Dec. 9, 2022]
| Article 60-2 (Institutions specialized in countermeasures against computer security incidents related to equipment connected to information and communications networks) |
"Specialized organizations prescribed by Presidential Decree" in the provisions, with the exception of the subparagraphs, of Article 48-5(4) of the Act means the following institutions:
| 1. | The Korea Internet and Security Agency; |
| 2. | An institution determined through consultation between the Minister of Science and ICT and the heads of relevant central administrative agencies, which has expertise in dealing with cyber security incidents related to devices and the like connected to information and communications networks. |
[This Article Added on Dec. 8, 2020]
| Article 60-3 (Procedures for information security certification) |
| (1) | A person who intends to obtain information security certification under Article 48-6(1) of the Act (hereinafter referred to as "information security certification") shall submit an application for information security certification prescribed by Decree of the Ministry of Science and ICT to the Minister of Science and ICT along with the following documents and shall produce devices and the like connected to information and communications networks, subject to information security certification: |
| 1. | Documents proving that the certification standards under Article 48-6(2) of the Act (hereinafter referred to as "information security certification standard") have been satisfied; |
| 2. | A user manual of devices and the like connected to information and communications networks subject to information security certification; |
| 3. | Other documents prescribed by Decree of the Ministry of Science and ICT as necessary for information security certification. |
| (2) | Upon receipt of an application for information security certification pursuant to paragraph (1), the Minister of Science and ICT shall request a testing agency for certification designated pursuant to Article 48-6(4) of the Act (hereinafter referred to as "testing agency for certification") to conduct a test to confirm compliance with the certification standards under paragraph (2) of that Article (hereinafter referred to as "information security certification test"). |
| (3) | Where necessary for conducting an information security certification test, a testing agency for certification may conduct a test on the site where the relevant devices and the like connected to information and communications networks are installed. |
| (4) | A testing agency for certification shall submit a report on the results of information security certification tests to the Minister of Science and ICT. |
| (5) | The Minister of Science and ICT shall examine a report on the results of information security certification tests submitted pursuant to paragraph (4); and where the devices and the like connected to information and communications networks meet the information security certification standards, he or she shall issue an information security certification prescribed by Decree of the Ministry of Science and ICT to a person who applies for information security certification pursuant to paragraph (1), and shall publicly announce such fact on the Ministry's website. |
| (6) | The Minister of Science and ICT who has revoked information security certification pursuant to Article 48-6(3) of the Act shall notify the relevant person of such fact and publicly announce it on the Ministry's website. |
[This Article Added on Dec. 8, 2020]
| Article 60-4 (Effective period of information security certification) |
| (1) | The validity period of information security certification shall be 3 years and may be extended only once by up to 2 years. |
| (2) | A person who intends to extend the validity period of information security certification pursuant to paragraph (1) shall file an application for an extension of the validity period of information security certification with the Minister of Science and ICT by no later than 6 months before the expiration of the validity period, as prescribed by Decree of the Ministry of Science and ICT. |
| (3) | Upon receipt of an application for extension of the validity period under paragraph (2), the Minister of Science and ICT may extend the validity period only where the sameness of the characteristics and configuration is recognized for the devices and the like connected to the information and communications network for which the information security certification has been granted. |
| (4) | The Minister of Science and ICT who extends the validity period under paragraph (3) shall issue information security certification reflecting the extended validity period as prescribed by Decree of the Ministry of Science and ICT to the applicant for extension of the validity period and shall publicly announce such fact on the Ministry's website. |
[This Article Added on Dec. 8, 2020]
| Article 60-5 (Fees for information security certification) |
| (1) | A person who intends to apply for information security certification shall pay a fee. |
| (2) | The criteria for calculating fees under paragraph (1) shall be determined and publicly notified by the Minister of Science and ICT. |
[This Article Added on Dec. 8, 2020]
| Article 60-6 (Follow-up management of information security certification) |
| (1) | Where devices and the like connected to information and communications networks for which information security certification has been granted fail to meet the standards for information security certification due to discovery of vulnerabilities, the Minister of Science and ICT may request a person who has obtained the relevant information security certification to fix such vulnerabilities for a specified period. |
| (2) | Details necessary for a request to fix vulnerabilities under paragraph (1) shall be determined and publicly notified by the Minister of Science and ICT. |
[This Article Added on Dec. 8, 2020]
| Article 60-7 (Standards for designating testing agencies for certification) |
| (1) | "Institution satisfying the designation standards prescribed by Presidential Decree" in Article 48-6(4) of the Act means an institution meeting all of the following standards: |
| 1. | It shall be a corporation engaged in the affairs related to information security certification tests; |
| 2. | It shall have human resources (including two full-time workers) with technical capabilities, who are in charge of the affairs related to information security certification tests, and an organization dedicated to such affairs; |
| 3. | It shall have a test environment, such as facilities and laboratory spaces, to perform the affairs related to information security certification tests; |
| 4. | It shall have the operational ability to perform the affairs related to information security certification tests. |
| (2) | A person seeking to be designated as a testing agency for certification shall file an application for designation as a testing agency for certification with the Minister of Science and ICT, along with documents proving that he or she meets the designation standards provided in paragraph (1). |
| (3) | Upon receipt of an application under paragraph (2), the Minister of Science and ICT may designate a testing agency for certification after examining whether it satisfies the designation standards under paragraph (1). |
| (4) | The Minister of Science and ICT who designates a testing agency for certification pursuant to paragraph (3) shall issue a certificate of designation in the form prescribed by Decree of the Ministry of Science and ICT to the applicant and shall publicly announce such fact in the Official Gazette and on the Ministry's website. |
| (5) | The validity period of the designation under paragraph (3) shall be determined by the Minister of Science and ICT for up to 3 years; and where it is intended to continue to conduct the affairs of a testing agency for certification after the validity period expires, an application for redesignation shall be filed from 6 months before the expiry of the validity period until the expiration date of the validity period. |
| (6) | The designation shall be deemed valid until the applicant is notified of the results of the examination of the application for redesignation under paragraph (5). |
| (7) | Detailed matters related to the designation standards and procedures for testing agencies for certification, redesignation, etc. under paragraphs (1) through (6) shall be determined and publicly notified by the Minister of Science and ICT. |
[This Article Added on Dec. 8, 2020]
| Article 60-8 (Follow-up management of testing agencies for certification and revocation of designation) |
| (1) | A testing agency for certification shall submit the results of certification tests for the previous year to the Minister of Science and ICT by January 31 of each year in a report in the form prescribed by Decree of the Ministry of Science and ICT. |
| (2) | The Minister of Science and ICT may request a testing agency for certification to submit data or visit the site to verify whether it meets the designation standards under Article 48-6(4) of the Act or whether it gives rise to the grounds for revocation of designation under the subparagraphs of paragraph (5) of that Article. |
| (3) | Upon revoking a designation as a testing agency for certification under Article 48-6(5) of the Act, the Minister of Science and ICT shall notify the relevant institution of the revocation and publicly announce such revocation in the Official Gazette and on the Ministry’s website. |
[This Article Added on Dec. 8, 2020]
| Article 60-9 (Entrustment of information security certification affairs) |
Pursuant to Article 48-6(6) of the Act, the Minister of Science and ICT shall entrust the following affairs to the Korea Internet and Security Agency:
| 1. | Receiving applications for information security certification, requesting the implementation of information security certification tests, receiving reports on the results of information security certification tests, issuing information security certificates, and publicly announcing information security certification and revocation thereof, under Articles 60-3(1), (2), and (4) through (6); |
| 2. | Receiving applications for extension of the validity period of information security certification, issuing an information security certificate, and publicly announcing information security certification pursuant to Article 60-4(2) and (4); |
| 3. | Reviewing the fix of vulnerabilities of information security certification and supporting the delivery of requests to fix vulnerabilities under Article 60-6. |
[This Article Added on Dec. 8, 2020]
| Article 60-10 (Terms and conditions on measures for prevention of damage) |
Matters that shall be stipulated in the terms and conditions of use under Article 49-2(5) of the Act with respect to measures to prevent damage and the spread thereof shall be as follows:
| 1. | The grounds for and details of the measures prescribed in the items of Article 49-2(3)3 of the Act; |
| 2. | The period of taking the measure to discontinue the provision of services pursuant to Article 49-2(3)3b of the Act; |
| 3. | The procedures for filing a user's objection to any of the measures taken under the items of Article 49-2(3)3 of the Act; |
| 4. | Where any of the measures prescribed in the items of Article 49-2(3)3 of the Act is taken, the methods and procedures for notifying users of the grounds for and details of such relevant measure, the procedure for filing an objection, and other relevant matters. |
[This Article Added on Dec. 9, 2022]
| Article 60-11 (Discontinuance of telecommunications services for phone numbers used as means of deception) |
| (1) | "Person prescribed by Presidential Decree, including the Commissioner General of the Korean National Police Agency, the Prosecutor General, and the Governor of the Financial Supervisory Service" in Article 49-3(1) of the Act means the Commissioner General of the Korean National Police Agency, the Prosecutor General, and the Governor of the Financial Supervisory Service. |
| (2) | Where a user intends to file an objection pursuant to Article 49-3(2) of the Act, the user shall submit a written statement of the following matters to the authority that requested the discontinuance of the relevant telecommunications service pursuant to paragraph (1) of that Article (hereafter in this Article referred to as "authority that requested the discontinuance of the service") within 30 days from the date the telecommunications service was discontinued: |
| 1. | The name or business name, address, and contact information of the petitioner; |
| 2. | The grounds for the objection; |
| 3. | The date the telecommunications service was discontinued. |
| (3) | Upon receipt of an objection filed under paragraph (2), the authority that requested the discontinuance of the service shall make a decision on the objection within 15 days from the date of receipt and shall notify the results of the decision, in writing, to the petitioner; provided, if it is impracticable to make a decision within the period due to an unavoidable reason, the authority may extend the period by up to 15 days and shall notify the petitioner of the reason for the extension and the extended period. |
| (4) | If there is any deficiency in a written statement submitted under paragraph (2) or further facts need to be verified, the authority that requested the discontinuance of the service may request that such statement or facts be supplemented. In such cases, the period taken for supplementation shall not be included in the period specified in paragraph (3). |
| (5) | Where the authority that requested the discontinuance of the service deems that an objection filed under Article 49-3(2) of the Act is reasonable, it shall request the Minister of Science and ICT to terminate the discontinuance of the relevant telecommunications service without delay. |
[This Article Added on Dec. 9, 2022]
| Article 61 (Guidelines for transmission of advertising information for profit) |
| (1) | "Period prescribed by Presidential Decree" in Article 50(1)1 of the Act means 6 months from the date the trade of the relevant goods, etc. is concluded. <Amended on Nov. 28, 2014> |
| (2) | "Media prescribed by Presidential Decree" in the proviso of Article 50(3) of the Act means electronic mail. <Added on Nov. 28, 2014> |
| (3) | Matters that a person who transmits advertising information for profit, using an electronic transmission medium pursuant to Article 50(4) of the Act shall clearly state in the relevant information, and methods therefor shall be as specified in Appendix 6. <Amended on Nov. 28, 2014> |
| Article 62 (Provision of free telephone services for refusal of reception or withdrawal of consent to reception) |
A person who transmits advertising information for profit, using an electronic transmission medium shall clearly state information about free telephone services, etc. for the refusal of reception or for the withdrawal of consent to reception, as prescribed in Appendix 6, and shall provide such services to addressees in accordance with Article 50(6) of the Act. <Amended on Mar. 29, 2011; Nov. 28, 2014>
| Article 62-2 (Notification of results of handling of consent to receive messages) |
A person who intends to transmit advertising information for profit, using an electronic transmission medium pursuant to Article 50(7) of the Act shall notify an addressee of the following matters within 14 days from the date the relevant addressee expresses his or her consent to receipt of messages, refusal to receive messages or withdrawal of his or her consent to receive messages:
| 1. | The name of a sender; |
| 2. | The fact that the addressee has consented to receive messages, refused to receive messages, or withdrawn his or her consent to receive messages, and the date he or she expresses the relevant intent; |
| 3. | The results of the handling thereof. |
[This Article Added on Nov. 28, 2014]
| Article 62-3 (Verification of addressees' consents to receive messages) |
| (1) | A person who has obtained prior consent from an addressee pursuant to Article 50(1) or (3) of the Act shall verify whether the relevant addressee gives consent to receive messages every two years from the date he or she obtains consent to receive messages from the addressee (referring to the day before every second year from the date he or she obtains consent to receive messages) pursuant to paragraph (8) of the aforesaid Article. |
| (2) | A person who intends to verify whether an addressee gives his or her consent to receive messages pursuant to paragraph (1) shall advise the addressee of the following matters: |
| 1. | The name of a sender; |
| 2. | The fact that the addressee gives consent to receive messages, and the date he or she gives consent to receive messages; |
| 3. | The methods for expressing his or her intent to maintain or withdraw his or her consent to receive messages. |
[This Article Added on Nov. 28, 2014]
| Article 63 (Devices for restricting installation of advertising programs for profits) |
"Information processing device prescribed by Presidential Decree" in the former part of Article 50-5 of the Act means an information processing device with which information can be transmitted and received by connecting it to an information and communications network, such as mobile Internet and mobile telephones. <Amended on Aug. 29, 2011>
| Article 64 (Subsidization for development of software designed to cut off transmission of advertising information for profits) |
| (1) | Pursuant to Article 50-6 of the Act, the Korea Media and Communications Commission may fully or partially subsidize a project of a public institution, corporation, or organization that develops and distributes a piece of software or a computer program for conveniently blocking or reporting advertising information transmitted for profits in violation of Article 50 of the Act (hereinafter referred to as "software for blocking or reporting advertisements"), within the budget. <Amended on Oct. 1, 2025> |
| (2) | The Korea Media and Communications Commission may recommend providers of information and communications services and users to use the software for blocking or reporting advertisements developed in accordance with paragraph (1). <Amended on Jan. 28, 2009; Aug. 4, 2020; Oct. 1, 2025> |
| Article 65 (Operation of the Korea Internet and Security Agency) |
| (1) | The Minister of Science and ICT, the Minister of the Interior and Safety, the Korea Media and Communications Commission, or the Personal Information Protection Commission may request the head of a related agency to dispatch public officials related to the affairs of the Korea Internet and Security Agency under the subparagraphs of Article 52(3) of the Act. <Amended on Oct. 1, 2010; Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Aug. 4, 2020; Oct. 1, 2025> |
| (2) | When the head of a related agency who dispatched a public official under paragraph (1) needs to have the public official returned during the period of dispatch service, he or she shall consult with the head of the agency that requested for such dispatch. |
| (3) | The head of the Korea Internet and Security Agency may authorize a research institute related to information and communications to conduct part of the business affairs specified in Article 52(3)4 of the Act, with approval therefor from the Minister of Science and ICT, the Minister of the Interior and Safety or the Korea Media and Communications Commission. <Amended on Oct. 1, 2010; Mar. 23, 2013; Nov. 28, 2014; Jul. 26, 2017; Oct. 1, 2025> |
| (4) | If a business affair that the head of the Korea Internet and Security Agency conducts in accordance with Article 52(3) of the Act is related to the protection of a public institution’s information, he or she shall obtain approval therefor from the head of the related institution. <Amended on Oct. 1, 2010> |
| (5) | The Korea Internet and Security Agency shall perform the following affairs in order to promote programs for transmitting advertising information under Article 52(3)10 and 22 of the Act. <Add on Aug. 4, 2020; Jul. 23, 2024> |
| 1. | Settlement of grievances relating to the transmission of advertising information and counseling thereon; |
| 2. | Provision of technical advice under Article 64(10) of the Act related to the transmission of advertising information and other necessary assistance; |
| 3. | Research on measures to prevent illegal transmission of advertising information; |
| 4. | Education and publicity for the prevention of illegal transmission of advertising information; |
| 5. | Affairs related to the duties under subparagraphs 1 through 4. |
| (6) | If deemed necessary for requiring providers of information and communications services to submit relevant articles, documents, etc. or for efficiently conducting inspections under Article 64(1) or (3) of the Act related to the transmission of advertising information, the Korea Media and Communications Commission may dispatch its public officials to the Korea Internet and Security Agency pursuant to Article 32-4 of the State Public Officials Act. <Added on Aug. 4, 2020; Oct. 1, 2025> |
[Title Amended on Oct. 1, 2010]
| Article 66 Deleted. <Aug. 4, 2020> |
CHAPTER VI-2 TELECOMMUNICATIONS BILLING SERVICES
| Article 66-2 (Requirements for registration) |
| (1) | A person who intends to be registered as a provider of telecommunications billing services under Article 53 of the Act shall meet all the following requirements: <Amended on Mar. 23, 2013; Jul. 26, 2017; Dec. 28, 2021; Dec. 31, 2024> |
| 1. | The ratio of the total liabilities to the equity capital, total contributions, or endowment shall not exceed a ratio determined and publicly notified by the Minister of Science and ICT, which shall not exceed 200/100. If the majority stockholder is a company that belongs to a conglomerate, defined under subparagraph 11 of Article 2 of the Monopoly Regulation and Fair Trade Act, (excluding conglomerates defined under Article 38(1)1 and 2 of the Enforcement Decree of the aforesaid Act) in such cases, the calculation of such ratio shall be based on the conglomerate, but companies that engage in financial business or insurance business, from among companies that belong to the conglomerate, shall be excluded from the calculation; |
| 2. | The person shall be fully equipped with the following human resources and physical facilities with which the person can conduct the business: |
| a. | At least 5 executive officers and employees who have work experience of at least two years in operating electronic computer systems; |
| b. | Electronic computer systems and various computer programs necessary for smoothly providing telecommunications billing services; |
| c. | An information protection system under Article 57(2) of the Act; |
| 3. | The paid-in capital, total contributions, or endowment shall be at least an amount specified in paragraph (2). |
| (2) | "Amount prescribed by Presidential Decree" in Article 53(2) of the Act means 1 billion won. |
[This Article Added on Mar. 28, 2008]
| Article 66-3 (Procedures for registration) |
| (1) | A person who intends to register as a provider of telecommunications billing services pursuant to Article 53 of the Act shall submit an application for registration in the form prescribed and publicly notified by the Minister of Science and ICT to the Minister of Science and ICT. <Amended on Feb. 27, 2024> |
| (2) | An application for registration under paragraph (1) shall be accompanied by the following documents: <Amended on Feb. 27, 2024> |
| 1. | Articles of incorporation; |
| 2. | Documents proving that the applicant meets the requirements for registration under Article 66-2; |
| 3. | A business plan for three years after the commencement of business (including estimated financial statements and a statement of estimated revenues and expenditures); |
| 4. | A plan for the protection of users of telecommunications billing services (including matters under Articles 66-7 through 66-9). |
| 5. | A document proving that the applicant does not fall under any of the disqualifications under Article 54 of the Act. |
| (3) | Upon receipt of an application for registration under paragraph (1), the Minister of Science and ICT shall verify the relevant corporate registration by sharing administrative information under Article 36(1) of the Electronic Government Act. <Amended on May 4, 2010; Nov. 2, 2010; Mar. 23, 2013; Jul. 26, 2017> |
| (4) | The Minister of Science and ICT may request the applicant to supplement the documents submitted pursuant to paragraphs (1) and (2) if there is a defect in the documents submitted, and may extend the supplementation period if the applicant requests it within 10 days from the date of submission. <Amended on Mar. 23, 2013; Jul. 26, 2017; Feb. 27, 2024> |
| (5) | Upon receipt of an application for registration pursuant to paragraph (1), the Minister of Science and ICT shall register the applicant as a provider of communication billing services if the applicant meets the requirements for registration under Article 66-2 and issue a certificate of registration as a provider of communication billing services in the form prescribed and publicly notified by the Minister of Science and ICT to the applicant. <Added on Feb. 27, 2024> |
| (6) | Where the Minister of Science and ICT registers a provider of telecommunications billing services, he or she shall publish the details of the registration in the Official Gazette and shall inform the general public thereof through the Internet, etc. <Amended on Mar. 23, 2013; Jul. 26, 2017; Feb. 27, 2024> |
[This Article Added on Mar. 28, 2008]
| Article 66-4 (Grounds for disqualification from registration) |
"Investor prescribed by Presidential Decree" in subparagraph 1 of Article 54 of the Act means any of the following persons: <Amended on Jul. 29, 2008; Sep. 5, 2017>
| 1. | The principal who holds the largest number of outstanding voting stocks of, or shares in contributions to, the relevant corporation (hereafter referred to as "stocks or the like" in this Article), when the stocks held by the principal and those held by persons related to the principal, as defined under any subparagraph of Article 3(1) of the Enforcement Decree of the Act on Corporate Governance of Financial Companies, on their own accounts respectively in whosever name are aggregated; |
| 2. | A person who holds at least 10/100 of stocks or the like of the relevant corporation on his or her account in whosever name or a stockholder who exercises the de facto control over important matters relating to the management of the corporation through appointment and dismissal of executive officers or by other means, who is a related person defined under any subparagraph of Article 3(1) of the Enforcement Decree of the Act on Corporate Governance of Financial Companies. |
[This Article Added on Mar. 28, 2008]
| Article 66-5 (Administrative dispositions) |
| (1) | Deleted. <Dec. 22, 2015> |
| (2) | When the Minister of Science and ICT intends to revoke the registration of a provider of telecommunications billing services under Article 55 of the Act, he or she shall hold a hearing. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
| (3) | When the Minister of Science and ICT revokes the registration of a provider of telecommunications billing services under Article 55 of the Act, he or she shall publish the details thereof in the Official Gazette and shall notify the general public thereof through the Internet or by other means. <Amended on Mar. 23, 2013; Jul. 26, 2017> |
[This Article Added on Mar. 28, 2008]
| Article 66-6 (Measures necessary for securing stability and reliability of telecommunications billing services) |
Administrative and technical measures that a provider of telecommunications billing services shall take in accordance with Article 57(2) of the Act in order to secure the stability and reliability of transactions through telecommunications billing services are as shown in Appendix 7.
[This Article Added on Mar. 28, 2008]
| Article 66-7 (Period for retention of transaction records and methods for changing contractual terms) |
| (1) | Pursuant to Article 58(4) and (7) of the Act, a provider of telecommunications billing services shall preserve records of the following matters for 1 year from the date on which each transaction is conducted; provided, the records of a transaction, the amount of which exceeds 10,000 won, shall be preserved for 5 years: <Amended on Aug. 29, 2011; Mar. 23, 2013; Nov. 28, 2014; Jul. 26, 2017; Dec. 11, 2018> |
| 1. | The type of a transaction conducted through telecommunications billing services; |
| 2. | The amount of a transaction; |
| 3. | The other party to a transaction of purchase or use through telecommunications billing services (referring to a person who sells goods or provides services in return for a price therefor through telecommunications billing services; hereinafter referred to as the "other party to a transaction"); |
| 4. | The date and time of a transaction; |
| 5. | The subscriber number of telecommunications services for which charges are billed and collected; |
| 6. | Matters regarding access to telecommunications services in connection with the relevant transaction; |
| 7. | Matters regarding an application for a transaction and amendment to terms and conditions; |
| 8. | Matters regarding approval for a transaction; |
| 9. | Other matters determined and publicly notified by the Minister of Science and ICT. |
| (2) | Transaction records under paragraph (1) shall be preserved in paper, microfilms, discs, magnetic tapes, or other electronic information processing systems; provided, where such records are preserved in discs, magnetic tapes, or other electronic information processing systems, the requirements under Article 5(1) of the Framework Act on Electronic Documents and Transactions shall be fully met. <Amended on Aug. 31, 2012> |
| (3) | When a provider of telecommunications billing services (limited to those who provide the services described in Article (2)(1)10a) changes terms and conditions pursuant to Article 58(6) of the Act, he or she shall notify users of telecommunications billing services by any means of e-mail, writing, facsimile, telephone or other means similar thereto. <Added on Nov. 28, 2014; Jan. 5, 2021> |
| (4) | A user of telecommunications billing services may raise an objection to the changed terms and conditions from the date he or she receives notification under paragraph (3) until the business day before the effective date of the changed terms and conditions. <Added on Nov. 28, 2014> |
[This Article Added on Mar. 28, 2008]
[Title Amended on Nov. 28, 2014]
[Moved from Article 66-8 <Dec. 11, 2018>]
| Article 66-8 (Content of and procedures for requesting information on purchasers) |
| (1) | Where a user of telecommunications billing services requests the other party to a transaction pursuant to the former part of Article 58-2(1) of the Act for information about the name and date of birth of a person who purchased or used goods or service (hereinafter referred to as "purchaser information"), he or she shall submit a written request (including an electronic document) for purchaser information, stating the following information: |
| 1. | Personal data of the user of telecommunications billing services: Name, date of birth, and contact information (referring to a telephone number, electronic mail address, etc.); |
| 2. | Requested details of payment: The telephone number used for payment and the date, time, and amount of payment; |
| 3. | The statement that purchaser information needs to be written separately for each type of goods or services. |
| (2) | Where any institution or organization authorized to mediate in and resolve disputes under Article 59(2) of the Act requests for purchaser information on behalf of a user of telecommunications billing services, it shall submit a document (including an electronic document) confirming that the user of telecommunications billing services has given consent to requesting purchaser information on behalf of the user, along with the written request under paragraph (1). |
[This Article Added on Dec. 11, 2018]
[Previous Article 66-8 moved to Article 66-7 <Dec. 11, 2018>]
| Article 66-9 (Procedures for filing objections and redressing violations of rights) |
| (1) | A provider of telecommunications billing services shall designate a manager and an officer in charge of the protection of users of telecommunications billing services for filing objections and redressing violations of rights under Article 59(3) of the Act and shall notify the contact information of such manager and officer (referring to telephone numbers, facsimile numbers, e-mail addresses, etc.) to users of telecommunications billing services through the Internet and by other means. <Amended on Dec. 11, 2018; Jan. 5, 2021> |
| (2) | A user of telecommunications billing services may file an objection with regard to telecommunications billing services to the relevant provider of telecommunications billing services in writing (or by an electronic document), telephone, facsimile, or other similar means. <Amended on Jan. 5, 2021> |
| (3) | Upon receipt of an objection under paragraph (2), the provider of telecommunications billing services shall notify the user of the results of the relevant investigation or decision within 2 weeks from the date when such objection is filed. |
[This Article Added on Mar. 28, 2008]
CHAPTER VI-3 INTERNATIONAL COOPERATION
| Article 67 Deleted. <Aug. 4, 2020> |
CHAPTER VII SUPPLEMENTARY PROVISIONS
| Article 68 (Submission of data) |
"Ground prescribed by Presidential Decree to believe that it is necessary for the protection of users" in Article 64(1)3 of the Act means either of the following cases: <Amended on Mar. 28, 2008; Aug. 29, 2011>
| 1. | Where it is necessary to prepare policy measures for the protection of youths under Article 41(1) of the Act; |
| 2. | Where it is necessary to ascertain whether a person responsible for the protection of youths under Article 42-3(3) of the Act performs the duty of protecting youths; |
| 3. | Deleted. <Aug. 17, 2012> |
| Article 68-2 (Methods for publication of order of corrective measures) |
| (1) | When the Minister of Science and ICT or the Korea Media and Communications Commission orders a provider of information and communications services under Article 64 (4) of the Act to make a public publication of the fact that the service provider is ordered to take corrective measures, the Minister of Science and ICT or the Korea Media and Communications Commission shall prescribe the details, number of times, and media of publication, the size of pages, etc. in issuing such order, taking the following factors into consideration: <Amended on Sep. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Aug. 4, 2020; Oct. 1, 2025> |
| 1. | Details and severity of relevant violations; |
| 2. | The duration and number of times of relevant violations. |
| (2) | When the Minister of Science and ICT or the Korea Media and Communications Commission orders a provider of information and communications services under paragraph (1) to make a publication of the fact that the service provider is ordered to take corrective measures, the Minister of Science and ICT or the Korea Media and Communications Commission may consult on the text of the publication with the provider of information and communications services. <Amended on Sep. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Aug. 4, 2020; Oct. 1, 2025> |
[This Article Added on Jan. 28, 2009]
| Article 69 (Disclosure of order to take corrective measures) |
| (1) | In either of the following cases, the fact that a provider of information and communications services is ordered to take corrective measures under Article 64 of the Act may be disclosed. In such cases, the Minister of Science and ICT or the Korea Media and Communications Commission shall notify the relevant provider of information and communications services of the disclosure in advance: <Amended on Mar. 28, 2008; Jan. 28, 2009; Sep. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Aug. 4, 2020; Oct. 1, 2025> |
| 1. | Where a provider of information and communications services is ordered to take corrective measures for an act specified in any provision of Articles 71 through 74 of the Act; |
| 2. | Where a provider of information and communications services has been ordered to take corrective measures at least twice a year. |
| (2) | The disclosure of an order to take corrective measures under paragraph (1) shall be made by publishing it on Internet websites or general daily newspapers circulated nationwide under the Act on the Promotion of Newspapers. <Amended on Jan. 27, 2010> |
| Article 69-2 (Scope of persons required to submit transparency reports) |
"Person who meets the standards prescribed by Presidential Decree" in the provisions, with the exception of the subparagraphs, of Article 64-5(1) of the Act means a person obligated to designate a person responsible for preventing the circulation of illegally filmed materials or the like.
[This Article Added on Dec. 8, 2020]
| Article 69-3 Deleted. <Aug. 4, 2020> |
| Article 69-4 Deleted. <Aug. 4, 2020> |
| Article 70 (Delegation of authority and entrustment of affairs) |
| (1) | Pursuant to Article 65(1) of the Act, Minister of Science and ICT shall delegate the authority to impose administrative fines under Article 76 of the Act upon the following persons and to collect administrative fines from them to the Director General of the Central Radio Management Service: <Amended on Mar. 28, 2008; Jul. 3, 2008; Oct. 1, 2010; Mar. 23, 2013; Nov. 28, 2014; Jul. 26, 2017; Sep. 28, 2018; Jun. 11, 2019; Jun. 25, 2019; Dec. 7, 2021; Jul. 3, 2023> |
| 1. | A business operator not possessing line equipment under Article 22(2)2 of the Enforcement Decree of the Telecommunications Business Act; |
| 2. | A person required to designate and a chief information security officer, and report thereon pursuant to the proviso of Article 45-3(1) of the Act; |
| 2-2. | A person required to ensure that the chief information security officer may not concurrently hold another office, other than the one performing duties prescribed in Article 45-3(4) of the Act pursuant to Article 45-3(3) of the Act; |
| 2-3. | A person who fails to comply with a corrective order issued under Article 46(3) of the Act; |
| 2-4. | A person who fails to comply without good cause with a request to submit data under Article 46(4) of the Act; provided, the foregoing shall not apply to the heads of relevant central administrative agencies (including their affiliated agencies); |
| 3. | A person who has registered as a provider of telecommunications billing services pursuant to Article 53(1) of the Act. |
| (2) | The Minister of Science and ICT shall delegate the following authority to the President of the Central Radio Management Service pursuant to Article 65(1) of the Act: <Added on Aug. 4, 2020; Dec. 7, 2021; Jul. 3, 2023> |
| 1. | Reporting on the designation of a chief information security officer under Article 45-3(1) of the Act; |
| 1-2. | Conducting inspections and issuing corrective orders under Article 46(3) of the Act; |
| 1-3. | Requesting for submission of data under Article 46(4) of the Act (limited to cases where submission of data is requested for inspection under Article 46(3) of the Act); |
| 2. | Registration of providers of telecommunications billing services under Article 53(1) of the Act; |
| 3. | Reporting on the modification of registered matters of a provider of telecommunications billing services, the transfer of business or acquisition by transfer of business, or the merger or inheritance of business, the succession to business, and temporary discontinuation, permanent discontinuation, dissolution of business of a provider of telecommunications billing services under Article 53(4) of the Act; |
| 4. | Revocation of the registration of a provider of telecommunications billing services under Article 55(1) of the Act; |
| 5. | Reporting on terms and conditions (including reporting on changes in terms and conditions) on telecommunications billing services under Article 56(1) of the Act; |
| 6. | Recommending a provider of telecommunications billing services to change terms and conditions pursuant to Article 56(2) of the Act; |
| 7. | Issuing orders to refuse, suspend, or restrict the provision of telecommunications billing services under Article 61 of the Act; |
| 8. | Requesting the submission of data and conducting inspections under Article 64(1) and (3) of the Act to verify facts of violations of Articles 45-3 and 53 through 61 of the Act; |
| 9. | Issuing an order to a person who has obtained registration as a provider of telecommunications billing services pursuant to Article 53(1) of the Act to take corrective measures under Article 64(4) of the Act. |
| (3) | The Korea Media and Communications Commission shall delegate the following authority to the President of the Broadcasting and Communications Office under Article 65(1) of the Act: <Added on Aug. 4, 2020; Oct. 1, 2025> |
| 1. | Issuance of orders to take corrective measures and orders for making a public announcement under Article 64(4) of the Act for a person who has violated Articles 50, 50-3(1), 50-4, 50-5, 50-7 and 50-8 of the Act; |
| 2. | Imposition and collection of administrative fines under Article 76 of the Act on and from persons who violate Articles 50, 50-4(4), 50-5, and 50-7(1) and (2) of the Act. |
| (4) | Pursuant to Article 65(3) of the Act, the Korea Media and Communications Commission shall entrust the following affairs to the head of the Korea Internet and Security Agency: <Amended on Mar. 28, 2008; Oct. 1, 2010; Sep. 29, 2011; Nov. 28, 2014; Aug. 4, 2020; Oct. 1, 2025> |
| 1. | Affairs relating to a request for the submission of data and inspections under Article 64(1) and (3) of the Act (limited to grievances and counseling items filed with the Korea Internet and Security Agency for the protection of users) to verify whether a person violates Article 22-2, 23-2, or 23-3 of the Act or falls under any subparagraph of Article 23-4(1); |
| 2. | Duties relating to a request for the submission of data and inspections under Article 64(1) through (3) of the Act for ascertaining a violation of any provision of Articles 50, 50-3 through 50-5, 50-7, and 50-8 of the Act (limited to grievances filed with the Korea Internet and Security Agency for settlement or counseling in connection with the transmission of advertising information). |
| (5) | Deleted. <Aug. 4, 2020> |
[Title Amended on Dec. 7, 2021]
| Article 70-2 (Processing of personally identifiable information) |
The Minister of Science and ICT or the Korea Media and Communications Commission (including persons delegated with the authority or entrusted with the affairs of the Minister of Science and ICT or the Korea Media and Communications Commission under Article 70) may process data containing resident registration numbers or alien registration numbers under Article 19(1) or (4) of the Enforcement Decree of the Personal Information Protection Act if it is essential for conducting the following business affairs: <Amended on Oct. 1, 2025>
| 1. | Registration, etc. of providers of telecommunications billing services under Article 53 of the Act; |
| 2. | Requests for submission, perusal, inspection, etc. of materials, etc. under Article 64(1) through (3) of the Act. |
[This Article Wholly Amended on Feb. 27, 2024]
| Article 71 (Re-examination of regulation) |
| (1) | Deleted. <Mar. 3, 2020> |
| (2) | The Minister of Science and ICT shall examine the appropriateness of the following matters every 3 years (referring to the period ends on the day before January 1 of every third year), counting from each base date specified in the following, and take measures, such as making improvements: <Amended on Dec. 30, 2016; Jul. 26, 2017; Dec. 11, 2018; Jun. 11, 2019; Dec. 8, 2020; Dec. 7, 2021; Jul. 3, 2023; Mar. 24, 2026> |
| 1. | Qualifications of chief information security officers under Article 36-7(4) and (6) and the scope of providers of information and communications services under paragraph (5) of that Article: January 1, 2020; |
| 2. | Protective measures by integrated information and communication facility operators, etc. under Article 37: January 1, 2017; |
| 3. | Obligations to purchase an insurance policy and the minimum amount of insurance coverage under Article 38: January 1, 2017; |
| 3-2. | Inspection of implementation under Article 39: January 1, 2024; |
| 3-3. | Reports by integrated information and communication facility operators, etc. on service interruption under Article 40: January 1, 2024; |
| 3-4. | Obligations of lessees of integrated information and communications facilities to take measures under Article 41: January 1, 2024; |
| 4. | Scope of persons subject to the certification of information protection and management systems under Article 49: January 1, 2014; |
| 5. | Follow-up management and notification on the certification of information protection and management systems under Article 51: January 1, 2017; |
| 6. | Deleted; <Mar. 24, 2026> |
| 7. | Deleted; <Mar. 24, 2026> |
| 8. | Deleted; <Mar. 24, 2026> |
| 9. | Period and methods for preservation of transaction records under Article 66-7: January 1, 2014. |
| (3) | Deleted. <Dec. 30, 2016> |
| (4) | The Korea Media and Communications Commission shall examine the appropriateness of the following matters every 3 years counting from January 1, 2024 (referring to the period that ends on the day before the base date of every third year) and shall take measures, such as making improvements: <Amended on Feb. 27, 2024; May 20, 2025; Oct. 1, 2025> |
| 1. | Physical, technical, and administrative measures taken by identity service agencies and security measures taken by entities using connecting information under Article 13(1) and (2); |
| 2. | Entities subject to inspection of the current status under Article 14; |
| 3. | Scope of persons obliged to designate persons responsible for the protection of youths under Article 25; |
| 4. | Criteria for persons subject to technical and administrative measures, record retention period, and types of measures under Article 35-2. |
[This Article Added on Dec. 30, 2013]
| Article 72 Deleted. <Dec. 27, 2010> |
| Article 73 Deleted. <Aug. 18, 2009> |
| Article 74 (Criteria for imposition of administrative fines) |
Criteria for the imposition of administrative fines under the provisions of Article 76(1) through (3) of the Act are as prescribed in Appendix 9.
[This Article Wholly Amended on Oct. 1, 2010]
ADDENDA <Presidential Decree No. 20668, Feb. 29, 2008>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Article 2 (Relationship to other statutes or regulations)
A citation of the previous Enforcement Decree of the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Enforcement Rule of the Act on Promotion of Information and Communications Network Utilization and Information Protection, or a provision of either of them by any other statutes or regulations in force as at the time this Decree enters into force shall be deemed a citation of this Decree or the relevant provision of this Decree in lieu of the previous provision, if this Decree prescribes such relevant provision.
ADDENDUM <Presidential Decree No. 20756, Mar. 28, 2008>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 20896, Jul. 3, 2008>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Article 2 Omitted.
ADDENDA <Presidential Decree No. 20947, Jul. 29, 2008>
Article 1 (Enforcement date)
This Decree shall enter into force on February 4, 2009. (Proviso Omitted.)
Articles 2 through 25 Omitted.
Article 26 Omitted.
Articles 27 and 28 Omitted.
ADDENDA <Presidential Decree No. 21278, Jan. 28, 2009>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation; provided, the amended provisions of Article 15(4)2 and 4 shall enter into force 1 year after the date of their promulgation.
Article 2 (Preparation for public notice)
Notwithstanding the proviso to Article 1 of the Addenda, the public notice under the amended provisions of Article 15(6) may include the public notice of guidelines under the amended provisions of Article 15(4)2 and 4.
ADDENDA <Presidential Decree No. 21692, Aug. 18, 2009>
Article 1 (Enforcement date)
This Decree shall enter into force on August 23, 2009.
Articles 2 through 4 Omitted.
Article 5 Omitted.
Article 6 Omitted.
ADDENDA <Presidential Decree No. 21719, Sep. 9, 2009>
Article 1 (Enforcement date)
This Decree shall enter into force on September 10, 2009.
Article 2 Omitted.
Article 3 Omitted.
ADDENDA <Presidential Decree No. 22003, Jan. 27, 2010>
Article 1 (Enforcement date)
This Decree shall enter into force on February 1, 2010.
Articles 2 through 5 Omitted.
ADDENDA <Presidential Decree No. 22151, May 4, 2010>
Article 1 (Enforcement date)
This Decree shall enter into force on May 5, 2010.
Articles 2 through 4 Omitted.
ADDENDA <Presidential Decree No. 22423, Oct. 1, 2010>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Article 2 (Transitional measures concerning guidelines for administrative dispositions)
| (1) | Notwithstanding the amended provisions of Appendices 4 and 8, the previous provisions shall apply to the application of guidelines for administrative dispositions (including guidelines for the imposition of penalty surcharges) against violations committed before this Decree enters into force. |
| (2) | Administrative dispositions imposed for violations committed before this Decree enters into force shall be included in the computation of the number of violations under the amended provisions of Appendix 4. |
Article 3 (Transitional measures concerning administrative fines)
| (1) | Notwithstanding the amended provisions of Appendix 9, the previous practices shall apply to the imposition of administrative fines for violations committed before this Decree enters into force. |
| (2) | A disposition of the imposition of an administrative fine due to an offense committed before this Act enters into force shall be included in the calculation of the number of times of offenses under the amended provisions of Appendix 9. |
ADDENDA <Presidential Decree No. 22424, Oct. 1, 2010>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Articles 2 through 9 Omitted.
Article 10 Omitted.
ADDENDUM <Presidential Decree No. 22467, Nov. 2, 2010>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 22550, Dec. 27, 2010>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 5 Omitted.
Article 6 Omitted.
ADDENDUM <Presidential Decree No. 22773, Mar. 29, 2011>
This Decree shall enter into force on the date of its promulgation.
ADDENDUM <Presidential Decree No. 23104, Aug. 29, 2011>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 23169, Sep. 29, 2011>
Article 1 (Enforcement date)
This Decree shall enter into force on September 30, 2011. (Proviso Omitted.)
Articles 2 through 6 Omitted.
Article 7 Omitted.
Article 8 Omitted.
ADDENDUM <Presidential Decree No. 23876, Jun. 25, 2012>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 24047, Aug. 17, 2012>
Article 1 (Enforcement date)
This Decree shall enter into force on August 18, 2012; provided, the amended provisions of Articles 15(2), 36-2 through 36-6, 39 through 49, 51 through 53, 53-2 through 53-4, 54-2, 55-2 through 55-5, Appendix 2, Appendix 3, paragraph 2 v and w of Appendix 9, and Article 3 of Addenda shall enter into force on February 18, 2013.
Article 2 (Applicability to counting of unused period)
Counting a period under the amended provisions of Article 16(1) shall begin where information and communications services are not used on and after August 18, 2012.
Article 3 Omitted.
ADDENDA <Presidential Decree No. 24076, Aug. 31, 2012>
Article 1 (Enforcement date)
This Decree shall enter into force on September 2, 2012. (Proviso Omitted.)
Article 2 Omitted.
Article 3 Omitted.
Article 4 Omitted.
ADDENDA <Presidential Decree No. 24102, Sep. 14, 2012>
Article 1 (Enforcement date)
This Decree shall enter into force on September 16, 2012. (Proviso Omitted.)
Article 2 Omitted.
Article 3 Omitted.
Article 4 Omitted.
ADDENDA <Presidential Decree No. 24445, Mar. 23, 2013>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Articles 2 through 4 Omitted.
ADDENDUM <Presidential Decree No. 25050, Dec. 30, 2013>
This Decree shall enter into force on January 1, 2014. (Proviso Omitted.)
ADDENDUM <Presidential Decree No. 25532, Aug. 6, 2014>
This Decree shall enter into force on August 7, 2014.
ADDENDA <Presidential Decree No. 25751, Nov. 19, 2014>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 4 Omitted.
Article 5 Omitted.
ADDENDA <Presidential Decree No. 25789, Nov. 28, 2014>
Article 1 (Enforcement date)
This Decree shall enter into force on November 29, 2014; provided, the amended provision of the main sentence of Article 16(1) shall enter into force on August 18, 2015.
Article 2 (Applicability to destruction of personal information)
The amended provision of the main sentence of Article 16(1) shall also apply to personal information collected or provided before August 18, 2015.
Article 3 (Applicability to notification of results of handling of consent to receive messages)
The amended provisions of Article 62-2 shall apply, beginning with cases where an addressee expresses his/her consent to receive messages, refuse to receive messages or withdraw his/her consent to receive messages after this Decree enters into force.
Article 4 (Special cases concerning Reporting on Chief Information Security Officers)
Notwithstanding the amended provisions of Article 36-7, an information and telecommunications service provider falling under any of the subparagraphs of the amended provisions of Article 36-6 as at the time this Decree enters into force shall submit a report on the designation of a chief information security officer to the Minister of Science, ICT and Future Planning within 90 days from the date this Decree enters into force.
Article 5 (Special cases on guidelines for transmitting advertising information for purposes of generating profits)
Where the amended provision of Article 61(1) applies to cases where the sale of goods, etc. is concluded before this Decree enters into force, the enforcement date of this Decree shall be deemed the date the sale of the relevant goods, etc. is concluded.
Article 6 (Special cases concerning verification as to whether addressee has consented to receive messages)
Where the amended provisions of Article 62-3(1) applies to cases where a person has obtained consent to receive messages from an addressee before this Decree enters into force, he or she shall be deemed to have obtained the relevant consent to receive messages on the date this Decree enters into force.
Article 7 (Transitional measures concerning measures to protect personal information)
Where an information and telecommunications service provider has taken security measures under the former Article 15(4)1 and 2 before this Decree enters into force, the former provisions shall apply, notwithstanding the amended provisions of Article 15(4)1 and 2.
Article 8 (Transitional Measures concerning Guidelines for Calculating Penalty Surcharges)
When a penalty surcharge is imposed on any offense committed before this Decree enters into force, notwithstanding the amended provisions of Appendix 8, the former provisions thereof shall apply.
Article 9 (Transitional Measures concerning Administrative Fines)
| (1) | When guidelines for imposing administrative fines apply to offenses committed before this Decree enters into force, notwithstanding the amended provisions of Appendix 9, the previous provisions thereof shall apply. |
| (2) | A disposition of the imposition of an administrative fine due to an offense committed before this Act enters into force shall be included in the calculation of the number of times of offenses under the amended provisions of Appendix 9. |
ADDENDA <Presidential Decree No. 26757, Dec. 22, 2015>
Article 1 (Enforcement date)
This Decree shall enter into force on December 23, 2015.
Article 2 (Transitional measures concerning administrative fines)
Administrative fines, imposed pursuant to the previous provisions of subparagraph 2n of Appendix 9, for violations committed before this Decree enters into force, shall not be included in the count of violations under the amended provisions of subparagraph 2f of Appendix 9.
ADDENDUM <Presidential Decree No. 27188, May 31, 2016>
This Decree shall enter into force on June 2, 2016; provided, the amended provisions of Article 16 shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 27510, Sep. 22, 2016>
Article 1 (Enforcement date)
This Decree shall enter into force on September 23, 2016; provided, the amended provisions of the proviso to Article 16(2) shall enter into force 1 year after this Decree enters into force.
Article 2 (Applicability to Separate Storage and Management of Personal Information)
The amended provisions of the proviso to Article 16(2) shall also apply to the personal information collected or provided before the enforcement date referred to in the proviso to Article 1 of Addenda.
ADDENDA <Presidential Decree No. 27751, Dec. 30, 2016>
Article 1 (Enforcement date)
This Decree shall enter into force on January 1, 2017. (Proviso Omitted.)
Articles 2 through 12 Omitted.
ADDENDA <Presidential Decree No. 27951, Mar. 22, 2017>
Article 1 (Enforcement date)
This Decree shall enter into force on March 23, 2017.
Article 2 (Applicability to consent to access authority)
The amended provisions of Article 9-2(1) through (3) shall begin to apply to cases where a provider of information and communications services needs access authority to provide the relevant services through such software (including software which have been manufactured before this Decree enters into force and are provided thereafter, and software which have been provided before this Decree enters into force and are updated thereafter) of mobile devices as are supplied after this Decree enters into force.
Article 3 (Applicability to measures necessary for protecting information on users)
The amended provisions of Article 9-2(4) shall begin to apply from the first case of providing the operating system or software of mobile devices after this Decree enters into force (including a case of having manufactured the operating system or software before this Decree enters, but providing it thereafter and a case of having provided the operating system or software before this Decree enters into force, but upgrading either thereafter) and the first case of manufacturing mobile devices after this Decree enters into force (excluding a case where mobile devices are being manufactured as at the time this Decree enters into force, but the operating system has been installed in them therebefore).
ADDENDA <Presidential Decree No. 28210, Jul. 26, 2017>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Articles 2 through 5 Omitted.
Article 6 Omitted.
ADDENDA <Presidential Decree No. 28283, Sep. 5, 2017>
Article 1 (Enforcement date)
This Decree shall enter into force three months after the date of its promulgation; provided, ... <omitted> ... Article 6 of the Addenda shall enter into force on the date of its promulgation.
Articles 2 through 5 Omitted.
Article 6 Omitted.
ADDENDUM <Presidential Decree No. 28919, May 28, 2018>
This Decree shall enter into force on the date of its promulgation. (Proviso Omitted.)
ADDENDUM <Presidential Decree No. 29053, Jul. 17, 2018>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 29192, Sep. 28, 2018>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Article 2 Omitted.
Article 3 Omitted.
ADDENDUM <Presidential Decree No. 29339, Dec. 11, 2018>
This Decree shall enter into force on December 13, 2018.
ADDENDUM <Presidential Decree No. 29633, Mar. 19, 2019>
This Decree shall enter into force on March 19, 2019.
ADDENDA <Presidential Decree No. 29852, Jun. 11, 2019>
Article 1 (Enforcement date)
This Act shall enter into force on June 13, 2019; provided, the amended provisions of Articles 34(1) shall enter into force on the date of its promulgation, and the amended provisions of Articles 16-2 and 17-2 shall enter into force on June 25, 2019.
Article 2 (Applicability to qualifications of chief information security officers)
The amended provisions of Article 36-6(2) and (4) shall begin to apply to chief information security officers designated and reported after this Act enters into force.
Article 3 (Special cases concerning methods and procedures for reporting on chief information security officers)
Where a provider of information and communications services becomes obligated to report his or her chief information security officer pursuant to Article 45-3(1) of the Act as at the time this Decree enters into force, the deadline for reporting on the chief information security officer under the amended provisions of Article 36-7 shall be counted from the date this Decree enters into force.
ADDENDA <Presidential Decree No. 29886, Jun. 25, 2019>
Article 1 (Enforcement date)
This Decree shall enter into force on June 25, 2019.
Article 2 Omitted.
ADDENDUM <Presidential Decree No. 30509, Mar. 3, 2020>
This Decree shall enter into force on the date of its promulgation.
ADDENDUM <Presidential Decree No. 30691, May 19, 2020>
This Decree shall enter into force on June 11, 2020.
ADDENDUM <Presidential Decree No. 30894, Aug. 4, 2020>
This Decree shall enter into force on August 5, 2020.
ADDENDA <Presidential Decree No. 31221, Dec. 8, 2020>
Article 1 (Enforcement date)
This Decree shall enter into force on December 10, 2020.
Articles 2 through 7 Omitted.
Article 8 Omitted.
Article 9 Omitted.
ADDENDUM <Presidential Decree No. 31247, Dec. 8, 2020>
This Decree shall enter into force on December 10, 2020; provided, the amended provisions of Article 35-2(4) shall enter into force on January 1, 2021.
ADDENDUM <Presidential Decree No. 31380, Jan. 5, 2021>
This Decree shall enter into force on the date of its promulgation. (Proviso Omitted.)
ADDENDA <Presidential Decree No. 31429, Feb. 2, 2021>
Article 1 (Enforcement date)
This Decree shall enter into force on February 5, 2021.
Article 2 Omitted.
Article 3 Omitted.
ADDENDUM <Presidential Decree No. 32179, Dec. 7, 2021>
This Decree shall enter into force on December 9, 2021.
ADDENDA <Presidential Decree No. 32274, Dec. 28, 2021>
Article 1 (Enforcement date)
This Decree shall enter into force on December 30, 2021.
Articles 2 through 12 Omitted.
Article 13 Omitted.
Article 14 Omitted.
ADDENDUM <Presidential Decree No. 32868, Aug. 9, 2022>
This Decree shall enter into force on the date of its promulgation.
ADDENDUM <Presidential Decree No. 33039, Dec. 9, 2022>
This Decree shall enter into force on December 11, 2022.
ADDENDUM <Presidential Decree No. 33612, Jul. 3, 2023>
This Decree shall enter into force on July 4, 2023.
ADDENDUM <Presidential Decree No. 34024, Dec. 26, 2023>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 34234, Feb. 27, 2024>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Article 2 (Applicability to documents attached to application for registration as provider of telecommunication billing services)
The amended provisions of Article 66-3(2)5 shall begin to apply where an application for registration as a provider of telecommunications billing services is submitted after this Decree enters into force.
ADDENDUM <Presidential Decree No. 34258, Feb. 27, 2024>
This Decree shall enter into force on the date of its promulgation.
ADDENDUM <Presidential Decree No. 34723, Jul. 23, 2024>
This Act shall enter into force on July 24, 2014.
ADDENDUM <Presidential Decree No. 34821, Aug. 13, 2024>
This Decree shall enter into force on August 14, 2024.
ADDENDUM <Presidential Decree No. 35172, Dec. 31, 2024>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 35533, May 20, 2025>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Article 2 (Transitional measures concerning administrative fines)
Administrative fines imposed under the previous provisions of subparagraph 2n of Appendix 9 for violations committed before this Decree enters into force shall not be included in the calculation of the number of violations under the amended provisions of subparagraph 2n of Appendix 9.
ADDENDA <Presidential Decree No. 35810, Oct. 1, 2025>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Articles 2 through 4 Omitted.
Article 5 Omitted.
ADDENDA <Presidential Decree No. 35837, Nov. 4, 2025>
Article 1 (Enforcement date)
This Decree shall enter into force on the date of its promulgation.
Article 2 (Applicability to persons subject to information security management system certification)
The amended provisions of Article 49(1)2 shall also apply to telecommunications business operators that resell mobile telecommunications services received from facilities-based telecommunications business operators under Article 38(1) of the Telecommunications Business Act at the time this Decree enters into force.
ADDENDUM <Presidential Decree No. 36220, Mar. 24, 2026>
This Decree shall enter into force on the date of its promulgation.