영문/국문 이단 법령보기
PERSONAL INFORMATION PROTECTION ACT 개인정보 보호법
 Act No. 10465, Mar. 29, 2011
Amended by Act No. 11690, Mar. 23, 2013
Act No. 11990, Aug. 6, 2013
Act No. 12504, Mar. 24, 2014
Act No. 12844, Nov. 19, 2014
Act No. 13423, Jul. 24, 2015
Act No. 14107, Mar. 29, 2016
Act No. 14765, Apr. 18, 2017
Act No. 14839, Jul. 26, 2017
Act No. 16930, Feb. 4, 2020
Act No. 19234, Mar. 14, 2023
  신규제정 2011. 3. 29 법률 제 10465 호
개정 2013. 3. 23 법률 제 11690 호
2013. 8. 6 법률 제 11990 호
2014. 3. 24 법률 제 12504 호
2014. 11. 19 법률 제 12844 호
2015. 7. 24 법률 제 13423 호
2016. 3. 29 법률 제 14107 호
2017. 4. 18 법률 제 14765 호
2017. 7. 26 법률 제 14839 호
2020. 2. 4 법률 제 16930 호
2023. 3. 14 법률 제 19234 호
CHAPTER I GENERAL PROVISIONS
제1장 총칙
CHAPTER I GENERAL PROVISIONS
Article 1 (Purpose)
The purpose of this Act is to protect the freedom and rights of individuals, and further, to realize the dignity and value of the individuals, by prescribing the processing and protection of personal information. <Amended on Mar. 24, 2014>
제1조(목적)
이 법은 개인정보의 처리 및 보호에 관한 사항을 정함으로써 개인의 자유와 권리를 보호하고, 나아가 개인의 존엄과 가치를 구현함을 목적으로 한다. <개정 2014. 3. 24.>
Article 1 (Purpose)
The purpose of this Act is to protect the freedom and rights of individuals, and further, to realize the dignity and value of the individuals, by prescribing the processing and protection of personal information. <Amended on Mar. 24, 2014>
Article 2 (Definitions)
The terms used in this Act are defined as follows: <Amended on Mar. 24, 2014; Feb. 4, 2020; Mar. 14, 2023>
1. The term "personal information" means any of the following information relating to a living individual:
(a) Information that identifies a particular individual by his or her full name, resident registration number, pictures, etc.;
(b) Information which, even if it by itself does not uniquely identify an individual, may be easily combined with other information to uniquely identify an individual. In such cases, whether or not there is ease of combination shall be determined by reasonably considering the time, cost, technology, etc. used to identify the individual such as likelihood that the other information can be procured;
(c) Information under items (a) or (b) above that is pseudonymized in accordance with subparagraph 1-2 below and thereby becomes incapable of uniquely identifying an individual without the use or combination of information for restoration to the original state (hereinafter referred to as “pseudonymized information”);
1-2. The term “pseudonymization” means a procedure to process personal information so that the information cannot uniquely identify an individual without additional information, by erasing in part, or replacing in whole or in part, such information;
2. The term “processing” means the collection, generation, connecting, interlocking, recording, storage, retention, value-added processing, editing, searching, output, correction, recovery, use, provision, disclosure, and destruction of personal information and other similar activities;
3. The term “data subject” means an individual who is identifiable through the information processed and is the subject of that information;
4. The term “personal information file” means a set or sets of personal information arranged or organized in a systematic manner based on a certain rule for easy search of the personal information;
5. The term “personal information controller” means a public institution, legal person, organization, individual, etc. that processes personal information directly or indirectly to operate the personal information files as part of its work;
6. The term "public institution" means any of the following institutions:
(a) The administrative bodies of the National Assembly, the Courts, the Constitutional Court, and the National Election Commission; the central administrative agencies (including agencies under the Presidential Office and the Prime Minister’s Office) and their affiliated entities; and local governments;
(b) Other national agencies and public entities prescribed by Presidential Decree;
7. The term "fixed visual data processing device" means a device prescribed by Presidential Decree, which is installed at a certain place to continuously or regularly take pictures of persons, things, etc. or transmit such pictures via a wired or wireless network;
7-2. The term "mobile visual data processing device" means a device prescribed by Presidential Decree, which a person can wear or carry or which can be attached to or mounted on a movable object to take pictures of persons or things, etc. or to transmit such pictures through a wired or wireless network;
8. The term “scientific research” means research that applies scientific methods, such as technological development and demonstration, fundamental research, applied research and privately funded research.
제2조(정의)
이 법에서 사용하는 용어의 뜻은 다음과 같다. <개정 2014. 3. 24., 2020. 2. 4., 2023. 3. 14.>
1. “개인정보”란 살아 있는 개인에 관한 정보로서 다음 각 목의 어느 하나에 해당하는 정보를 말한다.
가. 성명, 주민등록번호 및 영상 등을 통하여 개인을 알아볼 수 있는 정보
나. 해당 정보만으로는 특정 개인을 알아볼 수 없더라도 다른 정보와 쉽게 결합하여 알아볼 수 있는 정보. 이 경우 쉽게 결합할 수 있는지 여부는 다른 정보의 입수 가능성 등 개인을 알아보는 데 소요되는 시간, 비용, 기술 등을 합리적으로 고려하여야 한다.
다. 가목 또는 나목을 제1호의2에 따라 가명처리함으로써 원래의 상태로 복원하기 위한 추가 정보의 사용ㆍ결합 없이는 특정 개인을 알아볼 수 없는 정보(이하 “가명정보”라 한다)
1의2. “가명처리”란 개인정보의 일부를 삭제하거나 일부 또는 전부를 대체하는 등의 방법으로 추가 정보가 없이는 특정 개인을 알아볼 수 없도록 처리하는 것을 말한다.
2. “처리”란 개인정보의 수집, 생성, 연계, 연동, 기록, 저장, 보유, 가공, 편집, 검색, 출력, 정정(訂正), 복구, 이용, 제공, 공개, 파기(破棄), 그 밖에 이와 유사한 행위를 말한다.
3. “정보주체”란 처리되는 정보에 의하여 알아볼 수 있는 사람으로서 그 정보의 주체가 되는 사람을 말한다.
4. “개인정보파일”이란 개인정보를 쉽게 검색할 수 있도록 일정한 규칙에 따라 체계적으로 배열하거나 구성한 개인정보의 집합물(集合物)을 말한다.
5. “개인정보처리자”란 업무를 목적으로 개인정보파일을 운용하기 위하여 스스로 또는 다른 사람을 통하여 개인정보를 처리하는 공공기관, 법인, 단체 및 개인 등을 말한다.
6. “공공기관”이란 다음 각 목의 기관을 말한다.
가. 국회, 법원, 헌법재판소, 중앙선거관리위원회의 행정사무를 처리하는 기관, 중앙행정기관(대통령 소속 기관과 국무총리 소속 기관을 포함한다) 및 그 소속 기관, 지방자치단체
나. 그 밖의 국가기관 및 공공단체 중 대통령령으로 정하는 기관
7. “고정형 영상정보처리기기”란 일정한 공간에 설치되어 지속적 또는 주기적으로 사람 또는 사물의 영상 등을 촬영하거나 이를 유ㆍ무선망을 통하여 전송하는 장치로서 대통령령으로 정하는 장치를 말한다.
7의2. “이동형 영상정보처리기기”란 사람이 신체에 착용 또는 휴대하거나 이동 가능한 물체에 부착 또는 거치(据置)하여 사람 또는 사물의 영상 등을 촬영하거나 이를 유ㆍ무선망을 통하여 전송하는 장치로서 대통령령으로 정하는 장치를 말한다.
8. “과학적 연구”란 기술의 개발과 실증, 기초연구, 응용연구 및 민간 투자 연구 등 과학적 방법을 적용하는 연구를 말한다.
Article 2 (Definitions)
The terms used in this Act are defined as follows: <Amended on Mar. 24, 2014; Feb. 4, 2020; Mar. 14, 2023>
1. The term "personal information" means any of the following information relating to a living individual:
(a) Information that identifies a particular individual by his or her full name, resident registration number, pictures, etc.;
(b) Information which, even if it by itself does not uniquely identify an individual, may be easily combined with other information to uniquely identify an individual. In such cases, whether or not there is ease of combination shall be determined by reasonably considering the time, cost, technology, etc. used to identify the individual such as likelihood that the other information can be procured;
(c) Information under items (a) or (b) above that is pseudonymized in accordance with subparagraph 1-2 below and thereby becomes incapable of uniquely identifying an individual without the use or combination of information for restoration to the original state (hereinafter referred to as “pseudonymized information”);
1-2. The term “pseudonymization” means a procedure to process personal information so that the information cannot uniquely identify an individual without additional information, by erasing in part, or replacing in whole or in part, such information;
2. The term “processing” means the collection, generation, connecting, interlocking, recording, storage, retention, value-added processing, editing, searching, output, correction, recovery, use, provision, disclosure, and destruction of personal information and other similar activities;
3. The term “data subject” means an individual who is identifiable through the information processed and is the subject of that information;
4. The term “personal information file” means a set or sets of personal information arranged or organized in a systematic manner based on a certain rule for easy search of the personal information;
5. The term “personal information controller” means a public institution, legal person, organization, individual, etc. that processes personal information directly or indirectly to operate the personal information files as part of its work;
6. The term "public institution" means any of the following institutions:
(a) The administrative bodies of the National Assembly, the Courts, the Constitutional Court, and the National Election Commission; the central administrative agencies (including agencies under the Presidential Office and the Prime Minister’s Office) and their affiliated entities; and local governments;
(b) Other national agencies and public entities prescribed by Presidential Decree;
7. The term "fixed visual data processing device" means a device prescribed by Presidential Decree, which is installed at a certain place to continuously or regularly take pictures of persons, things, etc. or transmit such pictures via a wired or wireless network;
7-2. The term "mobile visual data processing device" means a device prescribed by Presidential Decree, which a person can wear or carry or which can be attached to or mounted on a movable object to take pictures of persons or things, etc. or to transmit such pictures through a wired or wireless network;
8. The term “scientific research” means research that applies scientific methods, such as technological development and demonstration, fundamental research, applied research and privately funded research.
Article 3 (Principles of Information Protection)
(1) The personal information controller shall specify explicitly the purposes for which personal information is processed; and shall collect personal information lawfully and fairly to the minimum extent necessary for such purposes.
(2) The personal information controller shall process personal information in an appropriate manner necessary for the purposes for which the personal information is processed, and shall not use it beyond such purposes.
(3) The personal information controller shall ensure personal information is accurate, complete, and up to date to the extent necessary in relation to the purposes for which the personal information is processed.
(4) The personal information controller shall manage personal information safely according to the processing methods, types, etc. of personal information, taking into account the possibility of infringement on the data subject’s rights and the severity of the relevant risks.
(5) The personal information controller shall make public its Privacy Policy under Article 30 and other matters related to personal information processing, and shall guarantee the data subject’s rights, such as the right to request access to his or her personal information. <Amended on Mar. 14, 2023>
(6) The personal information controller shall process personal information in a manner to minimize the possibility of infringing the privacy of a data subject.
(7) If it is still possible to fulfill the purposes of collecting personal information by processing anonymized or pseudonymized personal information, the personal information controller shall endeavor to process personal information through anonymization, where anonymization is possible, or through pseudonymization, if it is impossible to fulfill the purposes of collecting personal information through anonymization. <Amended on Feb. 4, 2020>
(8) The personal information controller shall endeavor to obtain trust of data subjects by observing and performing such duties and responsibilities as provided for in this Act and other related statutes or regulations.
제3조(개인정보 보호 원칙)
① 개인정보처리자는 개인정보의 처리 목적을 명확하게 하여야 하고 그 목적에 필요한 범위에서 최소한의 개인정보만을 적법하고 정당하게 수집하여야 한다.
② 개인정보처리자는 개인정보의 처리 목적에 필요한 범위에서 적합하게 개인정보를 처리하여야 하며, 그 목적 외의 용도로 활용하여서는 아니 된다.
③ 개인정보처리자는 개인정보의 처리 목적에 필요한 범위에서 개인정보의 정확성, 완전성 및 최신성이 보장되도록 하여야 한다.
④ 개인정보처리자는 개인정보의 처리 방법 및 종류 등에 따라 정보주체의 권리가 침해받을 가능성과 그 위험 정도를 고려하여 개인정보를 안전하게 관리하여야 한다.
⑤ 개인정보처리자는 제30조에 따른 개인정보 처리방침 등 개인정보의 처리에 관한 사항을 공개하여야 하며, 열람청구권 등 정보주체의 권리를 보장하여야 한다. <개정 2023. 3. 14.>
⑥ 개인정보처리자는 정보주체의 사생활 침해를 최소화하는 방법으로 개인정보를 처리하여야 한다.
⑦ 개인정보처리자는 개인정보를 익명 또는 가명으로 처리하여도 개인정보 수집목적을 달성할 수 있는 경우 익명처리가 가능한 경우에는 익명에 의하여, 익명처리로 목적을 달성할 수 없는 경우에는 가명에 의하여 처리될 수 있도록 하여야 한다. <개정 2020. 2. 4.>
⑧ 개인정보처리자는 이 법 및 관계 법령에서 규정하고 있는 책임과 의무를 준수하고 실천함으로써 정보주체의 신뢰를 얻기 위하여 노력하여야 한다.
Article 3 (Principles of Information Protection)
(1) The personal information controller shall specify explicitly the purposes for which personal information is processed; and shall collect personal information lawfully and fairly to the minimum extent necessary for such purposes.
(2) The personal information controller shall process personal information in an appropriate manner necessary for the purposes for which the personal information is processed, and shall not use it beyond such purposes.
(3) The personal information controller shall ensure personal information is accurate, complete, and up to date to the extent necessary in relation to the purposes for which the personal information is processed.
(4) The personal information controller shall manage personal information safely according to the processing methods, types, etc. of personal information, taking into account the possibility of infringement on the data subject’s rights and the severity of the relevant risks.
(5) The personal information controller shall make public its Privacy Policy under Article 30 and other matters related to personal information processing, and shall guarantee the data subject’s rights, such as the right to request access to his or her personal information. <Amended on Mar. 14, 2023>
(6) The personal information controller shall process personal information in a manner to minimize the possibility of infringing the privacy of a data subject.
(7) If it is still possible to fulfill the purposes of collecting personal information by processing anonymized or pseudonymized personal information, the personal information controller shall endeavor to process personal information through anonymization, where anonymization is possible, or through pseudonymization, if it is impossible to fulfill the purposes of collecting personal information through anonymization. <Amended on Feb. 4, 2020>
(8) The personal information controller shall endeavor to obtain trust of data subjects by observing and performing such duties and responsibilities as provided for in this Act and other related statutes or regulations.
Article 4 (Rights of Data Subjects)
A data subject has the following rights in relation to the processing of his or her own personal information: <Amended on Mar. 14, 2023>
1. The right to be informed of the processing of such personal information;
2. The right to determine whether or not to consent and the scope of consent regarding the processing of such personal information;
3. The right to confirm whether personal information is being processed and to request access (including the provision of copies; hereinafter the same applies) to and transmission of such personal information;
4. The right to suspend the processing of, and to request correction, erasure, and destruction of such personal information;
5. The right to appropriate redress for any damage arising out of the processing of such personal information through a prompt and fair procedure;
6. The right to refuse to accept a decision made through a fully automated processing of personal information or to request an explanation thereof.
제4조(정보주체의 권리)
정보주체는 자신의 개인정보 처리와 관련하여 다음 각 호의 권리를 가진다. <개정 2023. 3. 14.>
1. 개인정보의 처리에 관한 정보를 제공받을 권리
2. 개인정보의 처리에 관한 동의 여부, 동의 범위 등을 선택하고 결정할 권리
3. 개인정보의 처리 여부를 확인하고 개인정보에 대한 열람(사본의 발급을 포함한다. 이하 같다) 및 전송을 요구할 권리
4. 개인정보의 처리 정지, 정정ㆍ삭제 및 파기를 요구할 권리
5. 개인정보의 처리로 인하여 발생한 피해를 신속하고 공정한 절차에 따라 구제받을 권리
6. 완전히 자동화된 개인정보 처리에 따른 결정을 거부하거나 그에 대한 설명 등을 요구할 권리
Article 4 (Rights of Data Subjects)
A data subject has the following rights in relation to the processing of his or her own personal information: <Amended on Mar. 14, 2023>
1. The right to be informed of the processing of such personal information;
2. The right to determine whether or not to consent and the scope of consent regarding the processing of such personal information;
3. The right to confirm whether personal information is being processed and to request access (including the provision of copies; hereinafter the same applies) to and transmission of such personal information;
4. The right to suspend the processing of, and to request correction, erasure, and destruction of such personal information;
5. The right to appropriate redress for any damage arising out of the processing of such personal information through a prompt and fair procedure;
6. The right to refuse to accept a decision made through a fully automated processing of personal information or to request an explanation thereof.
Article 5 (Responsibilities of the State)
(1) The State and local governments shall formulate policies to prevent harmful consequences of beyond-purpose collection, abuse and misuse of personal information, indiscrete surveillance and tracking, etc. and to enhance the dignity of human beings and to ensure the protection of individual privacy.
(2) The State and local governments shall establish policy measures, such as improving statutes or regulations, necessary to protect the data subject's rights as provided in Article 4.
(3) The State and local governments shall formulate policies necessary for protecting the personal information of children under 14 years of age so that such children can clearly understand the effects of the processing of personal information and the rights of data subjects, etc. <Newly Inserted on Mar. 14, 2023>
(4) The State and local governments shall respect, promote, and support self-regulating data protection activities of personal information controllers to improve unreasonable social practices relating to the processing of personal information. <Amended on Mar. 14, 2023>
(5) When applying statutes or regulations or municipal ordinances regarding the processing of personal information, the State and local governments shall be in conformity with the principles of information protection to guarantee the rights of data subjects. <Amended on Mar. 14, 2023>
제5조(국가 등의 책무)
① 국가와 지방자치단체는 개인정보의 목적 외 수집, 오용ㆍ남용 및 무분별한 감시ㆍ추적 등에 따른 폐해를 방지하여 인간의 존엄과 개인의 사생활 보호를 도모하기 위한 시책을 강구하여야 한다.
② 국가와 지방자치단체는 제4조에 따른 정보주체의 권리를 보호하기 위하여 법령의 개선 등 필요한 시책을 마련하여야 한다.
③ 국가와 지방자치단체는 만 14세 미만 아동이 개인정보 처리가 미치는 영향과 정보주체의 권리 등을 명확하게 알 수 있도록 만 14세 미만 아동의 개인정보 보호에 필요한 시책을 마련하여야 한다. <신설 2023. 3. 14.>
④ 국가와 지방자치단체는 개인정보의 처리에 관한 불합리한 사회적 관행을 개선하기 위하여 개인정보처리자의 자율적인 개인정보 보호활동을 존중하고 촉진ㆍ지원하여야 한다. <개정 2023. 3. 14.>
⑤ 국가와 지방자치단체는 개인정보의 처리에 관한 법령 또는 조례를 적용할 때에는 정보주체의 권리가 보장될 수 있도록 개인정보 보호 원칙에 맞게 적용하여야 한다. <개정 2023. 3. 14.>
Article 5 (Responsibilities of the State)
(1) The State and local governments shall formulate policies to prevent harmful consequences of beyond-purpose collection, abuse and misuse of personal information, indiscrete surveillance and tracking, etc. and to enhance the dignity of human beings and to ensure the protection of individual privacy.
(2) The State and local governments shall establish policy measures, such as improving statutes or regulations, necessary to protect the data subject's rights as provided in Article 4.
(3) The State and local governments shall formulate policies necessary for protecting the personal information of children under 14 years of age so that such children can clearly understand the effects of the processing of personal information and the rights of data subjects, etc. <Newly Inserted on Mar. 14, 2023>
(4) The State and local governments shall respect, promote, and support self-regulating data protection activities of personal information controllers to improve unreasonable social practices relating to the processing of personal information. <Amended on Mar. 14, 2023>
(5) When applying statutes or regulations or municipal ordinances regarding the processing of personal information, the State and local governments shall be in conformity with the principles of information protection to guarantee the rights of data subjects. <Amended on Mar. 14, 2023>
Article 6 (Relationship to Other Statutes)
(1) Except as otherwise provided in other statutes, the processing and protection of personal information shall be governed by this Act. <Amended on Mar. 24, 2014; Mar. 14, 2023>
(2) An enactment of other statutes or amendment to existing statutes regarding the processing and protection of personal information shall be made fit for the purpose and principles of this Act. <Newly Inserted on Mar. 14, 2023>
제6조(다른 법률과의 관계)
① 개인정보의 처리 및 보호에 관하여 다른 법률에 특별한 규정이 있는 경우를 제외하고는 이 법에서 정하는 바에 따른다. <개정 2014. 3. 24., 2023. 3. 14.>
② 개인정보의 처리 및 보호에 관한 다른 법률을 제정하거나 개정하는 경우에는 이 법의 목적과 원칙에 맞도록 하여야 한다. <신설 2023. 3. 14.>
Article 6 (Relationship to Other Statutes)
(1) Except as otherwise provided in other statutes, the processing and protection of personal information shall be governed by this Act. <Amended on Mar. 24, 2014; Mar. 14, 2023>
(2) An enactment of other statutes or amendment to existing statutes regarding the processing and protection of personal information shall be made fit for the purpose and principles of this Act. <Newly Inserted on Mar. 14, 2023>
CHAPTER II ESTABLISHMENT OF PERSONAL INFORMATION PROTECTION POLICIES
제2장 개인정보 보호정책의 수립 등
CHAPTER II ESTABLISHMENT OF PERSONAL INFORMATION PROTECTION POLICIES
Article 7 (Personal Information Protection Commission)
(1) The Personal Information Protection Commission (hereinafter referred to as the “Protection Commission”) shall be established under the Prime Minister to independently perform business affairs relating to the protection of personal information. <Amended on Feb. 4, 2020>
(2) The Protection Commission shall be deemed a central administrative agency under Article 2 of the Government Organization Act: Provided, That Article 18 of the Government Organization Act shall not apply to any of the following matters: <Amended on Feb. 4, 2020>
1. Business affairs specified in subparagraphs 3 and 4 of Article 7-8;
2. Matters falling under subparagraph 1 among those to be deliberated and resolved on under Article 7-9 (1).
(3) Deleted. <Feb. 4, 2020>
(4) Deleted. <Feb. 4, 2020>
(5) Deleted. <Feb. 4, 2020>
(6) Deleted. <Feb. 4, 2020>
(7) Deleted. <Feb. 4, 2020>
(8) Deleted. <Feb. 4, 2020>
(9) Deleted. <Feb. 4, 2020>
제7조(개인정보 보호위원회)
① 개인정보 보호에 관한 사무를 독립적으로 수행하기 위하여 국무총리 소속으로 개인정보 보호위원회(이하 “보호위원회”라 한다)를 둔다. <개정 2020. 2. 4.>
② 보호위원회는 「정부조직법」 제2조에 따른 중앙행정기관으로 본다. 다만, 다음 각 호의 사항에 대하여는 「정부조직법」 제18조를 적용하지 아니한다. <개정 2020. 2. 4.>
1. 제7조의8제3호 및 제4호의 사무
2. 제7조의9제1항의 심의ㆍ의결 사항 중 제1호에 해당하는 사항
③ 삭제 <2020. 2. 4.>
④ 삭제 <2020. 2. 4.>
⑤ 삭제 <2020. 2. 4.>
⑥ 삭제 <2020. 2. 4.>
⑦ 삭제 <2020. 2. 4.>
⑧ 삭제 <2020. 2. 4.>
⑨ 삭제 <2020. 2. 4.>
Article 7 (Personal Information Protection Commission)
(1) The Personal Information Protection Commission (hereinafter referred to as the “Protection Commission”) shall be established under the Prime Minister to independently perform business affairs relating to the protection of personal information. <Amended on Feb. 4, 2020>
(2) The Protection Commission shall be deemed a central administrative agency under Article 2 of the Government Organization Act: Provided, That Article 18 of the Government Organization Act shall not apply to any of the following matters: <Amended on Feb. 4, 2020>
1. Business affairs specified in subparagraphs 3 and 4 of Article 7-8;
2. Matters falling under subparagraph 1 among those to be deliberated and resolved on under Article 7-9 (1).
(3) Deleted. <Feb. 4, 2020>
(4) Deleted. <Feb. 4, 2020>
(5) Deleted. <Feb. 4, 2020>
(6) Deleted. <Feb. 4, 2020>
(7) Deleted. <Feb. 4, 2020>
(8) Deleted. <Feb. 4, 2020>
(9) Deleted. <Feb. 4, 2020>
Article 7-2 (Composition of the Protection Commission)
(1) The Protection Commission shall be comprised of nine Commissioners including two Standing Commissioners (one Chairperson and one Vice Chairperson).
(2) Commissioners of the Protection Commission shall be selected from among any of the following persons with sufficient experience and expertise in the protection of personal information, with the Chairperson and Vice Chairperson being proposed by the Prime Minister, two other Commissioners being proposed by Chairperson, two other Commissioners being recommended by the negotiation body of the political party to which the President belongs or belonged, and three other persons being recommended by another negotiation body and named or appointed by the President:
1. A person who serves, or served, as a public official of Grade III or higher (including public officials belonging to the Senior Executive Service) who is responsible for personal information protection;
2. A person who has been serving, or served, as a judge, prosecutor or lawyer for 10 years or longer;
3. A person who served as an officer at a public institution or group (including groups comprised of personal information controllers) for three years or longer or a person recommended by the above public institution or group who was in charge of personal information protection for three years or longer;
4. A person who has expertise in a field relating to personal information and has been serving, or served, as an associate professor or higher at a school set forth in subparagraph 1 of Article 2 of the Higher Education Act for five years or longer.
(3) The Chairperson and the Vice Chairperson shall be appointed from among public officials in political service.
(4) The Chairperson, Vice Chairperson and the head of the secretariat under Article 7-13 shall become cabinet member, notwithstanding Article 10 of the Government Organization Act.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의2(보호위원회의 구성 등)
① 보호위원회는 상임위원 2명(위원장 1명, 부위원장 1명)을 포함한 9명의 위원으로 구성한다.
② 보호위원회의 위원은 개인정보 보호에 관한 경력과 전문지식이 풍부한 다음 각 호의 사람 중에서 위원장과 부위원장은 국무총리의 제청으로, 그 외 위원 중 2명은 위원장의 제청으로, 2명은 대통령이 소속되거나 소속되었던 정당의 교섭단체 추천으로, 3명은 그 외의 교섭단체 추천으로 대통령이 임명 또는 위촉한다.
1. 개인정보 보호 업무를 담당하는 3급 이상 공무원(고위공무원단에 속하는 공무원을 포함한다)의 직에 있거나 있었던 사람
2. 판사ㆍ검사ㆍ변호사의 직에 10년 이상 있거나 있었던 사람
3. 공공기관 또는 단체(개인정보처리자로 구성된 단체를 포함한다)에 3년 이상 임원으로 재직하였거나 이들 기관 또는 단체로부터 추천받은 사람으로서 개인정보 보호 업무를 3년 이상 담당하였던 사람
4. 개인정보 관련 분야에 전문지식이 있고 「고등교육법」 제2조제1호에 따른 학교에서 부교수 이상으로 5년 이상 재직하고 있거나 재직하였던 사람
③ 위원장과 부위원장은 정무직 공무원으로 임명한다.
④ 위원장, 부위원장, 제7조의13에 따른 사무처의 장은 「정부조직법」 제10조에도 불구하고 정부위원이 된다.
[본조신설 2020. 2. 4.]
Article 7-2 (Composition of the Protection Commission)
(1) The Protection Commission shall be comprised of nine Commissioners including two Standing Commissioners (one Chairperson and one Vice Chairperson).
(2) Commissioners of the Protection Commission shall be selected from among any of the following persons with sufficient experience and expertise in the protection of personal information, with the Chairperson and Vice Chairperson being proposed by the Prime Minister, two other Commissioners being proposed by Chairperson, two other Commissioners being recommended by the negotiation body of the political party to which the President belongs or belonged, and three other persons being recommended by another negotiation body and named or appointed by the President:
1. A person who serves, or served, as a public official of Grade III or higher (including public officials belonging to the Senior Executive Service) who is responsible for personal information protection;
2. A person who has been serving, or served, as a judge, prosecutor or lawyer for 10 years or longer;
3. A person who served as an officer at a public institution or group (including groups comprised of personal information controllers) for three years or longer or a person recommended by the above public institution or group who was in charge of personal information protection for three years or longer;
4. A person who has expertise in a field relating to personal information and has been serving, or served, as an associate professor or higher at a school set forth in subparagraph 1 of Article 2 of the Higher Education Act for five years or longer.
(3) The Chairperson and the Vice Chairperson shall be appointed from among public officials in political service.
(4) The Chairperson, Vice Chairperson and the head of the secretariat under Article 7-13 shall become cabinet member, notwithstanding Article 10 of the Government Organization Act.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-3 (Chairperson)
(1) The Chairperson shall represent the Protection Commission, preside over meetings of the Protection Commission, and oversee the related business affairs.
(2) If the Chairperson cannot perform his or her duties for inevitable reasons, the Vice Chairperson shall act on his or her behalf, and if both the Chairperson and Vice Chairperson cannot perform his or her duties for inevitable reasons, another Commissioner, determined by the Protection Commission in advance, shall act on behalf of Chairperson.
(3) The Chairperson may attend the National Assembly and make statements in relation to the business affairs of the Protection Commission, and if required by the National Assembly, he or she shall attend the National Assembly to make a report or respond to questions.
(4) The Chairperson may attend a meeting of the State Council and recommend the Prime Minister to submit a bill concerning the business affairs under his or her jurisdiction.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의3(위원장)
① 위원장은 보호위원회를 대표하고, 보호위원회의 회의를 주재하며, 소관 사무를 총괄한다.
② 위원장이 부득이한 사유로 직무를 수행할 수 없을 때에는 부위원장이 그 직무를 대행하고, 위원장ㆍ부위원장이 모두 부득이한 사유로 직무를 수행할 수 없을 때에는 위원회가 미리 정하는 위원이 위원장의 직무를 대행한다.
③ 위원장은 국회에 출석하여 보호위원회의 소관 사무에 관하여 의견을 진술할 수 있으며, 국회에서 요구하면 출석하여 보고하거나 답변하여야 한다.
④ 위원장은 국무회의에 출석하여 발언할 수 있으며, 그 소관 사무에 관하여 국무총리에게 의안 제출을 건의할 수 있다.
[본조신설 2020. 2. 4.]
Article 7-3 (Chairperson)
(1) The Chairperson shall represent the Protection Commission, preside over meetings of the Protection Commission, and oversee the related business affairs.
(2) If the Chairperson cannot perform his or her duties for inevitable reasons, the Vice Chairperson shall act on his or her behalf, and if both the Chairperson and Vice Chairperson cannot perform his or her duties for inevitable reasons, another Commissioner, determined by the Protection Commission in advance, shall act on behalf of Chairperson.
(3) The Chairperson may attend the National Assembly and make statements in relation to the business affairs of the Protection Commission, and if required by the National Assembly, he or she shall attend the National Assembly to make a report or respond to questions.
(4) The Chairperson may attend a meeting of the State Council and recommend the Prime Minister to submit a bill concerning the business affairs under his or her jurisdiction.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-4 (Term of Office of Commissioners)
(1) A Commissioner shall serve for a term of three years but may be consecutively appointed one time.
(2) When the post of a Commissioner becomes vacant, a new Commissioner shall be named or appointed without delay. In such cases, the term of the named or appointed succeeding Commissioner shall be newly commenced.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의4(위원의 임기)
① 위원의 임기는 3년으로 하되, 한 차례만 연임할 수 있다.
② 위원이 궐위된 때에는 지체 없이 새로운 위원을 임명 또는 위촉하여야 한다. 이 경우 후임으로 임명 또는 위촉된 위원의 임기는 새로이 개시된다.
[본조신설 2020. 2. 4.]
Article 7-4 (Term of Office of Commissioners)
(1) A Commissioner shall serve for a term of three years but may be consecutively appointed one time.
(2) When the post of a Commissioner becomes vacant, a new Commissioner shall be named or appointed without delay. In such cases, the term of the named or appointed succeeding Commissioner shall be newly commenced.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-5 (Status Guarantee for Commissioners)
(1) No Commissioner shall be dismissed or de-commissioned against his or her will except in the following cases:
1. Where he or she is unable to perform his or her duties for a long period due to mental or physical disorder;
2. Where he or she falls under any ground for disqualification provided for in Article 7-7;
3. Where he or she violates his or her duties under this Act or any other Act.
(2) Each Commissioner shall independently perform his or her duties in compliance with statutes and his or her conscience.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의5(위원의 신분보장)
① 위원은 다음 각 호의 어느 하나에 해당하는 경우를 제외하고는 그 의사에 반하여 면직 또는 해촉되지 아니한다.
1. 장기간 심신장애로 인하여 직무를 수행할 수 없게 된 경우
2. 제7조의7의 결격사유에 해당하는 경우
3. 이 법 또는 그 밖의 다른 법률에 따른 직무상의 의무를 위반한 경우
② 위원은 법률과 양심에 따라 독립적으로 직무를 수행한다.
[본조신설 2020. 2. 4.]
Article 7-5 (Status Guarantee for Commissioners)
(1) No Commissioner shall be dismissed or de-commissioned against his or her will except in the following cases:
1. Where he or she is unable to perform his or her duties for a long period due to mental or physical disorder;
2. Where he or she falls under any ground for disqualification provided for in Article 7-7;
3. Where he or she violates his or her duties under this Act or any other Act.
(2) Each Commissioner shall independently perform his or her duties in compliance with statutes and his or her conscience.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-6 (Prohibition on Dual Office Holding)
(1) Each Commissioner shall neither concurrently engage in any of the following posts, nor engage in any work for profits related to his or her duties:
1. Member of the National Assembly or Local Council;
2. State or local public official;
3. Other positions prescribed by Presidential Decree.
(2) Matters relating to work for profit set forth in paragraph (1) shall be prescribed by Presidential Decree.
(3) A Commissioner shall not engage in political activities.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의6(겸직금지 등)
① 위원은 재직 중 다음 각 호의 직(職)을 겸하거나 직무와 관련된 영리업무에 종사하여서는 아니 된다.
1. 국회의원 또는 지방의회의원
2. 국가공무원 또는 지방공무원
3. 그 밖에 대통령령으로 정하는 직
② 제1항에 따른 영리업무에 관한 사항은 대통령령으로 정한다.
③ 위원은 정치활동에 관여할 수 없다.
[본조신설 2020. 2. 4.]
Article 7-6 (Prohibition on Dual Office Holding)
(1) Each Commissioner shall neither concurrently engage in any of the following posts, nor engage in any work for profits related to his or her duties:
1. Member of the National Assembly or Local Council;
2. State or local public official;
3. Other positions prescribed by Presidential Decree.
(2) Matters relating to work for profit set forth in paragraph (1) shall be prescribed by Presidential Decree.
(3) A Commissioner shall not engage in political activities.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-7 (Grounds for Disqualification)
(1) Persons falling under any of the following cannot be a Commissioner:
1. Non-Korean national;
2. A person falling under any of the subparagraphs under Article 33 of the State Public Officials Act;
3. A party member set forth in Article 22 of the Political Parties Act.
(2) A Commissioner falling under any of the above subparagraphs 1 through 3 shall be automatically discharged from his or her position; provided, in the case of subparagraph 2 of Article 33 of the State Public Officials Act, this only applies to a person who was declared bankrupt and did not apply for immunity within the application deadline, or received a confirmed decision of immunity disapproval or cancellation, according to the Debtor Rehabilitation and Bankruptcy Act; in the case of subparagraph 5 of Article 33 of the Same Act, this only applies to Articles 129 through 132 of the Criminal Act, Article 2 of the Act on Special Cases Concerning the Punishment of Sexual Crimes, subparagraph 2 of Article 2 of the Act on the Protection of Children and Youth against Sex Offenses and a person who committed a crime prescribed in Articles 355 or 356 of the Criminal Act with regard to his or her duties and received a suspended sentence of imprisonment without labor or a heavier punishment.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의7(결격사유)
① 다음 각 호의 어느 하나에 해당하는 사람은 위원이 될 수 없다.
1. 대한민국 국민이 아닌 사람
2. 「국가공무원법」 제33조 각 호의 어느 하나에 해당하는 사람
3. 「정당법」 제22조에 따른 당원
② 위원이 제1항 각 호의 어느 하나에 해당하게 된 때에는 그 직에서 당연 퇴직한다. 다만, 「국가공무원법」 제33조제2호는 파산선고를 받은 사람으로서 「채무자 회생 및 파산에 관한 법률」에 따라 신청기한 내에 면책신청을 하지 아니하였거나 면책불허가 결정 또는 면책 취소가 확정된 경우만 해당하고, 같은 법 제33조제5호는 「형법」 제129조부터 제132조까지, 「성폭력범죄의 처벌 등에 관한 특례법」 제2조, 「아동ㆍ청소년의 성보호에 관한 법률」 제2조제2호 및 직무와 관련하여 「형법」 제355조 또는 제356조에 규정된 죄를 범한 사람으로서 금고 이상의 형의 선고유예를 받은 경우만 해당한다.
[본조신설 2020. 2. 4.]
Article 7-7 (Grounds for Disqualification)
(1) Persons falling under any of the following cannot be a Commissioner:
1. Non-Korean national;
2. A person falling under any of the subparagraphs under Article 33 of the State Public Officials Act;
3. A party member set forth in Article 22 of the Political Parties Act.
(2) A Commissioner falling under any of the above subparagraphs 1 through 3 shall be automatically discharged from his or her position; provided, in the case of subparagraph 2 of Article 33 of the State Public Officials Act, this only applies to a person who was declared bankrupt and did not apply for immunity within the application deadline, or received a confirmed decision of immunity disapproval or cancellation, according to the Debtor Rehabilitation and Bankruptcy Act; in the case of subparagraph 5 of Article 33 of the Same Act, this only applies to Articles 129 through 132 of the Criminal Act, Article 2 of the Act on Special Cases Concerning the Punishment of Sexual Crimes, subparagraph 2 of Article 2 of the Act on the Protection of Children and Youth against Sex Offenses and a person who committed a crime prescribed in Articles 355 or 356 of the Criminal Act with regard to his or her duties and received a suspended sentence of imprisonment without labor or a heavier punishment.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-8 (Business Affairs under Jurisdiction of Protection Commission)
The Protection Commission shall perform the following affairs: <Amended on Mar. 14, 2023>
1. Matters relating to the improvement of statutes or regulations relating to personal information protection;
2. Matters relating to the establishment or execution of policies, systems or plans relating to personal information protection;
3. Matters relating to investigation into infringement upon the right of data subjects and the ensuing dispositions;
4. Handling of complaints or remedial procedures relating to personal information processing and mediation of disputes over personal information;
5. Exchange and cooperation with international organizations and foreign personal information protection agencies to protect personal information;
6. Matters relating to the investigation and study, education and promotion of statutes or regulations, policies, systems and status relating to personal information protection;
7. Matters relating to support for and dissemination of technological development relating to personal information protection, the standardization of technologies, and nurturing of experts;
8. Matters provided in this Act and other statutes or regulations as affairs under the jurisdiction of the Protection Commission.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의8(보호위원회의 소관 사무)
보호위원회는 다음 각 호의 소관 사무를 수행한다. <개정 2023. 3. 14.>
1. 개인정보의 보호와 관련된 법령의 개선에 관한 사항
2. 개인정보 보호와 관련된 정책ㆍ제도ㆍ계획 수립ㆍ집행에 관한 사항
3. 정보주체의 권리침해에 대한 조사 및 이에 따른 처분에 관한 사항
4. 개인정보의 처리와 관련한 고충처리ㆍ권리구제 및 개인정보에 관한 분쟁의 조정
5. 개인정보 보호를 위한 국제기구 및 외국의 개인정보 보호기구와의 교류ㆍ협력
6. 개인정보 보호에 관한 법령ㆍ정책ㆍ제도ㆍ실태 등의 조사ㆍ연구, 교육 및 홍보에 관한 사항
7. 개인정보 보호에 관한 기술개발의 지원ㆍ보급, 기술의 표준화 및 전문인력의 양성에 관한 사항
8. 이 법 및 다른 법령에 따라 보호위원회의 사무로 규정된 사항
[본조신설 2020. 2. 4.]
Article 7-8 (Business Affairs under Jurisdiction of Protection Commission)
The Protection Commission shall perform the following affairs: <Amended on Mar. 14, 2023>
1. Matters relating to the improvement of statutes or regulations relating to personal information protection;
2. Matters relating to the establishment or execution of policies, systems or plans relating to personal information protection;
3. Matters relating to investigation into infringement upon the right of data subjects and the ensuing dispositions;
4. Handling of complaints or remedial procedures relating to personal information processing and mediation of disputes over personal information;
5. Exchange and cooperation with international organizations and foreign personal information protection agencies to protect personal information;
6. Matters relating to the investigation and study, education and promotion of statutes or regulations, policies, systems and status relating to personal information protection;
7. Matters relating to support for and dissemination of technological development relating to personal information protection, the standardization of technologies, and nurturing of experts;
8. Matters provided in this Act and other statutes or regulations as affairs under the jurisdiction of the Protection Commission.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-9 (Matters to Be Deliberated and Resolved on by Protection Commission)
(1) The Protection Commission shall deliberate and resolve on the following matters: <Amended on Mar. 14, 2023>
1. Matters relating to the assessment of personal information breach incident factors under Article 8-2;
2. Establishment of the Master Plan referred to in Article 9 and the Implementation Plan referred to in Article 10;
3. Matters relating to the improvement of policies, systems, and law relating to personal information protection;
4. Matters relating to the coordination of positions taken by public institutions with respect to the processing of personal information;
5. Matters relating to the interpretation and operation of statutes or regulations related to the protection of personal information;
6. Matters relating to the use and provision of personal information under Article 18 (2) 5;
6-2. Matters relating to orders to suspend cross-border transfers of personal information under Article 28-9;
7. Matters relating to the results of the privacy impact assessment under Article 33 (4);
8. Matters relating to the imposition of penalty surcharges under Article 64-2;
9. Matters relating to the presentation of opinions and recommendation for improvement under Article 61;
9-2. Matters concerning recommendations for correction pursuant to Article 63-2 (2);
10. Matters relating to corrective measures under Article 64;
11. Matters relating to accusation and recommendation for disciplinary actions under Article 65;
12. Matters relating to the publication of processing results and orders for publication under Article 66;
13. Matters relating to the imposition of administrative fines under Article 75;
14. Matters relating to the enactment, amendment and abolition of statutes or regulations under its jurisdiction and rules of the Protection Commission;
15. Matters referred to a meeting by Chairperson or at least two Commissioners of the Protection Commission with respect to the protection of personal information;
16. Other matters on which the Protection Commission deliberates or resolves pursuant to this Act or other statutes or regulations.
(2) The Protection Commission may take the following measures if necessary to deliberate and resolve matters provided in paragraph (1):
1. Listening to the opinions of relevant public officials, experts in personal information protection, civic organizations and relevant business operators;
2. Requesting submission of relevant materials or facts with respect to relevant agencies.
(3) Relevant agencies upon receipt of a request made under paragraph (2) 2 shall comply with the request unless there are extraordinary circumstances.
(4) Upon deliberating and resolving on matters provided in paragraph (1) 3, the Protection Commission may advise on the improvement of such matters to the relevant agency.
(5) The Protection Commission may inspect whether the details of its advice given under paragraph (4) has been implemented or not.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의9(보호위원회의 심의ㆍ의결 사항 등)
① 보호위원회는 다음 각 호의 사항을 심의ㆍ의결한다. <개정 2023. 3. 14.>
1. 제8조의2에 따른 개인정보 침해요인 평가에 관한 사항
2. 제9조에 따른 기본계획 및 제10조에 따른 시행계획에 관한 사항
3. 개인정보 보호와 관련된 정책, 제도 및 법령의 개선에 관한 사항
4. 개인정보의 처리에 관한 공공기관 간의 의견조정에 관한 사항
5. 개인정보 보호에 관한 법령의 해석ㆍ운용에 관한 사항
6. 제18조제2항제5호에 따른 개인정보의 이용ㆍ제공에 관한 사항
6의2. 제28조의9에 따른 개인정보의 국외 이전 중지 명령에 관한 사항
7. 제33조제4항에 따른 영향평가 결과에 관한 사항
8. 제64조의2에 따른 과징금 부과에 관한 사항
9. 제61조에 따른 의견제시 및 개선권고에 관한 사항
9의2. 제63조의2제2항에 따른 시정권고에 관한 사항
10. 제64조에 따른 시정조치 등에 관한 사항
11. 제65조에 따른 고발 및 징계권고에 관한 사항
12. 제66조에 따른 처리 결과의 공표 및 공표명령에 관한 사항
13. 제75조에 따른 과태료 부과에 관한 사항
14. 소관 법령 및 보호위원회 규칙의 제정ㆍ개정 및 폐지에 관한 사항
15. 개인정보 보호와 관련하여 보호위원회의 위원장 또는 위원 2명 이상이 회의에 부치는 사항
16. 그 밖에 이 법 또는 다른 법령에 따라 보호위원회가 심의ㆍ의결하는 사항
② 보호위원회는 제1항 각 호의 사항을 심의ㆍ의결하기 위하여 필요한 경우 다음 각 호의 조치를 할 수 있다.
1. 관계 공무원, 개인정보 보호에 관한 전문 지식이 있는 사람이나 시민사회단체 및 관련 사업자로부터의 의견 청취
2. 관계 기관 등에 대한 자료제출이나 사실조회 요구
③ 제2항제2호에 따른 요구를 받은 관계 기관 등은 특별한 사정이 없으면 이에 따라야 한다.
④ 보호위원회는 제1항제3호의 사항을 심의ㆍ의결한 경우에는 관계 기관에 그 개선을 권고할 수 있다.
⑤ 보호위원회는 제4항에 따른 권고 내용의 이행 여부를 점검할 수 있다.
[본조신설 2020. 2. 4.]
Article 7-9 (Matters to Be Deliberated and Resolved on by Protection Commission)
(1) The Protection Commission shall deliberate and resolve on the following matters: <Amended on Mar. 14, 2023>
1. Matters relating to the assessment of personal information breach incident factors under Article 8-2;
2. Establishment of the Master Plan referred to in Article 9 and the Implementation Plan referred to in Article 10;
3. Matters relating to the improvement of policies, systems, and law relating to personal information protection;
4. Matters relating to the coordination of positions taken by public institutions with respect to the processing of personal information;
5. Matters relating to the interpretation and operation of statutes or regulations related to the protection of personal information;
6. Matters relating to the use and provision of personal information under Article 18 (2) 5;
6-2. Matters relating to orders to suspend cross-border transfers of personal information under Article 28-9;
7. Matters relating to the results of the privacy impact assessment under Article 33 (4);
8. Matters relating to the imposition of penalty surcharges under Article 64-2;
9. Matters relating to the presentation of opinions and recommendation for improvement under Article 61;
9-2. Matters concerning recommendations for correction pursuant to Article 63-2 (2);
10. Matters relating to corrective measures under Article 64;
11. Matters relating to accusation and recommendation for disciplinary actions under Article 65;
12. Matters relating to the publication of processing results and orders for publication under Article 66;
13. Matters relating to the imposition of administrative fines under Article 75;
14. Matters relating to the enactment, amendment and abolition of statutes or regulations under its jurisdiction and rules of the Protection Commission;
15. Matters referred to a meeting by Chairperson or at least two Commissioners of the Protection Commission with respect to the protection of personal information;
16. Other matters on which the Protection Commission deliberates or resolves pursuant to this Act or other statutes or regulations.
(2) The Protection Commission may take the following measures if necessary to deliberate and resolve matters provided in paragraph (1):
1. Listening to the opinions of relevant public officials, experts in personal information protection, civic organizations and relevant business operators;
2. Requesting submission of relevant materials or facts with respect to relevant agencies.
(3) Relevant agencies upon receipt of a request made under paragraph (2) 2 shall comply with the request unless there are extraordinary circumstances.
(4) Upon deliberating and resolving on matters provided in paragraph (1) 3, the Protection Commission may advise on the improvement of such matters to the relevant agency.
(5) The Protection Commission may inspect whether the details of its advice given under paragraph (4) has been implemented or not.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-10 (Meetings)
(1) Meetings of the Protection Commission shall be convened by the Chairperson when he or she deems it necessary or at the request of not less than 1/4 of all incumbent Commissioners.
(2) The Chairperson or at least two Commissioners of the Protection Commission may propose a bill to the Protection Commission.
(3) The quorum for holding meetings of the Protection Commission shall be the presence of a majority of its members enrolled, and any resolution shall require the affirmative votes of a majority of the members present.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의10(회의)
① 보호위원회의 회의는 위원장이 필요하다고 인정하거나 재적위원 4분의 1 이상의 요구가 있는 경우에 위원장이 소집한다.
② 위원장 또는 2명 이상의 위원은 보호위원회에 의안을 제의할 수 있다.
③ 보호위원회의 회의는 재적위원 과반수의 출석으로 개의하고, 출석위원 과반수의 찬성으로 의결한다.
[본조신설 2020. 2. 4.]
Article 7-10 (Meetings)
(1) Meetings of the Protection Commission shall be convened by the Chairperson when he or she deems it necessary or at the request of not less than 1/4 of all incumbent Commissioners.
(2) The Chairperson or at least two Commissioners of the Protection Commission may propose a bill to the Protection Commission.
(3) The quorum for holding meetings of the Protection Commission shall be the presence of a majority of its members enrolled, and any resolution shall require the affirmative votes of a majority of the members present.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-11 (Exclusion of, Challenge to, or Recusal of, Commissioner)
(1) A Commissioner of the Protection Commission shall be excluded from deliberation and resolution on a case if:
1. The Commissioner or his or her current or former spouse is a party to the relevant case or is a joint right holder or a joint obligor with respect to the case;
2. The Commissioner is or was a relative of a party to the case;
3. The Commissioner has given any testimony, expert opinion, or legal advice with respect to the case;
4. The Commissioner is or was involved in the case as an agent or representative of a party to the case;
5. The Commissioner or a public institution, corporation or group where he or she belongs shares interests with a person who provides advice or other support for the case.
(2) Where the circumstances indicate that it would be impracticable to expect fair deliberations and resolutions by a Commissioner, any party may file a motion for challenge, and the Protection Commission shall make a decision by resolution.
(3) A Commissioner may recuse himself or herself from the case on the grounds provided in paragraph (1) or (2).
[This Article Newly Inserted on Feb. 4, 2020]
제7조의11(위원의 제척ㆍ기피ㆍ회피)
① 위원은 다음 각 호의 어느 하나에 해당하는 경우에는 심의ㆍ의결에서 제척된다.
1. 위원 또는 그 배우자나 배우자였던 자가 해당 사안의 당사자가 되거나 그 사건에 관하여 공동의 권리자 또는 의무자의 관계에 있는 경우
2. 위원이 해당 사안의 당사자와 친족이거나 친족이었던 경우
3. 위원이 해당 사안에 관하여 증언, 감정, 법률자문을 한 경우
4. 위원이 해당 사안에 관하여 당사자의 대리인으로서 관여하거나 관여하였던 경우
5. 위원이나 위원이 속한 공공기관ㆍ법인 또는 단체 등이 조언 등 지원을 하고 있는 자와 이해관계가 있는 경우
② 위원에게 심의ㆍ의결의 공정을 기대하기 어려운 사정이 있는 경우 당사자는 기피 신청을 할 수 있고, 보호위원회는 의결로 이를 결정한다.
③ 위원이 제1항 또는 제2항의 사유가 있는 경우에는 해당 사안에 대하여 회피할 수 있다.
[본조신설 2020. 2. 4.]
Article 7-11 (Exclusion of, Challenge to, or Recusal of, Commissioner)
(1) A Commissioner of the Protection Commission shall be excluded from deliberation and resolution on a case if:
1. The Commissioner or his or her current or former spouse is a party to the relevant case or is a joint right holder or a joint obligor with respect to the case;
2. The Commissioner is or was a relative of a party to the case;
3. The Commissioner has given any testimony, expert opinion, or legal advice with respect to the case;
4. The Commissioner is or was involved in the case as an agent or representative of a party to the case;
5. The Commissioner or a public institution, corporation or group where he or she belongs shares interests with a person who provides advice or other support for the case.
(2) Where the circumstances indicate that it would be impracticable to expect fair deliberations and resolutions by a Commissioner, any party may file a motion for challenge, and the Protection Commission shall make a decision by resolution.
(3) A Commissioner may recuse himself or herself from the case on the grounds provided in paragraph (1) or (2).
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-12 (Sub-Commission)
(1) The Protection Commission may have sub-commissions which will deliberate and resolve minor personal information breach cases or similar or repetitive matters to ensure more efficient work procedures.
(2) Each sub-commission shall be comprised of three members.
(3) Matters deliberated and resolved by the sub-commission pursuant to paragraph (1) shall be deemed deliberated and resolved by the Protection Commission.
(4) Resolution for a meeting of the sub-commission shall be made by the presence of all the members enrolled and affirmative votes of all members present.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의12(소위원회)
① 보호위원회는 효율적인 업무 수행을 위하여 개인정보 침해 정도가 경미하거나 유사ㆍ반복되는 사항 등을 심의ㆍ의결할 소위원회를 둘 수 있다.
② 소위원회는 3명의 위원으로 구성한다.
③ 소위원회가 제1항에 따라 심의ㆍ의결한 것은 보호위원회가 심의ㆍ의결한 것으로 본다.
④ 소위원회의 회의는 구성위원 전원의 출석과 출석위원 전원의 찬성으로 의결한다.
[본조신설 2020. 2. 4.]
Article 7-12 (Sub-Commission)
(1) The Protection Commission may have sub-commissions which will deliberate and resolve minor personal information breach cases or similar or repetitive matters to ensure more efficient work procedures.
(2) Each sub-commission shall be comprised of three members.
(3) Matters deliberated and resolved by the sub-commission pursuant to paragraph (1) shall be deemed deliberated and resolved by the Protection Commission.
(4) Resolution for a meeting of the sub-commission shall be made by the presence of all the members enrolled and affirmative votes of all members present.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-13 (Secretariat)
The Protection Commission shall have a secretariat to perform business affairs, and matters that are not specified in this Act in relation to the organization of the Protection Commission shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의13(사무처)
보호위원회의 사무를 처리하기 위하여 보호위원회에 사무처를 두며, 이 법에 규정된 것 외에 보호위원회의 조직에 관한 사항은 대통령령으로 정한다.
[본조신설 2020. 2. 4.]
Article 7-13 (Secretariat)
The Protection Commission shall have a secretariat to perform business affairs, and matters that are not specified in this Act in relation to the organization of the Protection Commission shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Feb. 4, 2020]
Article 7-14 (Operation)
Matters that are not specified in this Act and other statutes in relation to the operation of the Protection Commission shall be prescribed by the rules of the Protection Commission.
[This Article Newly Inserted on Feb. 4, 2020]
제7조의14(운영 등)
이 법과 다른 법령에 규정된 것 외에 보호위원회의 운영 등에 필요한 사항은 보호위원회의 규칙으로 정한다.
[본조신설 2020. 2. 4.]
Article 7-14 (Operation)
Matters that are not specified in this Act and other statutes in relation to the operation of the Protection Commission shall be prescribed by the rules of the Protection Commission.
[This Article Newly Inserted on Feb. 4, 2020]
Article 8 Deleted.
제8조 삭제 <2020. 2. 4.>
Article 8 Deleted.
Article 8-2 (Assessment of Personal Information Breach Incident Factors)
(1) The head of a central administrative agency shall request the Protection Commission to assess the factors of personal information breach incident where a policy or system that entails personal information processing is adopted or changed by the enactment or amendment of any statute under his or her jurisdiction.
(2) Upon receipt of a request made pursuant to paragraph (1), the Protection Commission may advise the head of the relevant agency of the matters necessary to improve the relevant statute or regulation by analyzing and reviewing the personal information breach incident factors of such statute or regulation.
(3) Matters necessary for the procedure and method to assess the personal information breach incident factors under paragraph (1) shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Jul. 24, 2015]
제8조의2(개인정보 침해요인 평가)
① 중앙행정기관의 장은 소관 법령의 제정 또는 개정을 통하여 개인정보 처리를 수반하는 정책이나 제도를 도입ㆍ변경하는 경우에는 보호위원회에 개인정보 침해요인 평가를 요청하여야 한다.
② 보호위원회가 제1항에 따른 요청을 받은 때에는 해당 법령의 개인정보 침해요인을 분석ㆍ검토하여 그 법령의 소관기관의 장에게 그 개선을 위하여 필요한 사항을 권고할 수 있다.
③ 제1항에 따른 개인정보 침해요인 평가의 절차와 방법에 관하여 필요한 사항은 대통령령으로 정한다.
[본조신설 2015. 7. 24.]
Article 8-2 (Assessment of Personal Information Breach Incident Factors)
(1) The head of a central administrative agency shall request the Protection Commission to assess the factors of personal information breach incident where a policy or system that entails personal information processing is adopted or changed by the enactment or amendment of any statute under his or her jurisdiction.
(2) Upon receipt of a request made pursuant to paragraph (1), the Protection Commission may advise the head of the relevant agency of the matters necessary to improve the relevant statute or regulation by analyzing and reviewing the personal information breach incident factors of such statute or regulation.
(3) Matters necessary for the procedure and method to assess the personal information breach incident factors under paragraph (1) shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Jul. 24, 2015]
Article 9 (Master Plan)
(1) The Protection Commission shall establish a Master Plan to protect personal information (hereinafter referred to as a “Master Plan”) every three years in consultation with the heads of relevant central administrative agencies to ensure the protection of personal information and the rights and interests of data subjects: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015>
(2) The Master Plan shall include the following:
1. Basic goals and intended directions of the protection of personal information;
2. Improvement of systems and statutes or regulations related to the protection of personal information;
3. Measure to prevent personal information breaches;
4. Vitalization of self-regulation to protect personal information;
5. Promoting education and public relations to protect personal information;
6. Training of specialists in the protection of personal information;
7. Other matters necessary to protect personal information.
(3) The National Assembly, the Court, the Constitutional Court, and the National Election Commission may establish and implement its own Master Plan to protect personal information of relevant institutions (including affiliated entities).
제9조(기본계획)
① 보호위원회는 개인정보의 보호와 정보주체의 권익 보장을 위하여 3년마다 개인정보 보호 기본계획(이하 “기본계획”이라 한다)을 관계 중앙행정기관의 장과 협의하여 수립한다. <개정 2013. 3. 23., 2014. 11. 19., 2015. 7. 24.>
② 기본계획에는 다음 각 호의 사항이 포함되어야 한다.
1. 개인정보 보호의 기본목표와 추진방향
2. 개인정보 보호와 관련된 제도 및 법령의 개선
3. 개인정보 침해 방지를 위한 대책
4. 개인정보 보호 자율규제의 활성화
5. 개인정보 보호 교육ㆍ홍보의 활성화
6. 개인정보 보호를 위한 전문인력의 양성
7. 그 밖에 개인정보 보호를 위하여 필요한 사항
③ 국회, 법원, 헌법재판소, 중앙선거관리위원회는 해당 기관(그 소속 기관을 포함한다)의 개인정보 보호를 위한 기본계획을 수립ㆍ시행할 수 있다.
Article 9 (Master Plan)
(1) The Protection Commission shall establish a Master Plan to protect personal information (hereinafter referred to as a “Master Plan”) every three years in consultation with the heads of relevant central administrative agencies to ensure the protection of personal information and the rights and interests of data subjects: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015>
(2) The Master Plan shall include the following:
1. Basic goals and intended directions of the protection of personal information;
2. Improvement of systems and statutes or regulations related to the protection of personal information;
3. Measure to prevent personal information breaches;
4. Vitalization of self-regulation to protect personal information;
5. Promoting education and public relations to protect personal information;
6. Training of specialists in the protection of personal information;
7. Other matters necessary to protect personal information.
(3) The National Assembly, the Court, the Constitutional Court, and the National Election Commission may establish and implement its own Master Plan to protect personal information of relevant institutions (including affiliated entities).
Article 10 (Implementation Plan)
(1) The head of a central administrative agency shall establish an implementation plan to protect personal information each year in accordance with the Master Plan and submit it to the Protection Commission, and shall execute the implementation plan subject to the deliberation and resolution of the Protection Commission.
(2) Matters necessary for the establishment and execution of the implementation plan shall be prescribed by Presidential Decree.
제10조(시행계획)
① 중앙행정기관의 장은 기본계획에 따라 매년 개인정보 보호를 위한 시행계획을 작성하여 보호위원회에 제출하고, 보호위원회의 심의ㆍ의결을 거쳐 시행하여야 한다.
② 시행계획의 수립ㆍ시행에 필요한 사항은 대통령령으로 정한다.
Article 10 (Implementation Plan)
(1) The head of a central administrative agency shall establish an implementation plan to protect personal information each year in accordance with the Master Plan and submit it to the Protection Commission, and shall execute the implementation plan subject to the deliberation and resolution of the Protection Commission.
(2) Matters necessary for the establishment and execution of the implementation plan shall be prescribed by Presidential Decree.
Article 11 (Request for Materials)
(1) To efficiently establish the Master Plan, the Protection Commission may request materials or opinions regarding the status of regulatory compliance, personal information management, etc. by personal information controllers from personal information controllers, the heads of relevant central administrative agencies, the heads of local governments and related organizations or associations, etc. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015>
(2) The Protection Commission may conduct an investigation with respect to data controllers, the competent head of the central administrative departments or agencies and local governments, and the competent agencies and organizations about the level and actual status of how personal data is managed where necessary to implement policies for personal data protection and to evaluate performance, etc. <Newly Inserted on Jul. 24, 2015; Jul. 26, 2017; Feb. 4, 2020>
(3) The head of a central administrative agency may request the materials referred to in paragraph (1) from personal information controllers in the fields under his or her jurisdiction to efficiently establish and promote Implementation Plans. <Amended on Jul. 24, 2015>
(4) Any person upon receipt of a request to furnish the materials under paragraphs (1) through (3) shall comply with the request unless there are extraordinary circumstances. <Amended on Jul. 24, 2015>
(5) The scope and method to furnish the materials under paragraphs (1) through (3) and other necessary matters shall be prescribed by Presidential Decree. <Amended on Jul. 24, 2015>
제11조(자료제출 요구 등)
① 보호위원회는 기본계획을 효율적으로 수립하기 위하여 개인정보처리자, 관계 중앙행정기관의 장, 지방자치단체의 장 및 관계 기관ㆍ단체 등에 개인정보처리자의 법규 준수 현황과 개인정보 관리 실태 등에 관한 자료의 제출이나 의견의 진술 등을 요구할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2015. 7. 24.>
② 보호위원회는 개인정보 보호 정책 추진, 성과평가 등을 위하여 필요한 경우 개인정보처리자, 관계 중앙행정기관의 장, 지방자치단체의 장 및 관계 기관ㆍ단체 등을 대상으로 개인정보관리 수준 및 실태파악 등을 위한 조사를 실시할 수 있다. <신설 2015. 7. 24., 2017. 7. 26., 2020. 2. 4.>
③ 중앙행정기관의 장은 시행계획을 효율적으로 수립ㆍ추진하기 위하여 소관 분야의 개인정보처리자에게 제1항에 따른 자료제출 등을 요구할 수 있다. <개정 2015. 7. 24.>
④ 제1항부터 제3항까지에 따른 자료제출 등을 요구받은 자는 특별한 사정이 없으면 이에 따라야 한다. <개정 2015. 7. 24.>
⑤ 제1항부터 제3항까지에 따른 자료제출 등의 범위와 방법 등 필요한 사항은 대통령령으로 정한다. <개정 2015. 7. 24.>
Article 11 (Request for Materials)
(1) To efficiently establish the Master Plan, the Protection Commission may request materials or opinions regarding the status of regulatory compliance, personal information management, etc. by personal information controllers from personal information controllers, the heads of relevant central administrative agencies, the heads of local governments and related organizations or associations, etc. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015>
(2) The Protection Commission may conduct an investigation with respect to data controllers, the competent head of the central administrative departments or agencies and local governments, and the competent agencies and organizations about the level and actual status of how personal data is managed where necessary to implement policies for personal data protection and to evaluate performance, etc. <Newly Inserted on Jul. 24, 2015; Jul. 26, 2017; Feb. 4, 2020>
(3) The head of a central administrative agency may request the materials referred to in paragraph (1) from personal information controllers in the fields under his or her jurisdiction to efficiently establish and promote Implementation Plans. <Amended on Jul. 24, 2015>
(4) Any person upon receipt of a request to furnish the materials under paragraphs (1) through (3) shall comply with the request unless there are extraordinary circumstances. <Amended on Jul. 24, 2015>
(5) The scope and method to furnish the materials under paragraphs (1) through (3) and other necessary matters shall be prescribed by Presidential Decree. <Amended on Jul. 24, 2015>
Article 11-2 (Assessment of Level of Personal Information Protection)
(1) The Protection Commission shall conduct an annual assessment of central administrative agencies and institutions affiliated with such agencies, local governments, or any other institutions prescribed by Presidential Decree for the performance of policies and work for the protection of personal information and the compliance of obligations under this Act (hereinafter referred to as "assessment of the level of personal information protection").
(2) The Protection Commission may require the head of a relevant public institution to submit relevant materials where necessary for the assessment of the level of personal information protection.
(3) The Protection Commission may disclose the results of the assessment of the level of personal information protection on its website, etc.
(4) The Protection Commission may grant awards to exemplary institutions and employees belonging thereto according to the results of the assessment of the level of personal information protection, and recommend improvement to the head of a relevant public institutions, if deemed necessary for the protection of personal information. In such cases, the head of the public institution shall make good faith efforts to comply with the recommendation, and notify the Protection Commission of the results of the measures taken.
(5) Other matters necessary for the criteria, methods, and procedures for the assessment of the level of personal information protection, the scope of data to be submitted under paragraph (2), etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제11조의2(개인정보 보호수준 평가)
① 보호위원회는 공공기관 중 중앙행정기관 및 그 소속기관, 지방자치단체, 그 밖에 대통령령으로 정하는 기관을 대상으로 매년 개인정보 보호 정책ㆍ업무의 수행 및 이 법에 따른 의무의 준수 여부 등을 평가(이하 “개인정보 보호수준 평가”라 한다)하여야 한다.
② 보호위원회는 개인정보 보호수준 평가에 필요한 경우 해당 공공기관의 장에게 관련 자료를 제출하게 할 수 있다.
③ 보호위원회는 개인정보 보호수준 평가의 결과를 인터넷 홈페이지 등을 통하여 공개할 수 있다.
④ 보호위원회는 개인정보 보호수준 평가의 결과에 따라 우수기관 및 그 소속 직원에 대하여 포상할 수 있고, 개인정보 보호를 위하여 필요하다고 인정하면 해당 공공기관의 장에게 개선을 권고할 수 있다. 이 경우 권고를 받은 공공기관의 장은 이를 이행하기 위하여 성실하게 노력하여야 하며, 그 조치 결과를 보호위원회에 알려야 한다.
⑤ 그 밖에 개인정보 보호수준 평가의 기준ㆍ방법ㆍ절차 및 제2항에 따른 자료 제출의 범위 등에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 11-2 (Assessment of Level of Personal Information Protection)
(1) The Protection Commission shall conduct an annual assessment of central administrative agencies and institutions affiliated with such agencies, local governments, or any other institutions prescribed by Presidential Decree for the performance of policies and work for the protection of personal information and the compliance of obligations under this Act (hereinafter referred to as "assessment of the level of personal information protection").
(2) The Protection Commission may require the head of a relevant public institution to submit relevant materials where necessary for the assessment of the level of personal information protection.
(3) The Protection Commission may disclose the results of the assessment of the level of personal information protection on its website, etc.
(4) The Protection Commission may grant awards to exemplary institutions and employees belonging thereto according to the results of the assessment of the level of personal information protection, and recommend improvement to the head of a relevant public institution, if deemed necessary for the protection of personal information. In such cases, the head of the public institution shall make good faith efforts to comply with the recommendation, and notify the Protection Commission of the results of the measures taken.
(5) Other matters necessary for the criteria, methods, and procedures for the assessment of the level of personal information protection, the scope of data to be submitted under paragraph (2), etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 12 (Personal Information Protection Guidelines)
(1) The Protection Commission may establish the Standard Personal Information Protection Guidelines (hereinafter referred to as the “Standard Guidelines”) regarding the personal information processing standard, types of personal information breaches, preventive measures, etc., and recommend that personal information controllers comply with such Guidelines. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) The head of a central administrative agency may establish the personal information protection guidelines regarding the personal information processing in the fields under his or her jurisdiction in accordance with the Standard Guidelines; and may recommend that personal information controllers comply with such guidelines.
(3) The National Assembly, the Court, the Constitutional Court, and the National Election Commission may establish and implement its own personal information protection guidelines for each relevant institution (including affiliated entities).
제12조(개인정보 보호지침)
① 보호위원회는 개인정보의 처리에 관한 기준, 개인정보 침해의 유형 및 예방조치 등에 관한 표준 개인정보 보호지침(이하 “표준지침”이라 한다)을 정하여 개인정보처리자에게 그 준수를 권장할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
② 중앙행정기관의 장은 표준지침에 따라 소관 분야의 개인정보 처리와 관련한 개인정보 보호지침을 정하여 개인정보처리자에게 그 준수를 권장할 수 있다.
③ 국회, 법원, 헌법재판소 및 중앙선거관리위원회는 해당 기관(그 소속 기관을 포함한다)의 개인정보 보호지침을 정하여 시행할 수 있다.
Article 12 (Personal Information Protection Guidelines)
(1) The Protection Commission may establish the Standard Personal Information Protection Guidelines (hereinafter referred to as the “Standard Guidelines”) regarding the personal information processing standard, types of personal information breaches, preventive measures, etc., and recommend that personal information controllers comply with such Guidelines. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) The head of a central administrative agency may establish the personal information protection guidelines regarding the personal information processing in the fields under his or her jurisdiction in accordance with the Standard Guidelines; and may recommend that personal information controllers comply with such guidelines.
(3) The National Assembly, the Court, the Constitutional Court, and the National Election Commission may establish and implement its own personal information protection guidelines for each relevant institution (including affiliated entities).
Article 13 (Promotion and Support of Self-Regulation)
The Protection Commission shall establish policies necessary for the following matters to promote and support self-regulating activities of personal information controllers to protect personal information:<Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
1. Education and public relations concerning the protection of personal information;
2. Promotion and support of agencies and organizations related to the protection of personal information;
3. Introduction and facilitation of privacy mark;
4. Support for personal information controllers in the establishment and implementation of self-regulatory rules;
5. Other matters necessary to support the self-regulating data protection activities of personal information controllers.
제13조(자율규제의 촉진 및 지원)
보호위원회는 개인정보처리자의 자율적인 개인정보 보호활동을 촉진하고 지원하기 위하여 다음 각 호의 필요한 시책을 마련하여야 한다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
1. 개인정보 보호에 관한 교육ㆍ홍보
2. 개인정보 보호와 관련된 기관ㆍ단체의 육성 및 지원
3. 개인정보 보호 인증마크의 도입ㆍ시행 지원
4. 개인정보처리자의 자율적인 규약의 제정ㆍ시행 지원
5. 그 밖에 개인정보처리자의 자율적 개인정보 보호활동을 지원하기 위하여 필요한 사항
Article 13 (Promotion and Support of Self-Regulation)
The Protection Commission shall establish policies necessary for the following matters to promote and support self-regulating activities of personal information controllers to protect personal information:<Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
1. Education and public relations concerning the protection of personal information;
2. Promotion and support of agencies and organizations related to the protection of personal information;
3. Introduction and facilitation of privacy mark;
4. Support for personal information controllers in the establishment and implementation of self-regulatory rules;
5. Other matters necessary to support the self-regulating data protection activities of personal information controllers.
Article 13-2 (Personal Information Protection Day)
(1) September 30 of each year shall be designated as the Personal Information Protection Day to raise awareness among citizens as to the importance of the protection and processing of personal information.
(2) The State and local governments may hold various events to spread the culture of personal information protection during the week in which the Personal Information Protection Day is included.
[This Article Newly Inserted on Mar. 14, 2023]
제13조의2(개인정보 보호의 날)
① 개인정보의 보호 및 처리의 중요성을 국민에게 알리기 위하여 매년 9월 30일을 개인정보 보호의 날로 지정한다.
② 국가와 지방자치단체는 개인정보 보호의 날이 포함된 주간에 개인정보 보호 문화 확산을 위한 각종 행사를 실시할 수 있다.
[본조신설 2023. 3. 14.]
Article 13-2 (Personal Information Protection Day)
(1) September 30 of each year shall be designated as the Personal Information Protection Day to raise awareness among citizens as to the importance of the protection and processing of personal information.
(2) The State and local governments may hold various events to spread the culture of personal information protection during the week in which the Personal Information Protection Day is included.
[This Article Newly Inserted on Mar. 14, 2023]
Article 14 (International Cooperation)
(1) The Government shall establish policy measures necessary to enhance the personal information protection standard in the international environment.
(2) The Government shall establish relevant policy measures so that the rights of data subjects may not be infringed on owing to cross-border transfers of personal information.
제14조(국제협력)
① 정부는 국제적 환경에서의 개인정보 보호 수준을 향상시키기 위하여 필요한 시책을 마련하여야 한다.
② 정부는 개인정보 국외 이전으로 인하여 정보주체의 권리가 침해되지 아니하도록 관련 시책을 마련하여야 한다.
Article 14 (International Cooperation)
(1) The Government shall establish policy measures necessary to enhance the personal information protection standard in the international environment.
(2) The Government shall establish relevant policy measures so that the rights of data subjects may not be infringed on owing to cross-border transfers of personal information.
CHAPTER III PROCESSING OF PERSONAL INFORMATION
제3장 개인정보의 처리
CHAPTER III PROCESSING OF PERSONAL INFORMATION
SECTION 1 Collection, Use, and Provision of Personal Information
제1절 개인정보의 수집, 이용, 제공 등
SECTION 1 Collection, Use, and Provision of Personal Information
Article 15 (Collection and Use of Personal Information)
(1) A personal information controller may collect personal information in any of the following cases, and use it within the scope of the purpose of collection: <Amended on Mar. 14, 2023>
1. Where consent is obtained from a data subject;
2. Where special provisions exist in other statutes or it is unavoidable due to obligations under statutes or regulations;
3. Where it is unavoidable for a public institution’s performance of work under its jurisdiction as prescribed by statutes or regulations, etc.;
4. Where it is necessary to take measures at the request of a data subject in the course of performing a contract concluded with the data subject or concluding a contract;
5. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
6. Where it is necessary to attain the legitimate interests of a personal information controller, which such interest is manifestly superior to the rights of the data subject. In such cases, processing shall be allowed only to the extent the processing is substantially related to the legitimate interests of the personal information controller and does not go beyond a reasonable scope.
7. Where it is urgently necessary for the public safety and security, public health, etc.
(2) A personal information controller shall inform a data subject of the following matters when it obtains consent under paragraph (1) 1. The same shall apply when any of the following is modified:
1. The purpose of the collection and use of personal information;
2. Particulars of personal information to be collected;
3. The period for retaining and using personal information;
4. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.
(3) A personal information controller may use personal information without the consent of a data subject within the scope reasonably related to the initial purpose of the collection as prescribed by Presidential Decree, in consideration whether disadvantages have been caused to the data subject and whether necessary measures to ensure safety such as encryption have been taken. <Newly Inserted on Feb. 4, 2020>
제15조(개인정보의 수집ㆍ이용)
① 개인정보처리자는 다음 각 호의 어느 하나에 해당하는 경우에는 개인정보를 수집할 수 있으며 그 수집 목적의 범위에서 이용할 수 있다. <개정 2023. 3. 14.>
1. 정보주체의 동의를 받은 경우
2. 법률에 특별한 규정이 있거나 법령상 의무를 준수하기 위하여 불가피한 경우
3. 공공기관이 법령 등에서 정하는 소관 업무의 수행을 위하여 불가피한 경우
4. 정보주체와 체결한 계약을 이행하거나 계약을 체결하는 과정에서 정보주체의 요청에 따른 조치를 이행하기 위하여 필요한 경우
5. 명백히 정보주체 또는 제3자의 급박한 생명, 신체, 재산의 이익을 위하여 필요하다고 인정되는 경우
6. 개인정보처리자의 정당한 이익을 달성하기 위하여 필요한 경우로서 명백하게 정보주체의 권리보다 우선하는 경우. 이 경우 개인정보처리자의 정당한 이익과 상당한 관련이 있고 합리적인 범위를 초과하지 아니하는 경우에 한한다.
7. 공중위생 등 공공의 안전과 안녕을 위하여 긴급히 필요한 경우
② 개인정보처리자는 제1항제1호에 따른 동의를 받을 때에는 다음 각 호의 사항을 정보주체에게 알려야 한다. 다음 각 호의 어느 하나의 사항을 변경하는 경우에도 이를 알리고 동의를 받아야 한다.
1. 개인정보의 수집ㆍ이용 목적
2. 수집하려는 개인정보의 항목
3. 개인정보의 보유 및 이용 기간
4. 동의를 거부할 권리가 있다는 사실 및 동의 거부에 따른 불이익이 있는 경우에는 그 불이익의 내용
③ 개인정보처리자는 당초 수집 목적과 합리적으로 관련된 범위에서 정보주체에게 불이익이 발생하는지 여부, 암호화 등 안전성 확보에 필요한 조치를 하였는지 여부 등을 고려하여 대통령령으로 정하는 바에 따라 정보주체의 동의 없이 개인정보를 이용할 수 있다. <신설 2020. 2. 4.>
Article 15 (Collection and Use of Personal Information)
(1) A personal information controller may collect personal information in any of the following cases, and use it within the scope of the purpose of collection: <Amended on Mar. 14, 2023>
1. Where consent is obtained from a data subject;
2. Where special provisions exist in other statutes or it is unavoidable due to obligations under statutes or regulations;
3. Where it is unavoidable for a public institution’s performance of work under its jurisdiction as prescribed by statutes or regulations, etc.;
4. Where it is necessary to take measures at the request of a data subject in the course of performing a contract concluded with the data subject or concluding a contract;
5. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
6. Where it is necessary to attain the legitimate interests of a personal information controller, which such interest is manifestly superior to the rights of the data subject. In such cases, processing shall be allowed only to the extent the processing is substantially related to the legitimate interests of the personal information controller and does not go beyond a reasonable scope.
7. Where it is urgently necessary for the public safety and security, public health, etc.
(2) A personal information controller shall inform a data subject of the following matters when it obtains consent under paragraph (1) 1. The same shall apply when any of the following is modified:
1. The purpose of the collection and use of personal information;
2. Particulars of personal information to be collected;
3. The period for retaining and using personal information;
4. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.
(3) A personal information controller may use personal information without the consent of a data subject within the scope reasonably related to the initial purpose of the collection as prescribed by Presidential Decree, in consideration whether disadvantages have been caused to the data subject and whether necessary measures to ensure safety such as encryption have been taken. <Newly Inserted on Feb. 4, 2020>
Article 16 (Restriction on Collection of Personal Information)
(1) A personal information controller shall collect the minimum personal information necessary to attain the purpose when collecting personal information pursuant to Article 15 (1). In such cases, the burden of proof that the minimum personal information is collected shall be borne by the personal information controller.
(2) A personal information controller shall collect personal information by specifically informing a data subject of the fact that he or she may deny the consent to the collection of other personal information than the minimum information necessary in case of collecting the personal information with consent of the data subject. <Newly Inserted on Aug. 6, 2013>
(3) A personal information controller shall not refuse to provide goods or services to a data subject on ground that the data subject does not consent to the collection of personal information exceeding minimum requirement. <Amended on Aug. 6, 2013>
제16조(개인정보의 수집 제한)
① 개인정보처리자는 제15조제1항 각 호의 어느 하나에 해당하여 개인정보를 수집하는 경우에는 그 목적에 필요한 최소한의 개인정보를 수집하여야 한다. 이 경우 최소한의 개인정보 수집이라는 입증책임은 개인정보처리자가 부담한다.
② 개인정보처리자는 정보주체의 동의를 받아 개인정보를 수집하는 경우 필요한 최소한의 정보 외의 개인정보 수집에는 동의하지 아니할 수 있다는 사실을 구체적으로 알리고 개인정보를 수집하여야 한다. <신설 2013. 8. 6.>
③ 개인정보처리자는 정보주체가 필요한 최소한의 정보 외의 개인정보 수집에 동의하지 아니한다는 이유로 정보주체에게 재화 또는 서비스의 제공을 거부하여서는 아니 된다. <개정 2013. 8. 6.>
Article 16 (Restriction on Collection of Personal Information)
(1) A personal information controller shall collect the minimum personal information necessary to attain the purpose when collecting personal information pursuant to Article 15 (1). In such cases, the burden of proof that the minimum personal information is collected shall be borne by the personal information controller.
(2) A personal information controller shall collect personal information by specifically informing a data subject of the fact that he or she may deny the consent to the collection of other personal information than the minimum information necessary in case of collecting the personal information with consent of the data subject. <Newly Inserted on Aug. 6, 2013>
(3) A personal information controller shall not refuse to provide goods or services to a data subject on ground that the data subject does not consent to the collection of personal information exceeding minimum requirement. <Amended on Aug. 6, 2013>
Article 17 (Provision of Personal Information)
(1) A personal information controller may provide (or share; hereinafter the same shall apply) the personal information of a data subject to a third party in any of the following cases: <Amended on Feb. 4, 2020; Mar. 14, 2023>
1. Where consent is obtained from the data subject;
2. Where the personal information is provided within the scope of purposes for which it is collected pursuant to Articles 15 (1) 2, 3, and 5 through 7.
(2) A personal information controller shall inform a data subject of the following matters when it obtains the consent under paragraph (1) 1. The same shall apply when any of the following is modified:
1. The recipient of personal information;
2. The purpose for which the recipient of personal information uses such information;
3. Particulars of personal information to be provided;
4. The period during which the recipient retains and uses personal information;
5. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.
(3) Deleted. <Mar. 14, 2023>
(4) A personal information controller may provide personal information without the consent of a data subject within the scope reasonably related to the purposes for which the personal information was initially collected, in accordance with the matters prescribed by Presidential Decree taking into consideration whether disadvantages are caused to the data subject, whether measures necessary to secure safety, such as encryption, have been taken, etc. <Newly Inserted on Feb. 4, 2020>
제17조(개인정보의 제공)
① 개인정보처리자는 다음 각 호의 어느 하나에 해당되는 경우에는 정보주체의 개인정보를 제3자에게 제공(공유를 포함한다. 이하 같다)할 수 있다. <개정 2020. 2. 4., 2023. 3. 14.>
1. 정보주체의 동의를 받은 경우
2. 제15조제1항제2호, 제3호 및 제5호부터 제7호까지에 따라 개인정보를 수집한 목적 범위에서 개인정보를 제공하는 경우
② 개인정보처리자는 제1항제1호에 따른 동의를 받을 때에는 다음 각 호의 사항을 정보주체에게 알려야 한다. 다음 각 호의 어느 하나의 사항을 변경하는 경우에도 이를 알리고 동의를 받아야 한다.
1. 개인정보를 제공받는 자
2. 개인정보를 제공받는 자의 개인정보 이용 목적
3. 제공하는 개인정보의 항목
4. 개인정보를 제공받는 자의 개인정보 보유 및 이용 기간
5. 동의를 거부할 권리가 있다는 사실 및 동의 거부에 따른 불이익이 있는 경우에는 그 불이익의 내용
③ 삭제 <2023. 3. 14.>
④ 개인정보처리자는 당초 수집 목적과 합리적으로 관련된 범위에서 정보주체에게 불이익이 발생하는지 여부, 암호화 등 안전성 확보에 필요한 조치를 하였는지 여부 등을 고려하여 대통령령으로 정하는 바에 따라 정보주체의 동의 없이 개인정보를 제공할 수 있다. <신설 2020. 2. 4.>
Article 17 (Provision of Personal Information)
(1) A personal information controller may provide (or share; hereinafter the same shall apply) the personal information of a data subject to a third party in any of the following cases: <Amended on Feb. 4, 2020; Mar. 14, 2023>
1. Where consent is obtained from the data subject;
2. Where the personal information is provided within the scope of purposes for which it is collected pursuant to Articles 15 (1) 2, 3, and 5 through 7.
(2) A personal information controller shall inform a data subject of the following matters when it obtains the consent under paragraph (1) 1. The same shall apply when any of the following is modified:
1. The recipient of personal information;
2. The purpose for which the recipient of personal information uses such information;
3. Particulars of personal information to be provided;
4. The period during which the recipient retains and uses personal information;
5. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.
(3) Deleted. <Mar. 14, 2023>
(4) A personal information controller may provide personal information without the consent of a data subject within the scope reasonably related to the purposes for which the personal information was initially collected, in accordance with the matters prescribed by Presidential Decree taking into consideration whether disadvantages are caused to the data subject, whether measures necessary to secure safety, such as encryption, have been taken, etc. <Newly Inserted on Feb. 4, 2020>
Article 18 (Restriction on Repurposing Personal Information and Provision Thereof)
(1) No personal information controller shall use personal information beyond the scope provided in Article 15 (1) or provide it to any third party beyond the scope provided in Articles 17 (1) and 28-8 (1). <Amended on Feb. 4, 2020; Mar. 14, 2023>
(2) Notwithstanding paragraph (1), where any of the following subparagraphs applies, a personal information controller may repurpose personal information or provide it to a third party, unless doing so is likely to unfairly infringe on the interest of a data subject or third party: Provided, That subparagraphs 5 through 9 shall be applied only to public institutions: <Amended on Feb. 4, 2020; Mar. 14, 2023>
1. Where separate consent is obtained from the data subject;
2. Where special provisions exist in other statutes;
3. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
4. Deleted; <Feb. 4, 2020>
5. Where it is impossible to perform the work under its jurisdiction as provided in other statutes, unless the personal information controller repurposes personal information or provides it to a third party, and it is subject to the deliberation and resolution by the Commission;
6. Where it is necessary to provide personal information to a foreign government or international organization to perform a treaty or other international convention;
7. Where it is necessary for the investigation of a crime, institution and maintenance of a prosecution;
8. Where it is necessary for a court to proceed with trial-related work;
9. Where it is necessary for the enforcement of punishment, probation and custody;
10. Where it is urgently necessary for the public safety and security, public health, etc.
(3) A personal information controller shall inform the data subject of the following matters when it obtains the consent under paragraph (2) 1; the same shall apply when any of the following is modified:
1. The recipient of personal information;
2. The purpose of use of personal information (in the case of provision of personal information, it means the purpose of use by the recipient);
3. Particulars of personal information to be used or provided;
4. The period for retaining and using personal information (where personal information is provided, it means the period for retention and use by the recipient);
5. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.
(4) Where a public institution repurposes personal information or provides it to a third party under paragraph (2) 2 through 6 and 8 through 10, the public institution shall post matters necessary for the legal basis for such use or provision, purpose, scope, and the like on the Official Gazette or on its website, as prescribed by Notification of the Protection Commission. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(5) Where a personal information controller provides personal information to a third party for another purpose in any case provided in any subparagraph of paragraph (2), the personal information controller shall request the recipient of the personal information to limit the purpose and method of use and other necessary matters, or to prepare necessary safeguards to ensure the safety of the personal information. In such cases, the person upon receipt of such request shall take measures necessary to ensure the safety of the personal information.
[Title Amended on Aug. 6, 2013]
제18조(개인정보의 목적 외 이용ㆍ제공 제한)
① 개인정보처리자는 개인정보를 제15조제1항에 따른 범위를 초과하여 이용하거나 제17조제1항 및 제28조의8제1항에 따른 범위를 초과하여 제3자에게 제공하여서는 아니 된다. <개정 2020. 2. 4., 2023. 3. 14.>
② 제1항에도 불구하고 개인정보처리자는 다음 각 호의 어느 하나에 해당하는 경우에는 정보주체 또는 제3자의 이익을 부당하게 침해할 우려가 있을 때를 제외하고는 개인정보를 목적 외의 용도로 이용하거나 이를 제3자에게 제공할 수 있다. 다만, 제5호부터 제9호까지에 따른 경우는 공공기관의 경우로 한정한다. <개정 2020. 2. 4., 2023. 3. 14.>
1. 정보주체로부터 별도의 동의를 받은 경우
2. 다른 법률에 특별한 규정이 있는 경우
3. 명백히 정보주체 또는 제3자의 급박한 생명, 신체, 재산의 이익을 위하여 필요하다고 인정되는 경우
4. 삭제 <2020. 2. 4.>
5. 개인정보를 목적 외의 용도로 이용하거나 이를 제3자에게 제공하지 아니하면 다른 법률에서 정하는 소관 업무를 수행할 수 없는 경우로서 보호위원회의 심의ㆍ의결을 거친 경우
6. 조약, 그 밖의 국제협정의 이행을 위하여 외국정부 또는 국제기구에 제공하기 위하여 필요한 경우
7. 범죄의 수사와 공소의 제기 및 유지를 위하여 필요한 경우
8. 법원의 재판업무 수행을 위하여 필요한 경우
9. 형(刑) 및 감호, 보호처분의 집행을 위하여 필요한 경우
10. 공중위생 등 공공의 안전과 안녕을 위하여 긴급히 필요한 경우
③ 개인정보처리자는 제2항제1호에 따른 동의를 받을 때에는 다음 각 호의 사항을 정보주체에게 알려야 한다. 다음 각 호의 어느 하나의 사항을 변경하는 경우에도 이를 알리고 동의를 받아야 한다.
1. 개인정보를 제공받는 자
2. 개인정보의 이용 목적(제공 시에는 제공받는 자의 이용 목적을 말한다)
3. 이용 또는 제공하는 개인정보의 항목
4. 개인정보의 보유 및 이용 기간(제공 시에는 제공받는 자의 보유 및 이용 기간을 말한다)
5. 동의를 거부할 권리가 있다는 사실 및 동의 거부에 따른 불이익이 있는 경우에는 그 불이익의 내용
④ 공공기관은 제2항제2호부터 제6호까지, 제8호부터 제10호까지에 따라 개인정보를 목적 외의 용도로 이용하거나 이를 제3자에게 제공하는 경우에는 그 이용 또는 제공의 법적 근거, 목적 및 범위 등에 관하여 필요한 사항을 보호위원회가 고시로 정하는 바에 따라 관보 또는 인터넷 홈페이지 등에 게재하여야 한다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
⑤ 개인정보처리자는 제2항 각 호의 어느 하나의 경우에 해당하여 개인정보를 목적 외의 용도로 제3자에게 제공하는 경우에는 개인정보를 제공받는 자에게 이용 목적, 이용 방법, 그 밖에 필요한 사항에 대하여 제한을 하거나, 개인정보의 안전성 확보를 위하여 필요한 조치를 마련하도록 요청하여야 한다. 이 경우 요청을 받은 자는 개인정보의 안전성 확보를 위하여 필요한 조치를 하여야 한다.
[제목개정 2013. 8. 6.]
Article 18 (Restriction on Repurposing Personal Information and Provision Thereof)
(1) No personal information controller shall use personal information beyond the scope provided in Article 15 (1) or provide it to any third party beyond the scope provided in Articles 17 (1) and 28-8 (1). <Amended on Feb. 4, 2020; Mar. 14, 2023>
(2) Notwithstanding paragraph (1), where any of the following subparagraphs applies, a personal information controller may repurpose personal information or provide it to a third party, unless doing so is likely to unfairly infringe on the interest of a data subject or third party: Provided, That subparagraphs 5 through 9 shall be applied only to public institutions: <Amended on Feb. 4, 2020; Mar. 14, 2023>
1. Where separate consent is obtained from the data subject;
2. Where special provisions exist in other statutes;
3. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
4. Deleted; <Feb. 4, 2020>
5. Where it is impossible to perform the work under its jurisdiction as provided in other statutes, unless the personal information controller repurposes personal information or provides it to a third party, and it is subject to the deliberation and resolution by the Commission;
6. Where it is necessary to provide personal information to a foreign government or international organization to perform a treaty or other international convention;
7. Where it is necessary for the investigation of a crime, institution and maintenance of a prosecution;
8. Where it is necessary for a court to proceed with trial-related work;
9. Where it is necessary for the enforcement of punishment, probation and custody;
10. Where it is urgently necessary for the public safety and security, public health, etc.
(3) A personal information controller shall inform the data subject of the following matters when it obtains the consent under paragraph (2) 1; the same shall apply when any of the following is modified:
1. The recipient of personal information;
2. The purpose of use of personal information (in the case of provision of personal information, it means the purpose of use by the recipient);
3. Particulars of personal information to be used or provided;
4. The period for retaining and using personal information (where personal information is provided, it means the period for retention and use by the recipient);
5. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.
(4) Where a public institution repurposes personal information or provides it to a third party under paragraph (2) 2 through 6 and 8 through 10, the public institution shall post matters necessary for the legal basis for such use or provision, purpose, scope, and the like on the Official Gazette or on its website, as prescribed by Notification of the Protection Commission. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(5) Where a personal information controller provides personal information to a third party for another purpose in any case provided in any subparagraph of paragraph (2), the personal information controller shall request the recipient of the personal information to limit the purpose and method of use and other necessary matters, or to prepare necessary safeguards to ensure the safety of the personal information. In such cases, the person upon receipt of such request shall take measures necessary to ensure the safety of the personal information.
[Title Amended on Aug. 6, 2013]
Article 19 (Restriction on Use and Provision of Personal Information on Part of Its Recipients)
A person who receives personal information from a personal information controller shall not use the personal information, or provide it to a third party, for any purpose other than the intended one, except in the following circumstances:
1. Where separate consent is obtained from the data subject;
2. Where special provisions exist in other statutes.
제19조(개인정보를 제공받은 자의 이용ㆍ제공 제한)
개인정보처리자로부터 개인정보를 제공받은 자는 다음 각 호의 어느 하나에 해당하는 경우를 제외하고는 개인정보를 제공받은 목적 외의 용도로 이용하거나 이를 제3자에게 제공하여서는 아니 된다.
1. 정보주체로부터 별도의 동의를 받은 경우
2. 다른 법률에 특별한 규정이 있는 경우
Article 19 (Restriction on Use and Provision of Personal Information on Part of Its Recipients)
A person who receives personal information from a personal information controller shall not use the personal information, or provide it to a third party, for any purpose other than the intended one, except in the following circumstances:
1. Where separate consent is obtained from the data subject;
2. Where special provisions exist in other statutes.
Article 20 (Notification of Sources of Personal Information Collected from Other Than Data Subjects)
(1) When a personal information controller processes personal information collected from sources other than data subjects, the personal information controller shall immediately notify the data subject of the following matters at the request of such data subject: <Amended on Mar. 14, 2023>
1. The source of collected personal information;
2. The purpose of processing personal information;
3. The fact that the data subject is entitled to request suspension of processing of personal information or to withdraw consent, as prescribed in Article 37.
(2) Notwithstanding paragraph (1), when a personal information controller satisfying the criteria prescribed by Presidential Decree taking into account the types and amount of processed personal information, number of employees, amount of sales, etc., collects personal information from third parties and processes the same pursuant to Article 17 (1) 1, the personal information controller shall notify the data subject of the matters referred to in paragraph (1): Provided, That this shall not apply where the information collected by the personal information controller does not contain any personal information, such as contact information, through which notification can be given to the data subject. <Newly Inserted on Mar. 29, 2016; Feb. 4, 2020>
(3) Matters necessary for the time, method, and procedure of giving notification to the data subject pursuant to the main clause of paragraph (2), shall be prescribed by Presidential Decree. <Newly Inserted on Mar. 29, 2016>
(4) Paragraph (1) and the main clause of paragraph (2) shall not apply to any of the following cases: Provided, That this shall be the case only where it is manifestly superior to the rights of data subjects under this Act: <Amended on Mar. 29, 2016; Mar. 14, 2023>
1. Where personal information, which is subject to a notification request, is included in the personal information files referred to in any subparagraph of Article 32 (2);
2. Where such notification is likely to cause harm to the life or body of any other person, or to unfairly damage the property and other interests of any other person.
[Title Amended on Mar. 14, 2023]
제20조(정보주체 이외로부터 수집한 개인정보의 수집 출처 등 통지)
① 개인정보처리자가 정보주체 이외로부터 수집한 개인정보를 처리하는 때에는 정보주체의 요구가 있으면 즉시 다음 각 호의 모든 사항을 정보주체에게 알려야 한다. <개정 2023. 3. 14.>
1. 개인정보의 수집 출처
2. 개인정보의 처리 목적
3. 제37조에 따른 개인정보 처리의 정지를 요구하거나 동의를 철회할 권리가 있다는 사실
② 제1항에도 불구하고 처리하는 개인정보의 종류ㆍ규모, 종업원 수 및 매출액 규모 등을 고려하여 대통령령으로 정하는 기준에 해당하는 개인정보처리자가 제17조제1항제1호에 따라 정보주체 이외로부터 개인정보를 수집하여 처리하는 때에는 제1항 각 호의 모든 사항을 정보주체에게 알려야 한다. 다만, 개인정보처리자가 수집한 정보에 연락처 등 정보주체에게 알릴 수 있는 개인정보가 포함되지 아니한 경우에는 그러하지 아니하다. <신설 2016. 3. 29.>
③ 제2항 본문에 따라 알리는 경우 정보주체에게 알리는 시기ㆍ방법 및 절차 등 필요한 사항은 대통령령으로 정한다. <신설 2016. 3. 29.>
④ 제1항과 제2항 본문은 다음 각 호의 어느 하나에 해당하는 경우에는 적용하지 아니한다. 다만, 이 법에 따른 정보주체의 권리보다 명백히 우선하는 경우에 한한다. <개정 2016. 3. 29., 2023. 3. 14.>
1. 통지를 요구하는 대상이 되는 개인정보가 제32조제2항 각 호의 어느 하나에 해당하는 개인정보파일에 포함되어 있는 경우
2. 통지로 인하여 다른 사람의 생명ㆍ신체를 해할 우려가 있거나 다른 사람의 재산과 그 밖의 이익을 부당하게 침해할 우려가 있는 경우
[제목개정 2023. 3. 14.]
Article 20 (Notification of Sources of Personal Information Collected from Other Than Data Subjects)
(1) When a personal information controller processes personal information collected from sources other than data subjects, the personal information controller shall immediately notify the data subject of the following matters at the request of such data subject: <Amended on Mar. 14, 2023>
1. The source of collected personal information;
2. The purpose of processing personal information;
3. The fact that the data subject is entitled to request suspension of processing of personal information or to withdraw consent, as prescribed in Article 37.
(2) Notwithstanding paragraph (1), when a personal information controller satisfying the criteria prescribed by Presidential Decree taking into account the types and amount of processed personal information, number of employees, amount of sales, etc., collects personal information from third parties and processes the same pursuant to Article 17 (1) 1, the personal information controller shall notify the data subject of the matters referred to in paragraph (1): Provided, That this shall not apply where the information collected by the personal information controller does not contain any personal information, such as contact information, through which notification can be given to the data subject. <Newly Inserted on Mar. 29, 2016; Feb. 4, 2020>
(3) Matters necessary for the time, method, and procedure of giving notification to the data subject pursuant to the main clause of paragraph (2), shall be prescribed by Presidential Decree. <Newly Inserted on Mar. 29, 2016>
(4) Paragraph (1) and the main clause of paragraph (2) shall not apply to any of the following cases: Provided, That this shall be the case only where it is manifestly superior to the rights of data subjects under this Act: <Amended on Mar. 29, 2016; Mar. 14, 2023>
1. Where personal information, which is subject to a notification request, is included in the personal information files referred to in any subparagraph of Article 32 (2);
2. Where such notification is likely to cause harm to the life or body of any other person, or to unfairly damage the property and other interests of any other person.
[Title Amended on Mar. 14, 2023]
Article 20-2 (Notification of Details of Use and Provision of Personal Information)
(1) A personal information controller who meets the criteria prescribed by Presidential Decree shall regularly notify data subjects of the details of the use and provision of personal information collected under this Act or the method of accessing the information system through which such details can be confirmed: Provided, That the notification may be omitted where personal information that enables notifications to the data subject, such as contact information, has not been collected or retained.
(2) Matters necessary for the scope of data subjects subject to notification, information to be notified, frequency, method, etc. of notification under paragraph (1) shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제20조의2(개인정보 이용ㆍ제공 내역의 통지)
① 대통령령으로 정하는 기준에 해당하는 개인정보처리자는 이 법에 따라 수집한 개인정보의 이용ㆍ제공 내역이나 이용ㆍ제공 내역을 확인할 수 있는 정보시스템에 접속하는 방법을 주기적으로 정보주체에게 통지하여야 한다. 다만, 연락처 등 정보주체에게 통지할 수 있는 개인정보를 수집ㆍ보유하지 아니한 경우에는 통지하지 아니할 수 있다.
② 제1항에 따른 통지의 대상이 되는 정보주체의 범위, 통지 대상 정보, 통지 주기 및 방법 등에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 20-2 (Notification of Details of Use and Provision of Personal Information)
(1) A personal information controller who meets the criteria prescribed by Presidential Decree shall regularly notify data subjects of the details of the use and provision of personal information collected under this Act or the method of accessing the information system through which such details can be confirmed: Provided, That the notification may be omitted where personal information that enables notifications to the data subject, such as contact information, has not been collected or retained.
(2) Matters necessary for the scope of data subjects subject to notification, information to be notified, frequency, method, etc. of notification under paragraph (1) shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 21 (Destruction of Personal Information)
(1) A personal information controller shall destroy personal information without delay when the personal information becomes unnecessary owing to the expiry of the retention period, attainment of the purpose of processing the personal information, the expiry of the processing period of pseudonymized information, etc.: Provided, That this shall not apply where the retention of such personal information is mandatory by other statutes or regulations. <Amended on Mar. 14, 2023>
(2) When a personal information controller destroys personal information pursuant to paragraph (1), measures necessary to prevent recovery and revival shall be taken.
(3) Where a personal information controller is obliged to retain, rather than destroy, personal information pursuant to the proviso of paragraph (1), the relevant personal information or personal information files shall be stored and managed separately from other personal information.
(4) Other necessary matters, such as the methods to destroy personal information and its destruction process, shall be prescribed by Presidential Decree.
제21조(개인정보의 파기)
① 개인정보처리자는 보유기간의 경과, 개인정보의 처리 목적 달성, 가명정보의 처리 기간 경과 등 그 개인정보가 불필요하게 되었을 때에는 지체 없이 그 개인정보를 파기하여야 한다. 다만, 다른 법령에 따라 보존하여야 하는 경우에는 그러하지 아니하다. <개정 2023. 3. 14.>
② 개인정보처리자가 제1항에 따라 개인정보를 파기할 때에는 복구 또는 재생되지 아니하도록 조치하여야 한다.
③ 개인정보처리자가 제1항 단서에 따라 개인정보를 파기하지 아니하고 보존하여야 하는 경우에는 해당 개인정보 또는 개인정보파일을 다른 개인정보와 분리하여서 저장ㆍ관리하여야 한다.
④ 개인정보의 파기방법 및 절차 등에 필요한 사항은 대통령령으로 정한다.
Article 21 (Destruction of Personal Information)
(1) A personal information controller shall destroy personal information without delay when the personal information becomes unnecessary owing to the expiry of the retention period, attainment of the purpose of processing the personal information, the expiry of the processing period of pseudonymized information, etc.: Provided, That this shall not apply where the retention of such personal information is mandatory by other statutes or regulations. <Amended on Mar. 14, 2023>
(2) When a personal information controller destroys personal information pursuant to paragraph (1), measures necessary to prevent recovery and revival shall be taken.
(3) Where a personal information controller is obliged to retain, rather than destroy, personal information pursuant to the proviso of paragraph (1), the relevant personal information or personal information files shall be stored and managed separately from other personal information.
(4) Other necessary matters, such as the methods to destroy personal information and its destruction process, shall be prescribed by Presidential Decree.
Article 22 (Methods of Obtaining Consent)
(1) Where a personal information controller intends to obtain the consent of the data subject (including his or her legal representative as stated in Article 22-2 (1); hereafter in this Article the same shall apply) to the processing of his or her personal information, the personal information controller shall present the request for consent to the data subject in a clearly recognizable manner where each matter requiring consent is distinctly presented, and obtain his or her consent thereto. In such cases, the personal information controller shall categorize the matters requiring consent falling under the following subparagraphs and obtain consent, respectively. <Amended on Apr. 18, 2017; Mar. 14, 2023>
1. Where consent shall be obtained under Article 15 (1) 1;
2. Where consent shall be obtained under Article 17 (1) 1;
3. Where consent shall be obtained under Article 18 (2) 1;
4. Where consent shall be obtained under subparagraph 1 of Article 19;
5. Where consent shall be obtained under Article 23 (1) 1;
6. Where consent shall be obtained under Article 24 (1) 1;
7. Where the personal information controller intends to obtain consent to the processing of personal information in order to promote goods or services or solicit purchase thereof;
8. Other cases prescribed by Presidential Decree where it is necessary to obtain consent by categorizing the matters requiring consent to protect a data subject.
(2) Where a personal information controller obtains the consent under paragraph (1) in writing (including electronic documents under Article 2, subparagraph 1 of the Framework Act on Electronic Documents and Transactions), the personal information controller shall clearly specify important matters prescribed by Presidential Decree such as the purpose of collection and use of personal information and the items of personal information to be collected and used, in the manner prescribed by Notification of the Protection Commission, so as to make such matters easy to be understood. <Newly Inserted on Apr. 18, 2017; Jul. 26, 2017; Feb. 4, 2020>
(3) With respect to the personal information that can be processed without consent of the data subject, a personal information controller shall disclose the relevant items and legal basis for such processing under Article 30 (2) by separating such information from the personal information processed with consent of the data subject, or shall inform the data subject thereof by e-mail or any other means prescribed by Presidential Decree. In such cases, the burden of proof that personal information can be processed without consent shall be borne by the personal information controller. <Amended on Mar. 29, 2016; Apr. 18, 2017; Mar. 14, 2023>
(4) Deleted. <Mar. 14, 2023>
(5) A personal information controller shall not refuse to provide goods or services to a data subject on the grounds that the data subject would not consent to the matter eligible for selective consent, or would not consent pursuant to paragraph (1) 3 and 7. <Amended on Apr. 18, 2017; Mar. 14, 2023>
(6) Deleted. <Mar. 14, 2023>
(7) Except as provided in paragraphs (1) through (5), matters necessary for detailed methods to obtain the consent of data subjects shall be prescribed by Presidential Decree, in consideration of the collection media of personal information and other factors. <Amended on Apr. 18, 2017; Mar. 14, 2023>
제22조(동의를 받는 방법)
① 개인정보처리자는 이 법에 따른 개인정보의 처리에 대하여 정보주체(제22조의2제1항에 따른 법정대리인을 포함한다. 이하 이 조에서 같다)의 동의를 받을 때에는 각각의 동의 사항을 구분하여 정보주체가 이를 명확하게 인지할 수 있도록 알리고 동의를 받아야 한다. 이 경우 다음 각 호의 경우에는 동의 사항을 구분하여 각각 동의를 받아야 한다. <개정 2017. 4. 18., 2023. 3. 14.>
1. 제15조제1항제1호에 따라 동의를 받는 경우
2. 제17조제1항제1호에 따라 동의를 받는 경우
3. 제18조제2항제1호에 따라 동의를 받는 경우
4. 제19조제1호에 따라 동의를 받는 경우
5. 제23조제1항제1호에 따라 동의를 받는 경우
6. 제24조제1항제1호에 따라 동의를 받는 경우
7. 재화나 서비스를 홍보하거나 판매를 권유하기 위하여 개인정보의 처리에 대한 동의를 받으려는 경우
8. 그 밖에 정보주체를 보호하기 위하여 동의 사항을 구분하여 동의를 받아야 할 필요가 있는 경우로서 대통령령으로 정하는 경우
② 개인정보처리자는 제1항의 동의를 서면(「전자문서 및 전자거래 기본법」 제2조제1호에 따른 전자문서를 포함한다)으로 받을 때에는 개인정보의 수집ㆍ이용 목적, 수집ㆍ이용하려는 개인정보의 항목 등 대통령령으로 정하는 중요한 내용을 보호위원회가 고시로 정하는 방법에 따라 명확히 표시하여 알아보기 쉽게 하여야 한다. <신설 2017. 4. 18., 2017. 7. 26., 2020. 2. 4.>
③ 개인정보처리자는 정보주체의 동의 없이 처리할 수 있는 개인정보에 대해서는 그 항목과 처리의 법적 근거를 정보주체의 동의를 받아 처리하는 개인정보와 구분하여 제30조제2항에 따라 공개하거나 전자우편 등 대통령령으로 정하는 방법에 따라 정보주체에게 알려야 한다. 이 경우 동의 없이 처리할 수 있는 개인정보라는 입증책임은 개인정보처리자가 부담한다. <개정 2016. 3. 29., 2017. 4. 18., 2023. 3. 14.>
④ 삭제 <2023. 3. 14.>
⑤ 개인정보처리자는 정보주체가 선택적으로 동의할 수 있는 사항을 동의하지 아니하거나 제1항제3호 및 제7호에 따른 동의를 하지 아니한다는 이유로 정보주체에게 재화 또는 서비스의 제공을 거부하여서는 아니 된다. <개정 2017. 4. 18., 2023. 3. 14.>
⑥ 삭제 <2023. 3. 14.>
⑦ 제1항부터 제5항까지에서 규정한 사항 외에 정보주체의 동의를 받는 세부적인 방법에 관하여 필요한 사항은 개인정보의 수집매체 등을 고려하여 대통령령으로 정한다. <개정 2017. 4. 18., 2023. 3. 14.>
Article 22 (Methods of Obtaining Consent)
(1) Where a personal information controller intends to obtain the consent of the data subject (including his or her legal representative as stated in Article 22-2 (1); hereafter in this Article the same shall apply) to the processing of his or her personal information, the personal information controller shall present the request for consent to the data subject in a clearly recognizable manner where each matter requiring consent is distinctly presented, and obtain his or her consent thereto. In such cases, the personal information controller shall categorize the matters requiring consent falling under the following subparagraphs and obtain consent, respectively. <Amended on Apr. 18, 2017; Mar. 14, 2023>
1. Where consent shall be obtained under Article 15 (1) 1;
2. Where consent shall be obtained under Article 17 (1) 1;
3. Where consent shall be obtained under Article 18 (2) 1;
4. Where consent shall be obtained under subparagraph 1 of Article 19;
5. Where consent shall be obtained under Article 23 (1) 1;
6. Where consent shall be obtained under Article 24 (1) 1;
7. Where the personal information controller intends to obtain consent to the processing of personal information in order to promote goods or services or solicit purchase thereof;
8. Other cases prescribed by Presidential Decree where it is necessary to obtain consent by categorizing the matters requiring consent to protect a data subject.
(2) Where a personal information controller obtains the consent under paragraph (1) in writing (including electronic documents under Article 2, subparagraph 1 of the Framework Act on Electronic Documents and Transactions), the personal information controller shall clearly specify important matters prescribed by Presidential Decree such as the purpose of collection and use of personal information and the items of personal information to be collected and used, in the manner prescribed by Notification of the Protection Commission, so as to make such matters easy to be understood. <Newly Inserted on Apr. 18, 2017; Jul. 26, 2017; Feb. 4, 2020>
(3) With respect to the personal information that can be processed without consent of the data subject, a personal information controller shall disclose the relevant items and legal basis for such processing under Article 30 (2) by separating such information from the personal information processed with consent of the data subject, or shall inform the data subject thereof by e-mail or any other means prescribed by Presidential Decree. In such cases, the burden of proof that personal information can be processed without consent shall be borne by the personal information controller. <Amended on Mar. 29, 2016; Apr. 18, 2017; Mar. 14, 2023>
(4) Deleted. <Mar. 14, 2023>
(5) A personal information controller shall not refuse to provide goods or services to a data subject on the grounds that the data subject would not consent to the matter eligible for selective consent, or would not consent pursuant to paragraph (1) 3 and 7. <Amended on Apr. 18, 2017; Mar. 14, 2023>
(6) Deleted. <Mar. 14, 2023>
(7) Except as provided in paragraphs (1) through (5), matters necessary for detailed methods to obtain the consent of data subjects shall be prescribed by Presidential Decree, in consideration of the collection media of personal information and other factors. <Amended on Apr. 18, 2017; Mar. 14, 2023>
Article 22-2 (Protection of Children's Personal Information)
(1) When the consent of a child under 14 years of age is required to process the personal information of such child, a personal information controller shall obtain the consent of his or her legal representative and confirm whether the legal representative has granted consent.
(2) Notwithstanding paragraph (1), information prescribed by Presidential Decree as minimum information necessary for obtaining the consent of a legal representative may be collected directly from the relevant child without consent of the legal representative.
(3) A personal information controller shall, when notifying a child under 14 years of age of matters relating to the processing of personal information, use such a form and such a clear and plain language that the child can easily understand.
(4) Except as provided in paragraphs (1) through (3), matters necessary for the methods of obtaining consent and of obtaining confirmation of consent, etc., shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제22조의2(아동의 개인정보 보호)
① 개인정보처리자는 만 14세 미만 아동의 개인정보를 처리하기 위하여 이 법에 따른 동의를 받아야 할 때에는 그 법정대리인의 동의를 받아야 하며, 법정대리인이 동의하였는지를 확인하여야 한다.
② 제1항에도 불구하고 법정대리인의 동의를 받기 위하여 필요한 최소한의 정보로서 대통령령으로 정하는 정보는 법정대리인의 동의 없이 해당 아동으로부터 직접 수집할 수 있다.
③ 개인정보처리자는 만 14세 미만의 아동에게 개인정보 처리와 관련한 사항의 고지 등을 할 때에는 이해하기 쉬운 양식과 명확하고 알기 쉬운 언어를 사용하여야 한다.
④ 제1항부터 제3항까지에서 규정한 사항 외에 동의 및 동의 확인 방법 등에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 22-2 (Protection of Children's Personal Information)
(1) When the consent of a child under 14 years of age is required to process the personal information of such child, a personal information controller shall obtain the consent of his or her legal representative and confirm whether the legal representative has granted consent.
(2) Notwithstanding paragraph (1), information prescribed by Presidential Decree as minimum information necessary for obtaining the consent of a legal representative may be collected directly from the relevant child without consent of the legal representative.
(3) A personal information controller shall, when notifying a child under 14 years of age of matters relating to the processing of personal information, use such a form and such a clear and plain language that the child can easily understand.
(4) Except as provided in paragraphs (1) through (3), matters necessary for the methods of obtaining consent and of obtaining confirmation of consent, etc., shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
SECTION 2 Restriction on Processing of Personal Information
제2절 개인정보의 처리 제한
SECTION 2 Restriction on Processing of Personal Information
Article 23 (Restriction on Processing of Sensitive Information)
(1) A personal information controller shall not process any information prescribed by Presidential Decree (hereinafter referred to as “sensitive information”), including ideology, belief, admission to or withdrawal from a trade union or political party, political opinions, health, sex life, and other personal information that is likely to markedly threaten the privacy of any data subject: Provided, That this shall not apply in any of the following circumstances: <Amended on Mar. 29, 2016>
1. Where the personal information controller informs the data subject of the matters provided for in Article 15 (2) or 17 (2), and obtains the consent of the data subject apart from the consent to the processing of other personal information;
2. Where other statutes or regulations require or permit the processing of sensitive information.
(2) Where a personal information controller processes sensitive information pursuant to paragraph (1), the personal information controller shall take measures necessary to ensure safety pursuant to Article 29 so that the sensitive information may not be lost, stolen, divulged, forged, altered, or damaged. <Newly Inserted on Mar. 29, 2016>
(3) Where a personal information controller deems that there is a risk of privacy invasion because sensitive information of the data subject is included in the information disclosed in the course of the provision of goods or services, the personal information controller shall communicate to the data subject the possibility of disclosure of sensitive information and the method of selecting non-disclosure in an easily understandable manner before providing the goods or services. <Newly Inserted on Mar. 14, 2023>
제23조(민감정보의 처리 제한)
① 개인정보처리자는 사상ㆍ신념, 노동조합ㆍ정당의 가입ㆍ탈퇴, 정치적 견해, 건강, 성생활 등에 관한 정보, 그 밖에 정보주체의 사생활을 현저히 침해할 우려가 있는 개인정보로서 대통령령으로 정하는 정보(이하 “민감정보”라 한다)를 처리하여서는 아니 된다. 다만, 다음 각 호의 어느 하나에 해당하는 경우에는 그러하지 아니하다. <개정 2016. 3. 29.>
1. 정보주체에게 제15조제2항 각 호 또는 제17조제2항 각 호의 사항을 알리고 다른 개인정보의 처리에 대한 동의와 별도로 동의를 받은 경우
2. 법령에서 민감정보의 처리를 요구하거나 허용하는 경우
② 개인정보처리자가 제1항 각 호에 따라 민감정보를 처리하는 경우에는 그 민감정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손되지 아니하도록 제29조에 따른 안전성 확보에 필요한 조치를 하여야 한다. <신설 2016. 3. 29.>
③ 개인정보처리자는 재화 또는 서비스를 제공하는 과정에서 공개되는 정보에 정보주체의 민감정보가 포함됨으로써 사생활 침해의 위험성이 있다고 판단하는 때에는 재화 또는 서비스의 제공 전에 민감정보의 공개 가능성 및 비공개를 선택하는 방법을 정보주체가 알아보기 쉽게 알려야 한다. <신설 2023. 3. 14.>
Article 23 (Restriction on Processing of Sensitive Information)
(1) A personal information controller shall not process any information prescribed by Presidential Decree (hereinafter referred to as “sensitive information”), including ideology, belief, admission to or withdrawal from a trade union or political party, political opinions, health, sex life, and other personal information that is likely to markedly threaten the privacy of any data subject: Provided, That this shall not apply in any of the following circumstances: <Amended on Mar. 29, 2016>
1. Where the personal information controller informs the data subject of the matters provided for in Article 15 (2) or 17 (2), and obtains the consent of the data subject apart from the consent to the processing of other personal information;
2. Where other statutes or regulations require or permit the processing of sensitive information.
(2) Where a personal information controller processes sensitive information pursuant to paragraph (1), the personal information controller shall take measures necessary to ensure safety pursuant to Article 29 so that the sensitive information may not be lost, stolen, divulged, forged, altered, or damaged. <Newly Inserted on Mar. 29, 2016>
(3) Where a personal information controller deems that there is a risk of privacy invasion because sensitive information of the data subject is included in the information disclosed in the course of the provision of goods or services, the personal information controller shall communicate to the data subject the possibility of disclosure of sensitive information and the method of selecting non-disclosure in an easily understandable manner before providing the goods or services. <Newly Inserted on Mar. 14, 2023>
Article 24 (Restriction on Processing of Personally Identifiable Information)
(1) A personal information controller shall not process any information prescribed by Presidential Decree that can be used to identify an individual in accordance with statutes or regulations (hereinafter referred to as "personally identifiable information"), except in any of the following cases:
1. Where the personal information controller informs a data subject of the matters provided for in Article 15 (2) or 17 (2), and obtains the consent of the data subject apart from the consent to the processing of other personal information;
2. Where other statutes or regulations specifically require or permit the processing of unique identification information.
(2) Deleted. <Aug. 6, 2013>
(3) Where a personal information controller processes personally identifiable information pursuant to paragraph (1), the personal information controller shall take measures necessary to ensure safety, including encryption, as prescribed by Presidential Decree, so that the personally identifiable information may not be lost, stolen, divulged, forged, altered, or damaged. <Amended on Jul. 24, 2015>
(4) The Protection Commission shall regularly inspect whether a personal information controller meeting the criteria prescribed by Presidential Decree taking into account the types and amount of processed personal information, number of employees, amount of sales, etc., has taken the measures necessary to ensure safety pursuant to paragraph (3), as prescribed by Presidential Decree. <Newly Inserted on Mar. 29, 2016; Jul. 26, 2017; Feb. 4, 2020>
(5) The Protection Commission may authorize specialized institutions prescribed by Presidential Decree to conduct the inspection referred to in paragraph (4). <Newly Inserted on Mar. 29, 2016; Jul. 26, 2017; Feb. 4, 2020>
제24조(고유식별정보의 처리 제한)
① 개인정보처리자는 다음 각 호의 경우를 제외하고는 법령에 따라 개인을 고유하게 구별하기 위하여 부여된 식별정보로서 대통령령으로 정하는 정보(이하 “고유식별정보”라 한다)를 처리할 수 없다.
1. 정보주체에게 제15조제2항 각 호 또는 제17조제2항 각 호의 사항을 알리고 다른 개인정보의 처리에 대한 동의와 별도로 동의를 받은 경우
2. 법령에서 구체적으로 고유식별정보의 처리를 요구하거나 허용하는 경우
② 삭제 <2013. 8. 6.>
③ 개인정보처리자가 제1항 각 호에 따라 고유식별정보를 처리하는 경우에는 그 고유식별정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손되지 아니하도록 대통령령으로 정하는 바에 따라 암호화 등 안전성 확보에 필요한 조치를 하여야 한다. <개정 2015. 7. 24.>
④ 보호위원회는 처리하는 개인정보의 종류ㆍ규모, 종업원 수 및 매출액 규모 등을 고려하여 대통령령으로 정하는 기준에 해당하는 개인정보처리자가 제3항에 따라 안전성 확보에 필요한 조치를 하였는지에 관하여 대통령령으로 정하는 바에 따라 정기적으로 조사하여야 한다. <신설 2016. 3. 29., 2017. 7. 26., 2020. 2. 4.>
⑤ 보호위원회는 대통령령으로 정하는 전문기관으로 하여금 제4항에 따른 조사를 수행하게 할 수 있다. <신설 2016. 3. 29., 2017. 7. 26., 2020. 2. 4.>
Article 24 (Restriction on Processing of Personally Identifiable Information)
(1) A personal information controller shall not process any information prescribed by Presidential Decree that can be used to identify an individual in accordance with statutes or regulations (hereinafter referred to as "personally identifiable information"), except in any of the following cases:
1. Where the personal information controller informs a data subject of the matters provided for in Article 15 (2) or 17 (2), and obtains the consent of the data subject apart from the consent to the processing of other personal information;
2. Where other statutes or regulations specifically require or permit the processing of unique identification information.
(2) Deleted. <Aug. 6, 2013>
(3) Where a personal information controller processes personally identifiable information pursuant to paragraph (1), the personal information controller shall take measures necessary to ensure safety, including encryption, as prescribed by Presidential Decree, so that the personally identifiable information may not be lost, stolen, divulged, forged, altered, or damaged. <Amended on Jul. 24, 2015>
(4) The Protection Commission shall regularly inspect whether a personal information controller meeting the criteria prescribed by Presidential Decree taking into account the types and amount of processed personal information, number of employees, amount of sales, etc., has taken the measures necessary to ensure safety pursuant to paragraph (3), as prescribed by Presidential Decree. <Newly Inserted on Mar. 29, 2016; Jul. 26, 2017; Feb. 4, 2020>
(5) The Protection Commission may authorize specialized institutions prescribed by Presidential Decree to conduct the inspection referred to in paragraph (4). <Newly Inserted on Mar. 29, 2016; Jul. 26, 2017; Feb. 4, 2020>
Article 24-2 (Restriction on Processing of Resident Registration Numbers)
(1) Notwithstanding Article 24 (1), a personal information controller shall not process any resident registration number, except in any of the following cases: <Amended on Nov. 19, 2014; Mar. 29, 2016; Jul. 26, 2017; Feb. 4, 2020>
1. Where any Act, Presidential Decree, National Assembly Regulations, Supreme Court Regulations, Constitutional Court Regulations, National Election Commission Regulations or Board of Audit and Inspection Regulations specifically requires or permits the processing of resident registration numbers;
2. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
3. Where it is inevitable to process resident registration numbers in line with subparagraphs 1 and 2 in cases prescribed by Notification of the Protection Commission.
(2) Notwithstanding Article 24 (3), a personal information controller shall retain resident registration numbers in a safe manner by means of encryption so that the resident registration numbers may not be lost, stolen, divulged, forged, altered, or damaged. In such cases, any necessary matters in relation to the scope of encryption objects and encryption timing by object, etc. shall be prescribed by Presidential Decree, taking into account the amount of personal information processed, data breach impact, etc. <Newly Inserted on Mar. 24, 2014; Jul. 24, 2015>
(3) A personal information controller shall provide data subjects with an alternative sign-up tool without using their resident registration numbers in the stage of being admitted to membership via the website while processing the resident registration numbers pursuant to paragraph (1). <Amended on Mar. 24, 2014>
(4) The Protection Commission may prepare and support such measures as legislative arrangements, policy-making, necessary facilities, and systems build-up in order to support the provision of the measures provided for in paragraph (3). <Amended on Mar. 24, 2014; Jul. 26, 2017; Feb. 4, 2020>
[This Article Newly Inserted on Aug. 6, 2013]
제24조의2(주민등록번호 처리의 제한)
① 제24조제1항에도 불구하고 개인정보처리자는 다음 각 호의 어느 하나에 해당하는 경우를 제외하고는 주민등록번호를 처리할 수 없다. <개정 2014. 11. 19., 2016. 3. 29., 2017. 7. 26., 2020. 2. 4.>
1. 법률ㆍ대통령령ㆍ국회규칙ㆍ대법원규칙ㆍ헌법재판소규칙ㆍ중앙선거관리위원회규칙 및 감사원규칙에서 구체적으로 주민등록번호의 처리를 요구하거나 허용한 경우
2. 정보주체 또는 제3자의 급박한 생명, 신체, 재산의 이익을 위하여 명백히 필요하다고 인정되는 경우
3. 제1호 및 제2호에 준하여 주민등록번호 처리가 불가피한 경우로서 보호위원회가 고시로 정하는 경우
② 개인정보처리자는 제24조제3항에도 불구하고 주민등록번호가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손되지 아니하도록 암호화 조치를 통하여 안전하게 보관하여야 한다. 이 경우 암호화 적용 대상 및 대상별 적용 시기 등에 관하여 필요한 사항은 개인정보의 처리 규모와 유출 시 영향 등을 고려하여 대통령령으로 정한다. <신설 2014. 3. 24., 2015. 7. 24.>
③ 개인정보처리자는 제1항 각 호에 따라 주민등록번호를 처리하는 경우에도 정보주체가 인터넷 홈페이지를 통하여 회원으로 가입하는 단계에서는 주민등록번호를 사용하지 아니하고도 회원으로 가입할 수 있는 방법을 제공하여야 한다. <개정 2014. 3. 24.>
④ 보호위원회는 개인정보처리자가 제3항에 따른 방법을 제공할 수 있도록 관계 법령의 정비, 계획의 수립, 필요한 시설 및 시스템의 구축 등 제반 조치를 마련ㆍ지원할 수 있다. <개정 2014. 3. 24., 2017. 7. 26., 2020. 2. 4.>
[본조신설 2013. 8. 6.]
Article 24-2 (Restriction on Processing of Resident Registration Numbers)
(1) Notwithstanding Article 24 (1), a personal information controller shall not process any resident registration number, except in any of the following cases: <Amended on Nov. 19, 2014; Mar. 29, 2016; Jul. 26, 2017; Feb. 4, 2020>
1. Where any Act, Presidential Decree, National Assembly Regulations, Supreme Court Regulations, Constitutional Court Regulations, National Election Commission Regulations or Board of Audit and Inspection Regulations specifically requires or permits the processing of resident registration numbers;
2. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
3. Where it is inevitable to process resident registration numbers in line with subparagraphs 1 and 2 in cases prescribed by Notification of the Protection Commission.
(2) Notwithstanding Article 24 (3), a personal information controller shall retain resident registration numbers in a safe manner by means of encryption so that the resident registration numbers may not be lost, stolen, divulged, forged, altered, or damaged. In such cases, any necessary matters in relation to the scope of encryption objects and encryption timing by object, etc. shall be prescribed by Presidential Decree, taking into account the amount of personal information processed, data breach impact, etc. <Newly Inserted on Mar. 24, 2014; Jul. 24, 2015>
(3) A personal information controller shall provide data subjects with an alternative sign-up tool without using their resident registration numbers in the stage of being admitted to membership via the website while processing the resident registration numbers pursuant to paragraph (1). <Amended on Mar. 24, 2014>
(4) The Protection Commission may prepare and support such measures as legislative arrangements, policy-making, necessary facilities, and systems build-up in order to support the provision of the measures provided for in paragraph (3). <Amended on Mar. 24, 2014; Jul. 26, 2017; Feb. 4, 2020>
[This Article Newly Inserted on Aug. 6, 2013]
Article 25 (Restriction on Installation and Operation of Fixed Visual Data Processing Devices)
(1) No one shall install and operate any fixed visual data processing device at open places, except in any of the following cases: <Amended on Mar. 14, 2023>
1. Where specifically allowed by statutes or regulations;
2. Where it is necessary for the prevention and investigation of crimes;
3. Where a person with legitimate authority installs and operates such device for the safety and management of facilities and prevention of fire;
4. Where a person with legitimate authority installs and operates such device for traffic enforcement;
5. Where a person with legitimate authority installs and operates such device for the collection, analysis, and provision of traffic information;
6. Cases prescribed by Presidential Decree, where the photographed image information is not stored.
(2) No one shall install and operate any fixed visual data processing device to look into the places which are likely to noticeably threaten individual privacy, such as a bathroom, restroom, sauna, and dressing room used by many unspecified persons: Provided, That this shall not apply to the facilities prescribed by Presidential Decree, which are used to detain or protect persons in accordance with statutes or regulations, such as correctional institutions and mental health care centers. <Amended on Mar. 14, 2023>
(3) The head of a public institution who intends to install and operate fixed visual data processing devices pursuant to the subparagraphs of paragraph (1) and a person who intends to install and operate fixed visual data processing devices pursuant to the proviso of paragraph (2) shall gather opinions of relevant specialist and interested persons through the procedures prescribed by Presidential Decree such as public hearings and information sessions. <Amended on Mar. 14, 2023>
(4) A person who installs and operates fixed visual data processing devices pursuant to the subparagraphs of paragraph (1) (hereinafter referred to as “fixed visual data processing device operator”) shall take necessary measures including posting on a signboard the following matters, so that data subjects may easily recognize such devices: Provided, That this shall not apply to military installations defined in subparagraph 2 of Article 2 of the Protection of Military Bases and Installations Act, important national facilities defined in subparagraph 13 of Article 2 of the United Defense Act, and other facilities prescribed by Presidential Decree: <Amended on Mar. 29, 2016; Mar. 14, 2023>
1. The purpose and place of installation;
2. The scope and hours of photographing;
3. The contact information of the person in charge of its management;
4. Other matters prescribed by Presidential Decree.
(5) A fixed visual data processing device operator shall neither arbitrarily manipulate a fixed visual data processing device for purposes other than those for which the device was installed, nor direct the device toward different spots, nor use sound recording functions. <Amended on Mar. 14, 2023>
(6) A fixed visual data processing device operator shall take measures necessary to ensure safety pursuant to Article 29 to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged. <Amended on Jul. 24, 2015; Mar. 14, 2023>
(7) A fixed visual data processing device operator shall establish an appropriate policy to operate and manage the fixed visual data processing devices, as prescribed by Presidential Decree: Provided, That the fixed visual data processing device operator need not formulate a policy to operate and manage the fixed visual data processing devices if he or she has included matters regarding the operation and management of fixed visual data processing devices when formulating the Privacy Policy under Article 30. <Amended on Mar. 14, 2023>
(8) A fixed visual data processing device operator may entrust the business affairs regarding the installation and operation of fixed visual data processing devices to a third party: Provided, That public institutions shall comply with the procedures and requirements prescribed by Presidential Decree when entrusting the business affairs regarding the installation and operation of fixed visual data processing devices to a third party. <Amended on Mar. 14, 2023>
[Title Amended on Mar. 14, 2023]
제25조(고정형 영상정보처리기기의 설치ㆍ운영 제한)
① 누구든지 다음 각 호의 경우를 제외하고는 공개된 장소에 고정형 영상정보처리기기를 설치ㆍ운영하여서는 아니 된다. <개정 2023. 3. 14.>
1. 법령에서 구체적으로 허용하고 있는 경우
2. 범죄의 예방 및 수사를 위하여 필요한 경우
3. 시설의 안전 및 관리, 화재 예방을 위하여 정당한 권한을 가진 자가 설치ㆍ운영하는 경우
4. 교통단속을 위하여 정당한 권한을 가진 자가 설치ㆍ운영하는 경우
5. 교통정보의 수집ㆍ분석 및 제공을 위하여 정당한 권한을 가진 자가 설치ㆍ운영하는 경우
6. 촬영된 영상정보를 저장하지 아니하는 경우로서 대통령령으로 정하는 경우
② 누구든지 불특정 다수가 이용하는 목욕실, 화장실, 발한실(發汗室), 탈의실 등 개인의 사생활을 현저히 침해할 우려가 있는 장소의 내부를 볼 수 있도록 고정형 영상정보처리기기를 설치ㆍ운영하여서는 아니 된다. 다만, 교도소, 정신보건 시설 등 법령에 근거하여 사람을 구금하거나 보호하는 시설로서 대통령령으로 정하는 시설에 대하여는 그러하지 아니하다. <개정 2023. 3. 14.>
③ 제1항 각 호에 따라 고정형 영상정보처리기기를 설치ㆍ운영하려는 공공기관의 장과 제2항 단서에 따라 고정형 영상정보처리기기를 설치ㆍ운영하려는 자는 공청회ㆍ설명회의 개최 등 대통령령으로 정하는 절차를 거쳐 관계 전문가 및 이해관계인의 의견을 수렴하여야 한다. <개정 2023. 3. 14.>
④ 제1항 각 호에 따라 고정형 영상정보처리기기를 설치ㆍ운영하는 자(이하 “고정형영상정보처리기기운영자”라 한다)는 정보주체가 쉽게 인식할 수 있도록 다음 각 호의 사항이 포함된 안내판을 설치하는 등 필요한 조치를 하여야 한다. 다만, 「군사기지 및 군사시설 보호법」 제2조제2호에 따른 군사시설, 「통합방위법」 제2조제13호에 따른 국가중요시설, 그 밖에 대통령령으로 정하는 시설의 경우에는 그러하지 아니하다. <개정 2016. 3. 29., 2023. 3. 14.>
1. 설치 목적 및 장소
2. 촬영 범위 및 시간
3. 관리책임자의 연락처
4. 그 밖에 대통령령으로 정하는 사항
⑤ 고정형영상정보처리기기운영자는 고정형 영상정보처리기기의 설치 목적과 다른 목적으로 고정형 영상정보처리기기를 임의로 조작하거나 다른 곳을 비춰서는 아니 되며, 녹음기능은 사용할 수 없다. <개정 2023. 3. 14.>
⑥ 고정형영상정보처리기기운영자는 개인정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손되지 아니하도록 제29조에 따라 안전성 확보에 필요한 조치를 하여야 한다. <개정 2015. 7. 24., 2023. 3. 14.>
⑦ 고정형영상정보처리기기운영자는 대통령령으로 정하는 바에 따라 고정형 영상정보처리기기 운영ㆍ관리 방침을 마련하여야 한다. 다만, 제30조에 따른 개인정보 처리방침을 정할 때 고정형 영상정보처리기기 운영ㆍ관리에 관한 사항을 포함시킨 경우에는 고정형 영상정보처리기기 운영ㆍ관리 방침을 마련하지 아니할 수 있다. <개정 2023. 3. 14.>
⑧ 고정형영상정보처리기기운영자는 고정형 영상정보처리기기의 설치ㆍ운영에 관한 사무를 위탁할 수 있다. 다만, 공공기관이 고정형 영상정보처리기기 설치ㆍ운영에 관한 사무를 위탁하는 경우에는 대통령령으로 정하는 절차 및 요건에 따라야 한다. <개정 2023. 3. 14.>
[제목개정 2023. 3. 14.]
Article 25 (Restriction on Installation and Operation of Fixed Visual Data Processing Devices)
(1) No one shall install and operate any fixed visual data processing device at open places, except in any of the following cases: <Amended on Mar. 14, 2023>
1. Where specifically allowed by statutes or regulations;
2. Where it is necessary for the prevention and investigation of crimes;
3. Where a person with legitimate authority installs and operates such device for the safety and management of facilities and prevention of fire;
4. Where a person with legitimate authority installs and operates such device for traffic enforcement;
5. Where a person with legitimate authority installs and operates such device for the collection, analysis, and provision of traffic information;
6. Cases prescribed by Presidential Decree, where the photographed image information is not stored.
(2) No one shall install and operate any fixed visual data processing device to look into the places which are likely to noticeably threaten individual privacy, such as a bathroom, restroom, sauna, and dressing room used by many unspecified persons: Provided, That this shall not apply to the facilities prescribed by Presidential Decree, which are used to detain or protect persons in accordance with statutes or regulations, such as correctional institutions and mental health care centers. <Amended on Mar. 14, 2023>
(3) The head of a public institution who intends to install and operate fixed visual data processing devices pursuant to the subparagraphs of paragraph (1) and a person who intends to install and operate fixed visual data processing devices pursuant to the proviso of paragraph (2) shall gather opinions of relevant specialist and interested persons through the procedures prescribed by Presidential Decree such as public hearings and information sessions. <Amended on Mar. 14, 2023>
(4) A person who installs and operates fixed visual data processing devices pursuant to the subparagraphs of paragraph (1) (hereinafter referred to as “fixed visual data processing device operator”) shall take necessary measures including posting on a signboard the following matters, so that data subjects may easily recognize such devices: Provided, That this shall not apply to military installations defined in subparagraph 2 of Article 2 of the Protection of Military Bases and Installations Act, important national facilities defined in subparagraph 13 of Article 2 of the United Defense Act, and other facilities prescribed by Presidential Decree: <Amended on Mar. 29, 2016; Mar. 14, 2023>
1. The purpose and place of installation;
2. The scope and hours of photographing;
3. The contact information of the person in charge of its management;
4. Other matters prescribed by Presidential Decree.
(5) A fixed visual data processing device operator shall neither arbitrarily manipulate a fixed visual data processing device for purposes other than those for which the device was installed, nor direct the device toward different spots, nor use sound recording functions. <Amended on Mar. 14, 2023>
(6) A fixed visual data processing device operator shall take measures necessary to ensure safety pursuant to Article 29 to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged. <Amended on Jul. 24, 2015; Mar. 14, 2023>
(7) A fixed visual data processing device operator shall establish an appropriate policy to operate and manage the fixed visual data processing devices, as prescribed by Presidential Decree: Provided, That the fixed visual data processing device operator need not formulate a policy to operate and manage the fixed visual data processing devices if he or she has included matters regarding the operation and management of fixed visual data processing devices when formulating the Privacy Policy under Article 30. <Amended on Mar. 14, 2023>
(8) A fixed visual data processing device operator may entrust the business affairs regarding the installation and operation of fixed visual data processing devices to a third party: Provided, That public institutions shall comply with the procedures and requirements prescribed by Presidential Decree when entrusting the business affairs regarding the installation and operation of fixed visual data processing devices to a third party. <Amended on Mar. 14, 2023>
[Title Amended on Mar. 14, 2023]
Article 25-2 (Restriction on Operation of Mobile Visual Data Processing Devices)
(1) A person who intends to operate a mobile visual data processing device for work purposes shall not take photographs (limited to cases falling within the scope of personal information; hereinafter the same shall apply) of a person or things related to such person at public places, except in the following cases:
1. In any of the cases falling under any subparagraph of Article 15 (1);
2. Where the data subject fails to express his or her intention to refuse to be photographed, although the fact of photographing is clearly stated to inform the data subject; in such cases, it shall be limited to cases where it is unlikely to unduly infringe upon the right of a data subject and where it does not exceed reasonable limits;
3. Other cases prescribed by Presidential Decree, corresponding to those referred to in subparagraphs 1 and 2.
(2) No one shall take photographs of a person or things related to such person through a mobile visual data processing device at a place used by many unspecified persons where an individual's privacy could be significantly compromised, such as a bathroom, toilet, sauna, and changing room: Provided, That this shall not apply to cases prescribed by Presidential Decree, where it is necessary for lifesaving and first-aid services.
(3) Where a person or thing related to such person is photographed with a portable visual data processing device in cases falling under the subparagraphs of paragraph (1), the fact of photographing shall be indicated and notified as prescribed by Presidential Decree, by such means as light, sound, and signboard.
(4) Except as provided in paragraphs (1) through (3), Article 25 (6) through (8) shall apply mutatis mutandis to the operation of mobile visual data processing devices.
[This Article Newly Inserted on Mar. 14, 2023]
제25조의2(이동형 영상정보처리기기의 운영 제한)
① 업무를 목적으로 이동형 영상정보처리기기를 운영하려는 자는 다음 각 호의 경우를 제외하고는 공개된 장소에서 이동형 영상정보처리기기로 사람 또는 그 사람과 관련된 사물의 영상(개인정보에 해당하는 경우로 한정한다. 이하 같다)을 촬영하여서는 아니 된다.
1. 제15조제1항 각 호의 어느 하나에 해당하는 경우
2. 촬영 사실을 명확히 표시하여 정보주체가 촬영 사실을 알 수 있도록 하였음에도 불구하고 촬영 거부 의사를 밝히지 아니한 경우. 이 경우 정보주체의 권리를 부당하게 침해할 우려가 없고 합리적인 범위를 초과하지 아니하는 경우로 한정한다.
3. 그 밖에 제1호 및 제2호에 준하는 경우로서 대통령령으로 정하는 경우
② 누구든지 불특정 다수가 이용하는 목욕실, 화장실, 발한실, 탈의실 등 개인의 사생활을 현저히 침해할 우려가 있는 장소의 내부를 볼 수 있는 곳에서 이동형 영상정보처리기기로 사람 또는 그 사람과 관련된 사물의 영상을 촬영하여서는 아니 된다. 다만, 인명의 구조ㆍ구급 등을 위하여 필요한 경우로서 대통령령으로 정하는 경우에는 그러하지 아니하다.
③ 제1항 각 호에 해당하여 이동형 영상정보처리기기로 사람 또는 그 사람과 관련된 사물의 영상을 촬영하는 경우에는 불빛, 소리, 안내판 등 대통령령으로 정하는 바에 따라 촬영 사실을 표시하고 알려야 한다.
④ 제1항부터 제3항까지에서 규정한 사항 외에 이동형 영상정보처리기기의 운영에 관하여는 제25조제6항부터 제8항까지의 규정을 준용한다.
[본조신설 2023. 3. 14.]
Article 25-2 (Restriction on Operation of Mobile Visual Data Processing Devices)
(1) A person who intends to operate a mobile visual data processing device for work purposes shall not take photographs (limited to cases falling within the scope of personal information; hereinafter the same shall apply) of a person or things related to such person at public places, except in the following cases:
1. In any of the cases falling under any subparagraph of Article 15 (1);
2. Where the data subject fails to express his or her intention to refuse to be photographed, although the fact of photographing is clearly stated to inform the data subject; in such cases, it shall be limited to cases where it is unlikely to unduly infringe upon the right of a data subject and where it does not exceed reasonable limits;
3. Other cases prescribed by Presidential Decree, corresponding to those referred to in subparagraphs 1 and 2.
(2) No one shall take photographs of a person or things related to such person through a mobile visual data processing device at a place used by many unspecified persons where an individual's privacy could be significantly compromised, such as a bathroom, toilet, sauna, and changing room: Provided, That this shall not apply to cases prescribed by Presidential Decree, where it is necessary for lifesaving and first-aid services.
(3) Where a person or thing related to such person is photographed with a portable visual data processing device in cases falling under the subparagraphs of paragraph (1), the fact of photographing shall be indicated and notified as prescribed by Presidential Decree, by such means as light, sound, and signboard.
(4) Except as provided in paragraphs (1) through (3), Article 25 (6) through (8) shall apply mutatis mutandis to the operation of mobile visual data processing devices.
[This Article Newly Inserted on Mar. 14, 2023]
Article 26 (Restriction on Personal Information Processing Subsequent to Entrustment of Work)
(1) A personal information controller shall, when entrusting the processing of personal information to a third party, do so in a document that states the following: <Amended on Mar. 14, 2023>
1. Prevention of personal information processing for other purposes than performing the entrusted work;
2. Technical and managerial safeguards of personal information;
3. Other matters prescribed by Presidential Decree to ensure safe management of personal information.
(2) A personal information controller who entrusts the processing of personal information pursuant to paragraph (1) (hereinafter referred to as "person entrusting") shall disclose the details of the entrusted affairs and the entity that processes personal information (including a third party re-entrusted from a person entrusted with the processing of personal information; hereinafter referred to as “person entrusted”) in the manner prescribed by Presidential Decree so as to be easily recognizable by data subjects at any time. <Amended on Mar. 14, 2023>
(3) The person entrusting shall, in case of entrusting the promotion of goods or services, or soliciting of sales thereof, notify data subjects of the entrusted work and the person entrusted in the manners prescribed by Presidential Decree. The same shall apply where the entrusted work or the person entrusted has been changed.
(4) The person entrusting shall educate the person entrusted so that personal information of data subjects may not be lost, stolen, divulged, forged, altered, or damaged owing to the outsourcing of work, and supervise how the person entrusted processes such personal information safely by inspecting the status of processing, etc., as prescribed by Presidential Decree. <Amended on Jul. 24, 2015>
(5) An person entrusted shall not use any personal information beyond the scope of the work entrusted by the personal information controller, nor provide personal information to a third party.
(6) A person entrusted shall, when he or she intends to re-entrust the processing of entrusted personal information to a third party, obtain consent from the person entrusting. <Newly Inserted on Mar. 14, 2023>
(7) With respect to liability for damages arising out of the processing of personal information entrusted to an person entrusted in violation of this Act, the person entrusted shall be deemed an employee of the personal information controller. <Amended on Mar. 14, 2023>
(8) Articles 15 through 18, 21, 22, 22-2, 23, 24, 24-2, 25, 25-2, 27, 28, 28-2 through 28-5, 28-7 through 28-11, 29, 30, 30-2, 31, 33, 34, 34-2, 35, 35-2, 36, 37, 37-2, 38, 59, 63, 63-2, and 64-2 shall apply mutatis mutandis to outsourcees. In such cases, "personal information controller" shall be construed as "person entrusted". <Amended on Mar. 14, 2023>
제26조(업무위탁에 따른 개인정보의 처리 제한)
① 개인정보처리자가 제3자에게 개인정보의 처리 업무를 위탁하는 경우에는 다음 각 호의 내용이 포함된 문서로 하여야 한다. <개정 2023. 3. 14.>
1. 위탁업무 수행 목적 외 개인정보의 처리 금지에 관한 사항
2. 개인정보의 기술적ㆍ관리적 보호조치에 관한 사항
3. 그 밖에 개인정보의 안전한 관리를 위하여 대통령령으로 정한 사항
② 제1항에 따라 개인정보의 처리 업무를 위탁하는 개인정보처리자(이하 “위탁자”라 한다)는 위탁하는 업무의 내용과 개인정보 처리 업무를 위탁받아 처리하는 자(개인정보 처리 업무를 위탁받아 처리하는 자로부터 위탁받은 업무를 다시 위탁받은 제3자를 포함하며, 이하 “수탁자”라 한다)를 정보주체가 언제든지 쉽게 확인할 수 있도록 대통령령으로 정하는 방법에 따라 공개하여야 한다. <개정 2023. 3. 14.>
③ 위탁자가 재화 또는 서비스를 홍보하거나 판매를 권유하는 업무를 위탁하는 경우에는 대통령령으로 정하는 방법에 따라 위탁하는 업무의 내용과 수탁자를 정보주체에게 알려야 한다. 위탁하는 업무의 내용이나 수탁자가 변경된 경우에도 또한 같다.
④ 위탁자는 업무 위탁으로 인하여 정보주체의 개인정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손되지 아니하도록 수탁자를 교육하고, 처리 현황 점검 등 대통령령으로 정하는 바에 따라 수탁자가 개인정보를 안전하게 처리하는지를 감독하여야 한다. <개정 2015. 7. 24.>
⑤ 수탁자는 개인정보처리자로부터 위탁받은 해당 업무 범위를 초과하여 개인정보를 이용하거나 제3자에게 제공하여서는 아니 된다.
⑥ 수탁자는 위탁받은 개인정보의 처리 업무를 제3자에게 다시 위탁하려는 경우에는 위탁자의 동의를 받아야 한다. <신설 2023. 3. 14.>
⑦ 수탁자가 위탁받은 업무와 관련하여 개인정보를 처리하는 과정에서 이 법을 위반하여 발생한 손해배상책임에 대하여는 수탁자를 개인정보처리자의 소속 직원으로 본다. <개정 2023. 3. 14.>
⑧ 수탁자에 관하여는 제15조부터 제18조까지, 제21조, 제22조, 제22조의2, 제23조, 제24조, 제24조의2, 제25조, 제25조의2, 제27조, 제28조, 제28조의2부터 제28조의5까지, 제28조의7부터 제28조의11까지, 제29조, 제30조, 제30조의2, 제31조, 제33조, 제34조, 제34조의2, 제35조, 제35조의2, 제36조, 제37조, 제37조의2, 제38조, 제59조, 제63조, 제63조의2 및 제64조의2를 준용한다. 이 경우 “개인정보처리자”는 “수탁자”로 본다. <개정 2023. 3. 14.>
Article 26 (Restriction on Personal Information Processing Subsequent to Entrustment of Work)
(1) A personal information controller shall, when entrusting the processing of personal information to a third party, do so in a document that states the following: <Amended on Mar. 14, 2023>
1. Prevention of personal information processing for other purposes than performing the entrusted work;
2. Technical and managerial safeguards of personal information;
3. Other matters prescribed by Presidential Decree to ensure safe management of personal information.
(2) A personal information controller who entrusts the processing of personal information pursuant to paragraph (1) (hereinafter referred to as "person entrusting") shall disclose the details of the entrusted affairs and the entity that processes personal information (including a third party re-entrusted from a person entrusted with the processing of personal information; hereinafter referred to as “person entrusted”) in the manner prescribed by Presidential Decree so as to be easily recognizable by data subjects at any time. <Amended on Mar. 14, 2023>
(3) The person entrusting shall, in case of entrusting the promotion of goods or services, or soliciting of sales thereof, notify data subjects of the entrusted work and the person entrusted in the manners prescribed by Presidential Decree. The same shall apply where the entrusted work or the person entrusted has been changed.
(4) The person entrusting shall educate the person entrusted so that personal information of data subjects may not be lost, stolen, divulged, forged, altered, or damaged owing to the outsourcing of work, and supervise how the person entrusted processes such personal information safely by inspecting the status of processing, etc., as prescribed by Presidential Decree. <Amended on Jul. 24, 2015>
(5) A person entrusted shall not use any personal information beyond the scope of the work entrusted by the personal information controller, nor provide personal information to a third party.
(6) A person entrusted shall, when he or she intends to re-entrust the processing of entrusted personal information to a third party, obtain consent from the person entrusting. <Newly Inserted on Mar. 14, 2023>
(7) With respect to liability for damages arising out of the processing of personal information entrusted to a person entrusted in violation of this Act, the person entrusted shall be deemed an employee of the personal information controller. <Amended on Mar. 14, 2023>
(8) Articles 15 through 18, 21, 22, 22-2, 23, 24, 24-2, 25, 25-2, 27, 28, 28-2 through 28-5, 28-7 through 28-11, 29, 30, 30-2, 31, 33, 34, 34-2, 35, 35-2, 36, 37, 37-2, 38, 59, 63, 63-2, and 64-2 shall apply mutatis mutandis to outsourcees. In such cases, "personal information controller" shall be construed as "person entrusted". <Amended on Mar. 14, 2023>
Article 27 (Restriction on Transfer of Personal Information following Business Transfer)
(1) A personal information controller shall notify in advance the data subjects of the following matters in the manner prescribed by Presidential Decree in the case of transfer of personal information to a third party owing to the transfer of some or all of his or her business, a merger, etc.:
1. The fact that the personal information will be transferred;
2. The name (referring to the company name in case of a legal person), address, telephone number and other contact information of the recipient of the personal information (hereinafter referred to as “business transferee, etc.”);
3. The method and procedure for withdrawing consent if the data subject does not wish his or her personal information to be transferred.
(2) Upon receiving personal information, the business transferee, etc. shall, without delay, notify data subjects of the fact in the manner prescribed by Presidential Decree: Provided, That this shall not apply where the personal information controller has already notified the data subjects of the fact of such transfer pursuant to paragraph (1).
(3) Upon receiving personal information owing to business transferee, etc., a merger, etc., the business transferee may use, or provide a third party with, the personal information only for the initial purposes dating to the time of the transfer. In such cases, the business transferee shall be deemed the personal information controller.
제27조(영업양도 등에 따른 개인정보의 이전 제한)
① 개인정보처리자는 영업의 전부 또는 일부의 양도ㆍ합병 등으로 개인정보를 다른 사람에게 이전하는 경우에는 미리 다음 각 호의 사항을 대통령령으로 정하는 방법에 따라 해당 정보주체에게 알려야 한다.
1. 개인정보를 이전하려는 사실
2. 개인정보를 이전받는 자(이하 “영업양수자등”이라 한다)의 성명(법인의 경우에는 법인의 명칭을 말한다), 주소, 전화번호 및 그 밖의 연락처
3. 정보주체가 개인정보의 이전을 원하지 아니하는 경우 조치할 수 있는 방법 및 절차
② 영업양수자등은 개인정보를 이전받았을 때에는 지체 없이 그 사실을 대통령령으로 정하는 방법에 따라 정보주체에게 알려야 한다. 다만, 개인정보처리자가 제1항에 따라 그 이전 사실을 이미 알린 경우에는 그러하지 아니하다.
③ 영업양수자등은 영업의 양도ㆍ합병 등으로 개인정보를 이전받은 경우에는 이전 당시의 본래 목적으로만 개인정보를 이용하거나 제3자에게 제공할 수 있다. 이 경우 영업양수자등은 개인정보처리자로 본다.
Article 27 (Restriction on Transfer of Personal Information following Business Transfer)
(1) A personal information controller shall notify in advance the data subjects of the following matters in the manner prescribed by Presidential Decree in the case of transfer of personal information to a third party owing to the transfer of some or all of his or her business, a merger, etc.:
1. The fact that the personal information will be transferred;
2. The name (referring to the company name in case of a legal person), address, telephone number and other contact information of the recipient of the personal information (hereinafter referred to as “business transferee, etc.”);
3. The method and procedure for withdrawing consent if the data subject does not wish his or her personal information to be transferred.
(2) Upon receiving personal information, the business transferee, etc. shall, without delay, notify data subjects of the fact in the manner prescribed by Presidential Decree: Provided, That this shall not apply where the personal information controller has already notified the data subjects of the fact of such transfer pursuant to paragraph (1).
(3) Upon receiving personal information owing to business transferee, etc., a merger, etc., the business transferee may use, or provide a third party with, the personal information only for the initial purposes dating to the time of the transfer. In such cases, the business transferee shall be deemed the personal information controller.
Article 28 (Supervision of Personal Information Handlers)
(1) In processing personal information, a personal information controller shall limit the scope of persons who process the personal information under his or her command and supervision, such as an executive officer or employee, temporary agency worker, and part-time worker (hereinafter referred to as “personal information handler”) to a minimum extent and shall appropriately manage and supervise such personal information handlers. <Amended on Mar. 14, 2023>
(2) A personal information controller shall provide personal information handlers with necessary educational programs on a regular basis in order to ensure the appropriate handling of personal information.
제28조(개인정보취급자에 대한 감독)
① 개인정보처리자는 개인정보를 처리함에 있어서 개인정보가 안전하게 관리될 수 있도록 임직원, 파견근로자, 시간제근로자 등 개인정보처리자의 지휘ㆍ감독을 받아 개인정보를 처리하는 자(이하 “개인정보취급자”라 한다)의 범위를 최소한으로 제한하고, 개인정보취급자에 대하여 적절한 관리ㆍ감독을 하여야 한다. <개정 2023. 3. 14.>
② 개인정보처리자는 개인정보의 적정한 취급을 보장하기 위하여 개인정보취급자에게 정기적으로 필요한 교육을 실시하여야 한다.
Article 28 (Supervision of Personal Information Handlers)
(1) In processing personal information, a personal information controller shall limit the scope of persons who process the personal information under his or her command and supervision, such as an executive officer or employee, temporary agency worker, and part-time worker (hereinafter referred to as “personal information handler”) to a minimum extent and shall appropriately manage and supervise such personal information handlers. <Amended on Mar. 14, 2023>
(2) A personal information controller shall provide personal information handlers with necessary educational programs on a regular basis in order to ensure the appropriate handling of personal information.
SECTION 3 Special Cases concerning Pseudonymized Information
제3절 가명정보의 처리에 관한 특례
SECTION 3 Special Cases concerning Pseudonymized Information
Article 28-2 (Processing of Pseudonymized Information)
(1) A personal information controller may process pseudonymized information without the consent of data subjects for statistical purposes, scientific research purposes, and archiving purposes in the public interest, etc.
(2) A personal information controller shall not include information that may be used to uniquely identify an individual when providing pseudonymized information to a third party according to paragraph (1).
[This Article Newly Inserted on Feb. 4, 2020]
제28조의2(가명정보의 처리 등)
① 개인정보처리자는 통계작성, 과학적 연구, 공익적 기록보존 등을 위하여 정보주체의 동의 없이 가명정보를 처리할 수 있다.
② 개인정보처리자는 제1항에 따라 가명정보를 제3자에게 제공하는 경우에는 특정 개인을 알아보기 위하여 사용될 수 있는 정보를 포함해서는 아니 된다.
[본조신설 2020. 2. 4.]
Article 28-2 (Processing of Pseudonymized Information)
(1) A personal information controller may process pseudonymized information without the consent of data subjects for statistical purposes, scientific research purposes, and archiving purposes in the public interest, etc.
(2) A personal information controller shall not include information that may be used to uniquely identify an individual when providing pseudonymized information to a third party according to paragraph (1).
[This Article Newly Inserted on Feb. 4, 2020]
Article 28-3 (Restriction on Combination of Pseudonymized Information)
(1) Notwithstanding Article 28-2, the combination of pseudonymized information processed by different personal information controllers for statistical purposes, scientific research and preservation of records for public interest, etc. shall be conducted by a specialized institution designated by the Protection Commission or the head of the related central administrative agency.
(2) A personal information controller who intends to transfer the combined information outside the organization that combined the information shall obtain approval from the head of the specialized institution after processing the information into pseudonymized information or the form referred to in Article 58-2.
(3) Necessary matters including the procedures and methods of combination pursuant to paragraph (1), standards and procedures to designate, or revoke the designation of, a specialized institution management and supervision, and standards and procedures of transfer and approval pursuant to paragraph (2) shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Feb. 4, 2020]
제28조의3(가명정보의 결합 제한)
① 제28조의2에도 불구하고 통계작성, 과학적 연구, 공익적 기록보존 등을 위한 서로 다른 개인정보처리자 간의 가명정보의 결합은 보호위원회 또는 관계 중앙행정기관의 장이 지정하는 전문기관이 수행한다.
② 결합을 수행한 기관 외부로 결합된 정보를 반출하려는 개인정보처리자는 가명정보 또는 제58조의2에 해당하는 정보로 처리한 뒤 전문기관의 장의 승인을 받아야 한다.
③ 제1항에 따른 결합 절차와 방법, 전문기관의 지정과 지정 취소 기준ㆍ절차, 관리ㆍ감독, 제2항에 따른 반출 및 승인 기준ㆍ절차 등 필요한 사항은 대통령령으로 정한다.
[본조신설 2020. 2. 4.]
Article 28-3 (Restriction on Combination of Pseudonymized Information)
(1) Notwithstanding Article 28-2, the combination of pseudonymized information processed by different personal information controllers for statistical purposes, scientific research and preservation of records for public interest, etc. shall be conducted by a specialized institution designated by the Protection Commission or the head of the related central administrative agency.
(2) A personal information controller who intends to transfer the combined information outside the organization that combined the information shall obtain approval from the head of the specialized institution after processing the information into pseudonymized information or the form referred to in Article 58-2.
(3) Necessary matters including the procedures and methods of combination pursuant to paragraph (1), standards and procedures to designate, or revoke the designation of, a specialized institution management and supervision, and standards and procedures of transfer and approval pursuant to paragraph (2) shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Feb. 4, 2020]
Article 28-4 (Obligation to Take Safety Measures for Pseudonymized Information)
(1) In processing pseudonymized information under Article 28-2 or 28-3, a personal information controller shall take such technical, administrative, and physical measures as separately storing and managing additional information needed for restoration to the original state, which are necessary to ensure safety as prescribed by Presidential Decree to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged. <Amended on Mar. 14, 2023>
(2) In processing pseudonymized information in accordance with Article 28-2 or 28-3, a personal information controller may separately determine the processing period of the pseudonymized information in consideration of the processing purpose, etc. <Newly Inserted on Mar. 14, 2023>
(3) A personal information controller who intends to process pseudonymized information under Article 28-2 or 28-3 shall prepare and retain records relating to matters prescribed by Presidential Decree including the purpose of processing the pseudonymized information, a recipient in cases pseudonymized information is provided to a third party, the processing period of pseudonymized information, etc. (limited to cases where the processing period is separately determined under paragraph (2)) to manage the details of the processing of pseudonymized information, and shall retain the records for at least three years from the date of destruction in the event of destruction of pseudonymized information. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
제28조의4(가명정보에 대한 안전조치의무 등)
① 개인정보처리자는 제28조의2 또는 제28조의3에 따라 가명정보를 처리하는 경우에는 원래의 상태로 복원하기 위한 추가 정보를 별도로 분리하여 보관ㆍ관리하는 등 해당 정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손되지 않도록 대통령령으로 정하는 바에 따라 안전성 확보에 필요한 기술적ㆍ관리적 및 물리적 조치를 하여야 한다. <개정 2023. 3. 14.>
② 개인정보처리자는 제28조의2 또는 제28조의3에 따라 가명정보를 처리하는 경우 처리목적 등을 고려하여 가명정보의 처리 기간을 별도로 정할 수 있다. <신설 2023. 3. 14.>
③ 개인정보처리자는 제28조의2 또는 제28조의3에 따라 가명정보를 처리하고자 하는 경우에는 가명정보의 처리 목적, 제3자 제공 시 제공받는 자, 가명정보의 처리 기간(제2항에 따라 처리 기간을 별도로 정한 경우에 한한다) 등 가명정보의 처리 내용을 관리하기 위하여 대통령령으로 정하는 사항에 대한 관련 기록을 작성하여 보관하여야 하며, 가명정보를 파기한 경우에는 파기한 날부터 3년 이상 보관하여야 한다. <개정 2023. 3. 14.>
[본조신설 2020. 2. 4.]
Article 28-4 (Obligation to Take Safety Measures for Pseudonymized Information)
(1) In processing pseudonymized information under Article 28-2 or 28-3, a personal information controller shall take such technical, administrative, and physical measures as separately storing and managing additional information needed for restoration to the original state, which are necessary to ensure safety as prescribed by Presidential Decree to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged. <Amended on Mar. 14, 2023>
(2) In processing pseudonymized information in accordance with Article 28-2 or 28-3, a personal information controller may separately determine the processing period of the pseudonymized information in consideration of the processing purpose, etc. <Newly Inserted on Mar. 14, 2023>
(3) A personal information controller who intends to process pseudonymized information under Article 28-2 or 28-3 shall prepare and retain records relating to matters prescribed by Presidential Decree including the purpose of processing the pseudonymized information, a recipient in cases pseudonymized information is provided to a third party, the processing period of pseudonymized information, etc. (limited to cases where the processing period is separately determined under paragraph (2)) to manage the details of the processing of pseudonymized information, and shall retain the records for at least three years from the date of destruction in the event of destruction of pseudonymized information. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
Article 28-5 (Prohibited Acts in Processing Pseudonymized Information)
(1) No person who processes pseudonymized information under Article 28-2 or 28-3 shall process such information for the purpose of uniquely identifying an individual. <Amended on Mar. 14, 2023>
(2) When information that can uniquely identify an individual is generated in the process of processing pseudonymized information under Article 28-2 or 28-3, a personal information controller shall immediately cease the processing of the relevant information, and shall retrieve and destroy the information without delay. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
제28조의5(가명정보 처리 시 금지의무 등)
① 제28조의2 또는 제28조의3에 따라 가명정보를 처리하는 자는 특정 개인을 알아보기 위한 목적으로 가명정보를 처리해서는 아니 된다. <개정 2023. 3. 14.>
② 개인정보처리자는 제28조의2 또는 제28조의3에 따라 가명정보를 처리하는 과정에서 특정 개인을 알아볼 수 있는 정보가 생성된 경우에는 즉시 해당 정보의 처리를 중지하고, 지체 없이 회수ㆍ파기하여야 한다. <개정 2023. 3. 14.>
[본조신설 2020. 2. 4.]
Article 28-5 (Prohibited Acts in Processing Pseudonymized Information)
(1) No person who processes pseudonymized information under Article 28-2 or 28-3 shall process such information for the purpose of uniquely identifying an individual. <Amended on Mar. 14, 2023>
(2) When information that can uniquely identify an individual is generated in the process of processing pseudonymized information under Article 28-2 or 28-3, a personal information controller shall immediately cease the processing of the relevant information, and shall retrieve and destroy the information without delay. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
Article 28-6 Deleted.
제28조의6 삭제 <2023. 3. 14.>
Article 28-6 Deleted.
Article 28-7 (Scope of Application)
Articles 20, 20-2, 27, 34 (1), 35, 35-2, 36, and 37 shall not apply to pseudonymized information processed under Article 28-2 or 28-3. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
제28조의7(적용범위)
제28조의2 또는 제28조의3에 따라 처리된 가명정보는 제20조, 제20조의2, 제27조, 제34조제1항, 제35조, 제35조의2, 제36조 및 제37조를 적용하지 아니한다. <개정 2023. 3. 14.>
[본조신설 2020. 2. 4.]
Article 28-7 (Scope of Application)
Articles 20, 20-2, 27, 34 (1), 35, 35-2, 36, and 37 shall not apply to pseudonymized information processed under Article 28-2 or 28-3. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
SECTION 4 Cross-Border Transfer of Personal Information
제4절 개인정보의 국외 이전
SECTION 4 Cross-Border Transfer of Personal Information
Article 28-8 (Cross-Border Transfer of Personal Information)
(1) No cross-border provision (including inquiry), entrusted processing, or storage (hereafter in this Section referred to as "transfer") of personal information shall be allowed by a personal information controller: Provided, That in any of the following cases, the cross-border transfer of personal information may be allowed:
1. Where separate consent is obtained from the data subject;
2. Where there are special provisions regarding the cross-border transfer of personal information in a statute, a treaty to which the Republic of Korea is a party, or other international conventions;
3. In any of the following cases where it is necessary to entrust the processing of personal information and to retain such personal information in order to conclude and perform a contract with the data subject:
(a) Where the matters set forth in the subparagraphs of paragraph (2) are disclosed in the Privacy Policy provided in Article 30;
(b) Where the matters provided in the subparagraphs of paragraph (2) are communicated to the data subject by means prescribed by Presidential Decree, such as electronic mail;
4. Where the recipient of personal information obtains certification determined and publicly notified by the Protection Commission, such as the certification of personal information protection under Article 32-2, and takes all of the following measures:
(a) Safety measures necessary for protecting personal information and measures necessary for guaranteeing the rights of data subjects;
(b) Measures necessary for implementing certified matters in the country to which personal information is to be transferred;
5. Where the Protection Commission recognizes that the personal information protection system of the country or international organization to which the personal information is to be transferred, the scope of guarantee of the rights of the data subject, and the procedures for damage relief, etc. are substantially equal to the level of personal information protection under this Act.
(2) A personal information controller shall inform data subjects of the following matters in advance when obtaining consent under paragraph (1) 1:
1. Particulars of the personal information to be transferred;
2. The country to which the personal information is transferred, transfer date, and method;
3. Name of the recipient of personal information (referring to the name of a corporation and the contact information of the corporation, if the recipient is a corporation);
4. The purpose of using personal information by the recipient of personal information and the period of retention and use of personal information;
5. The method and procedure for refusing the transfer of personal information and the effect of such refusal.
(3) A personal information controller that intends to change the matters provided in any subparagraph of paragraph (2) shall inform a data subject of such change and obtain the data subject's consent thereto.
(4) A personal information controller shall comply with other provisions of this Act and Articles 17 through 19 and Chapter V of this Act, which are related to the cross-border transfer of personal information, and shall take protective measures prescribed by Presidential Decree, where it makes cross-border transfers of personal information pursuant to the proviso, with the exception of the subparagraphs, of paragraph (1).
(5) A personal information controller shall not enter into a contract for cross-border transfers of personal information containing terms and conditions that are in violation of this Act.
(6) Except as provided in paragraphs (1) through (5), matters necessary for the criteria and procedures for the cross-border transfer of personal information, etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제28조의8(개인정보의 국외 이전)
① 개인정보처리자는 개인정보를 국외로 제공(조회되는 경우를 포함한다)ㆍ처리위탁ㆍ보관(이하 이 절에서 “이전”이라 한다)하여서는 아니 된다. 다만, 다음 각 호의 어느 하나에 해당하는 경우에는 개인정보를 국외로 이전할 수 있다.
1. 정보주체로부터 국외 이전에 관한 별도의 동의를 받은 경우
2. 법률, 대한민국을 당사자로 하는 조약 또는 그 밖의 국제협정에 개인정보의 국외 이전에 관한 특별한 규정이 있는 경우
3. 정보주체와의 계약의 체결 및 이행을 위하여 개인정보의 처리위탁ㆍ보관이 필요한 경우로서 다음 각 목의 어느 하나에 해당하는 경우
가. 제2항 각 호의 사항을 제30조에 따른 개인정보 처리방침에 공개한 경우
나. 전자우편 등 대통령령으로 정하는 방법에 따라 제2항 각 호의 사항을 정보주체에게 알린 경우
4. 개인정보를 이전받는 자가 제32조의2에 따른 개인정보 보호 인증 등 보호위원회가 정하여 고시하는 인증을 받은 경우로서 다음 각 목의 조치를 모두 한 경우
가. 개인정보 보호에 필요한 안전조치 및 정보주체 권리보장에 필요한 조치
나. 인증받은 사항을 개인정보가 이전되는 국가에서 이행하기 위하여 필요한 조치
5. 개인정보가 이전되는 국가 또는 국제기구의 개인정보 보호체계, 정보주체 권리보장 범위, 피해구제 절차 등이 이 법에 따른 개인정보 보호 수준과 실질적으로 동등한 수준을 갖추었다고 보호위원회가 인정하는 경우
② 개인정보처리자는 제1항제1호에 따른 동의를 받을 때에는 미리 다음 각 호의 사항을 정보주체에게 알려야 한다.
1. 이전되는 개인정보 항목
2. 개인정보가 이전되는 국가, 시기 및 방법
3. 개인정보를 이전받는 자의 성명(법인인 경우에는 그 명칭과 연락처를 말한다)
4. 개인정보를 이전받는 자의 개인정보 이용목적 및 보유ㆍ이용 기간
5. 개인정보의 이전을 거부하는 방법, 절차 및 거부의 효과
③ 개인정보처리자는 제2항 각 호의 어느 하나에 해당하는 사항을 변경하는 경우에는 정보주체에게 알리고 동의를 받아야 한다.
④ 개인정보처리자는 제1항 각 호 외의 부분 단서에 따라 개인정보를 국외로 이전하는 경우 국외 이전과 관련한 이 법의 다른 규정, 제17조부터 제19조까지의 규정 및 제5장의 규정을 준수하여야 하고, 대통령령으로 정하는 보호조치를 하여야 한다.
⑤ 개인정보처리자는 이 법을 위반하는 사항을 내용으로 하는 개인정보의 국외 이전에 관한 계약을 체결하여서는 아니 된다.
⑥ 제1항부터 제5항까지에서 규정한 사항 외에 개인정보 국외 이전의 기준 및 절차 등에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 28-8 (Cross-Border Transfer of Personal Information)
(1) No cross-border provision (including inquiry), entrusted processing, or storage (hereafter in this Section referred to as "transfer") of personal information shall be allowed by a personal information controller: Provided, That in any of the following cases, the cross-border transfer of personal information may be allowed:
1. Where separate consent is obtained from the data subject;
2. Where there are special provisions regarding the cross-border transfer of personal information in a statute, a treaty to which the Republic of Korea is a party, or other international conventions;
3. In any of the following cases where it is necessary to entrust the processing of personal information and to retain such personal information in order to conclude and perform a contract with the data subject:
(a) Where the matters set forth in the subparagraphs of paragraph (2) are disclosed in the Privacy Policy provided in Article 30;
(b) Where the matters provided in the subparagraphs of paragraph (2) are communicated to the data subject by means prescribed by Presidential Decree, such as electronic mail;
4. Where the recipient of personal information obtains certification determined and publicly notified by the Protection Commission, such as the certification of personal information protection under Article 32-2, and takes all of the following measures:
(a) Safety measures necessary for protecting personal information and measures necessary for guaranteeing the rights of data subjects;
(b) Measures necessary for implementing certified matters in the country to which personal information is to be transferred;
5. Where the Protection Commission recognizes that the personal information protection system of the country or international organization to which the personal information is to be transferred, the scope of guarantee of the rights of the data subject, and the procedures for damage relief, etc. are substantially equal to the level of personal information protection under this Act.
(2) A personal information controller shall inform data subjects of the following matters in advance when obtaining consent under paragraph (1) 1:
1. Particulars of the personal information to be transferred;
2. The country to which the personal information is transferred, transfer date, and method;
3. Name of the recipient of personal information (referring to the name of a corporation and the contact information of the corporation, if the recipient is a corporation);
4. The purpose of using personal information by the recipient of personal information and the period of retention and use of personal information;
5. The method and procedure for refusing the transfer of personal information and the effect of such refusal.
(3) A personal information controller that intends to change the matters provided in any subparagraph of paragraph (2) shall inform a data subject of such change and obtain the data subject's consent thereto.
(4) A personal information controller shall comply with other provisions of this Act and Articles 17 through 19 and Chapter V of this Act, which are related to the cross-border transfer of personal information, and shall take protective measures prescribed by Presidential Decree, where it makes cross-border transfers of personal information pursuant to the proviso, with the exception of the subparagraphs, of paragraph (1).
(5) A personal information controller shall not enter into a contract for cross-border transfers of personal information containing terms and conditions that are in violation of this Act.
(6) Except as provided in paragraphs (1) through (5), matters necessary for the criteria and procedures for the cross-border transfer of personal information, etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 28-9 (Orders to Suspend Cross-Border Transfers of Personal Information)
(1) The Protection Commission may order a personal information controller to suspend cross-border transfers of personal information in any of the following cases where the cross-border transfer of personal information is ongoing or where any further cross-border transfer is expected:
1. Cases in violation of Article 28-8 (1), (4), or (5);
2. Where the recipient of personal information or the State or international organization to which the personal information is transferred fails to properly protect the personal information when compared to the level of personal information protection under this Act, and thus the data subject suffers damage or is highly likely to suffer damage.
(2) Upon receipt of an order to suspend cross-border transfers of personal information under paragraph (1), a personal information controller may file an objection with the Protection Commission within seven days after receipt of such order.
(3) Matters necessary for the standards for orders to suspend cross-border transfers of personal information under paragraph (1), the procedures for filing an objection under paragraph (2), etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제28조의9(개인정보의 국외 이전 중지 명령)
① 보호위원회는 개인정보의 국외 이전이 계속되고 있거나 추가적인 국외 이전이 예상되는 경우로서 다음 각 호의 어느 하나에 해당하는 경우에는 개인정보처리자에게 개인정보의 국외 이전을 중지할 것을 명할 수 있다.
1. 제28조의8제1항, 제4항 또는 제5항을 위반한 경우
2. 개인정보를 이전받는 자나 개인정보가 이전되는 국가 또는 국제기구가 이 법에 따른 개인정보 보호 수준에 비하여 개인정보를 적정하게 보호하지 아니하여 정보주체에게 피해가 발생하거나 발생할 우려가 현저한 경우
② 개인정보처리자는 제1항에 따른 국외 이전 중지 명령을 받은 경우에는 명령을 받은 날부터 7일 이내에 보호위원회에 이의를 제기할 수 있다.
③ 제1항에 따른 개인정보 국외 이전 중지 명령의 기준, 제2항에 따른 불복 절차 등에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 28-9 (Orders to Suspend Cross-Border Transfers of Personal Information)
(1) The Protection Commission may order a personal information controller to suspend cross-border transfers of personal information in any of the following cases where the cross-border transfer of personal information is ongoing or where any further cross-border transfer is expected:
1. Cases in violation of Article 28-8 (1), (4), or (5);
2. Where the recipient of personal information or the State or international organization to which the personal information is transferred fails to properly protect the personal information when compared to the level of personal information protection under this Act, and thus the data subject suffers damage or is highly likely to suffer damage.
(2) Upon receipt of an order to suspend cross-border transfers of personal information under paragraph (1), a personal information controller may file an objection with the Protection Commission within seven days after receipt of such order.
(3) Matters necessary for the standards for orders to suspend cross-border transfers of personal information under paragraph (1), the procedures for filing an objection under paragraph (2), etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 28-10 (Reciprocity)
Notwithstanding Article 28-8, personal information controllers in a country that restricts cross-border transfers of personal information may be subject to restrictions at a level equivalent to those imposed by the country: Provided, That this shall not apply where cross-border transfers are necessary to implement a treaty or other international conventions.
[This Article Newly Inserted on Mar. 14, 2023]
제28조의10(상호주의)
제28조의8에도 불구하고 개인정보의 국외 이전을 제한하는 국가의 개인정보처리자에 대해서는 해당 국가의 수준에 상응하는 제한을 할 수 있다. 다만, 조약 또는 그 밖의 국제협정의 이행에 필요한 경우에는 그러하지 아니하다.
[본조신설 2023. 3. 14.]
Article 28-10 (Reciprocity)
Notwithstanding Article 28-8, personal information controllers in a country that restricts cross-border transfers of personal information may be subject to restrictions at a level equivalent to those imposed by the country: Provided, That this shall not apply where cross-border transfers are necessary to implement a treaty or other international conventions.
[This Article Newly Inserted on Mar. 14, 2023]
Article 28-11 (Provisions Applicable Mutatis Mutandis)
제28조의11(준용규정)
제28조의8제1항 각 호 외의 부분 단서에 따라 개인정보를 이전받은 자가 해당 개인정보를 제3국으로 이전하는 경우에 관하여는 제28조의8 및 제28조의9를 준용한다. 이 경우 “개인정보처리자”는 “개인정보를 이전받은 자”로, “개인정보를 이전받는 자”는 “제3국에서 개인정보를 이전받는 자”로 본다.
[본조신설 2023. 3. 14.]
Article 28-11 (Provisions Applicable Mutatis Mutandis)
CHAPTER IV SAFEGUARD OF PERSONAL INFORMATION
제4장 개인정보의 안전한 관리
CHAPTER IV SAFEGUARD OF PERSONAL INFORMATION
Article 29 (Duty of Safeguards)
Every personal information controller shall take such technical, managerial, and physical measures as establishing an internal management plan and preserving access records, etc. that are necessary to ensure safety as prescribed by Presidential Decree so that the personal information may not be lost, stolen, divulged, forged, altered, or damaged. <Amended on Jul. 24, 2015>
제29조(안전조치의무)
개인정보처리자는 개인정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손되지 아니하도록 내부 관리계획 수립, 접속기록 보관 등 대통령령으로 정하는 바에 따라 안전성 확보에 필요한 기술적ㆍ관리적 및 물리적 조치를 하여야 한다. <개정 2015. 7. 24.>
Article 29 (Duty of Safeguards)
Every personal information controller shall take such technical, managerial, and physical measures as establishing an internal management plan and preserving access records, etc. that are necessary to ensure safety as prescribed by Presidential Decree so that the personal information may not be lost, stolen, divulged, forged, altered, or damaged. <Amended on Jul. 24, 2015>
Article 30 (Establishment and Disclosure of Privacy Policy)
(1) A personal information controller shall establish a personal information processing policy including the following matters (hereinafter referred to as "Privacy Policy"). In such cases, public institutions shall establish the Privacy Policy for the personal information files to be registered pursuant to Article 32: <Amended on Mar. 29, 2016; Feb. 4, 2020; Mar. 14, 2023>
1. The purposes for which personal information is processed;
2. The period for processing and retaining personal information;
3. Provision of personal information to a third party (if applicable);
3-2. Procedures and methods for destroying personal information (if personal information shall be preserved according to the proviso of Article 21 (1), this shall include the basis of preservation and particulars of personal information to be preserved);
3-3. The possibility of disclosure of sensitive information and the method of selecting non-disclosure under Article 23 (3) (if applicable);
4. Entrusting personal information processing (if applicable);
4-2. Matters relating to processing, etc. of pseudonymized information under Articles 28-2 and 28-3 (if applicable);
5. The rights and obligations of data subjects and legal representatives, and how to exercise such rights;
6. Contact information, such as the name of a privacy officer designated under Article 31 or the name, telephone number, etc. of the department which performs the work related to personal information protection and handles related grievances;
7. Installation and operation of an automatic collection tool for personal information, including Internet access data files, and the denial thereof (if applicable);
8. Other matters prescribed by Presidential Decree regarding the processing of personal information.
(2) Upon establishing or modifying the Privacy Policy, a personal information controller shall disclose the content so that data subjects may easily recognize it in such a way as prescribed by Presidential Decree.
(3) Where there exist discrepancies between the Privacy Policy and the agreement executed by and between the personal information controller and data subjects, the terms that are beneficial to the data subjects shall prevail.
(4) The Protection Commission may prepare the Privacy Policy Guidelines and encourage the personal information controllers to comply with such Guidelines. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
제30조(개인정보 처리방침의 수립 및 공개)
① 개인정보처리자는 다음 각 호의 사항이 포함된 개인정보의 처리 방침(이하 “개인정보 처리방침”이라 한다)을 정하여야 한다. 이 경우 공공기관은 제32조에 따라 등록대상이 되는 개인정보파일에 대하여 개인정보 처리방침을 정한다. <개정 2016. 3. 29., 2020. 2. 4., 2023. 3. 14.>
1. 개인정보의 처리 목적
2. 개인정보의 처리 및 보유 기간
3. 개인정보의 제3자 제공에 관한 사항(해당되는 경우에만 정한다)
3의2. 개인정보의 파기절차 및 파기방법(제21조제1항 단서에 따라 개인정보를 보존하여야 하는 경우에는 그 보존근거와 보존하는 개인정보 항목을 포함한다)
3의3. 제23조제3항에 따른 민감정보의 공개 가능성 및 비공개를 선택하는 방법(해당되는 경우에만 정한다)
4. 개인정보처리의 위탁에 관한 사항(해당되는 경우에만 정한다)
4의2. 제28조의2 및 제28조의3에 따른 가명정보의 처리 등에 관한 사항(해당되는 경우에만 정한다)
5. 정보주체와 법정대리인의 권리ㆍ의무 및 그 행사방법에 관한 사항
6. 제31조에 따른 개인정보 보호책임자의 성명 또는 개인정보 보호업무 및 관련 고충사항을 처리하는 부서의 명칭과 전화번호 등 연락처
7. 인터넷 접속정보파일 등 개인정보를 자동으로 수집하는 장치의 설치ㆍ운영 및 그 거부에 관한 사항(해당하는 경우에만 정한다)
8. 그 밖에 개인정보의 처리에 관하여 대통령령으로 정한 사항
② 개인정보처리자가 개인정보 처리방침을 수립하거나 변경하는 경우에는 정보주체가 쉽게 확인할 수 있도록 대통령령으로 정하는 방법에 따라 공개하여야 한다.
③ 개인정보 처리방침의 내용과 개인정보처리자와 정보주체 간에 체결한 계약의 내용이 다른 경우에는 정보주체에게 유리한 것을 적용한다.
④ 보호위원회는 개인정보 처리방침의 작성지침을 정하여 개인정보처리자에게 그 준수를 권장할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
Article 30 (Establishment and Disclosure of Privacy Policy)
(1) A personal information controller shall establish a personal information processing policy including the following matters (hereinafter referred to as "Privacy Policy"). In such cases, public institutions shall establish the Privacy Policy for the personal information files to be registered pursuant to Article 32: <Amended on Mar. 29, 2016; Feb. 4, 2020; Mar. 14, 2023>
1. The purposes for which personal information is processed;
2. The period for processing and retaining personal information;
3. Provision of personal information to a third party (if applicable);
3-2. Procedures and methods for destroying personal information (if personal information shall be preserved according to the proviso of Article 21 (1), this shall include the basis of preservation and particulars of personal information to be preserved);
3-3. The possibility of disclosure of sensitive information and the method of selecting non-disclosure under Article 23 (3) (if applicable);
4. Entrusting personal information processing (if applicable);
4-2. Matters relating to processing, etc. of pseudonymized information under Articles 28-2 and 28-3 (if applicable);
5. The rights and obligations of data subjects and legal representatives, and how to exercise such rights;
6. Contact information, such as the name of a privacy officer designated under Article 31 or the name, telephone number, etc. of the department which performs the work related to personal information protection and handles related grievances;
7. Installation and operation of an automatic collection tool for personal information, including Internet access data files, and the denial thereof (if applicable);
8. Other matters prescribed by Presidential Decree regarding the processing of personal information.
(2) Upon establishing or modifying the Privacy Policy, a personal information controller shall disclose the content so that data subjects may easily recognize it in such a way as prescribed by Presidential Decree.
(3) Where there exist discrepancies between the Privacy Policy and the agreement executed by and between the personal information controller and data subjects, the terms that are beneficial to the data subjects shall prevail.
(4) The Protection Commission may prepare the Privacy Policy Guidelines and encourage the personal information controllers to comply with such Guidelines. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
Article 30-2 (Evaluation of Privacy Policy and Recommendations for Improvements)
(1) The Protection Commission shall evaluate the following with respect to the Privacy Policy and may recommend that the relevant personal information controller improve the policy pursuant to Article 61 (2), if it is deemed necessary to improve the policy based on the evaluation results:
1. Whether the matters that shall be included in the Privacy Policy pursuant to this Act are appropriately determined;
2. Whether the Privacy Policy has been prepared in an easily understandable manner;
3. Whether the Privacy Policy is disclosed in such a way that the data subject can easily confirm.
(2) Matters necessary for those subject to the evaluation of the Privacy Policy, criteria and procedures therefor, etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제30조의2(개인정보 처리방침의 평가 및 개선권고)
① 보호위원회는 개인정보 처리방침에 관하여 다음 각 호의 사항을 평가하고, 평가 결과 개선이 필요하다고 인정하는 경우에는 개인정보처리자에게 제61조제2항에 따라 개선을 권고할 수 있다.
1. 이 법에 따라 개인정보 처리방침에 포함하여야 할 사항을 적정하게 정하고 있는지 여부
2. 개인정보 처리방침을 알기 쉽게 작성하였는지 여부
3. 개인정보 처리방침을 정보주체가 쉽게 확인할 수 있는 방법으로 공개하고 있는지 여부
② 개인정보 처리방침의 평가 대상, 기준 및 절차 등에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 30-2 (Evaluation of Privacy Policy and Recommendations for Improvements)
(1) The Protection Commission shall evaluate the following with respect to the Privacy Policy and may recommend that the relevant personal information controller improve the policy pursuant to Article 61 (2), if it is deemed necessary to improve the policy based on the evaluation results:
1. Whether the matters that shall be included in the Privacy Policy pursuant to this Act are appropriately determined;
2. Whether the Privacy Policy has been prepared in an easily understandable manner;
3. Whether the Privacy Policy is disclosed in such a way that the data subject can easily confirm.
(2) Matters necessary for those subject to the evaluation of the Privacy Policy, criteria and procedures therefor, etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 31 (Designation of Privacy Officers)
(1) A personal information controller shall designate a privacy officer who shall have general supervision and control of the work regarding personal information processing: Provided, That a personal information controller whose number of employees, turnover, etc. meet the criteria prescribed by Presidential Decree need not designate a privacy officer. <Amended on Mar. 14, 2023>
(2) Where a privacy officer is not designated under the proviso of paragraph (1), the business owner or representative of the personal information controller shall become the privacy officer. <Newly Inserted on Mar. 14, 2023>
(3) A privacy officer shall perform the following work: <Amended on Mar. 14, 2023>
1. To establish and implement a personal information protection plan;
2. To conduct a regular survey of the status and practices of personal information processing, and to improve shortcomings;
3. To handle grievances and remedial compensation in relation to personal information processing;
4. To build the internal control system to prevent the divulgence, abuse, and misuse of personal information;
5. To prepare and implement an education program about personal information protection;
6. To protect, control, and manage the personal information files;
7. Other work prescribed by Presidential Decree for the appropriate processing of personal information.
(4) In performing the work provided in the subparagraphs of paragraph (3), a privacy officer may occasionally inspect the current status of personal information processing, processing systems, etc. if necessary, and may request a report thereon from the relevant parties. <Amended on Mar. 14, 2023>
(5) Where a privacy officer becomes aware of any violation of this Act or other relevant statutes or regulations in relation to the protection of personal information, he or she shall take corrective measures immediately, and shall report such corrective measures to the head of the institution or organization to which he or she belongs, if necessary. <Amended on Mar. 14, 2023>
(6) A personal information controller shall not allow the privacy officer to give or be subject to disadvantages without good cause while performing the affairs provided in the subparagraphs of paragraph (3), and shall guarantee the independent performance of work by the privacy officer. <Amended on Mar. 14, 2023>
(7) A personal information controller may organize and operate a council of privacy officers comprised of the privacy officers provided in paragraph (1) so as to safely process and protect personal information, exchange information, and conduct other joint projects prescribed by Presidential Decree. <Newly Inserted on Mar. 14, 2023>
(8) The Protection Commission may provide support necessary for the activities of the council of privacy officers under paragraph (7). <Newly Inserted on Mar. 14, 2023>
(9) Matters necessary for the qualification requirements for a privacy officer under paragraph (1), the work under paragraph (3), the guarantee of independence under paragraph (6), and other relevant matters, shall be prescribed by Presidential Decree, taking into consideration sales, the scale of personal information retained, etc. <Amended on Mar. 14, 2023>
[Title Amended on Mar. 14, 2023]
제31조(개인정보 보호책임자의 지정 등)
① 개인정보처리자는 개인정보의 처리에 관한 업무를 총괄해서 책임질 개인정보 보호책임자를 지정하여야 한다. 다만, 종업원 수, 매출액 등이 대통령령으로 정하는 기준에 해당하는 개인정보처리자의 경우에는 지정하지 아니할 수 있다. <개정 2023. 3. 14.>
② 제1항 단서에 따라 개인정보 보호책임자를 지정하지 아니하는 경우에는 개인정보처리자의 사업주 또는 대표자가 개인정보 보호책임자가 된다. <신설 2023. 3. 14.>
③ 개인정보 보호책임자는 다음 각 호의 업무를 수행한다. <개정 2023. 3. 14.>
1. 개인정보 보호 계획의 수립 및 시행
2. 개인정보 처리 실태 및 관행의 정기적인 조사 및 개선
3. 개인정보 처리와 관련한 불만의 처리 및 피해 구제
4. 개인정보 유출 및 오용ㆍ남용 방지를 위한 내부통제시스템의 구축
5. 개인정보 보호 교육 계획의 수립 및 시행
6. 개인정보파일의 보호 및 관리ㆍ감독
7. 그 밖에 개인정보의 적절한 처리를 위하여 대통령령으로 정한 업무
④ 개인정보 보호책임자는 제3항 각 호의 업무를 수행함에 있어서 필요한 경우 개인정보의 처리 현황, 처리 체계 등에 대하여 수시로 조사하거나 관계 당사자로부터 보고를 받을 수 있다. <개정 2023. 3. 14.>
⑤ 개인정보 보호책임자는 개인정보 보호와 관련하여 이 법 및 다른 관계 법령의 위반 사실을 알게 된 경우에는 즉시 개선조치를 하여야 하며, 필요하면 소속 기관 또는 단체의 장에게 개선조치를 보고하여야 한다. <개정 2023. 3. 14.>
⑥ 개인정보처리자는 개인정보 보호책임자가 제3항 각 호의 업무를 수행함에 있어서 정당한 이유 없이 불이익을 주거나 받게 하여서는 아니 되며, 개인정보 보호책임자가 업무를 독립적으로 수행할 수 있도록 보장하여야 한다. <개정 2023. 3. 14.>
⑦ 개인정보처리자는 개인정보의 안전한 처리 및 보호, 정보의 교류, 그 밖에 대통령령으로 정하는 공동의 사업을 수행하기 위하여 제1항에 따른 개인정보 보호책임자를 구성원으로 하는 개인정보 보호책임자 협의회를 구성ㆍ운영할 수 있다. <신설 2023. 3. 14.>
⑧ 보호위원회는 제7항에 따른 개인정보 보호책임자 협의회의 활동에 필요한 지원을 할 수 있다. <신설 2023. 3. 14.>
⑨ 제1항에 따른 개인정보 보호책임자의 자격요건, 제3항에 따른 업무 및 제6항에 따른 독립성 보장 등에 필요한 사항은 매출액, 개인정보의 보유 규모 등을 고려하여 대통령령으로 정한다. <개정 2023. 3. 14.>
[제목개정 2023. 3. 14.]
Article 31 (Designation of Privacy Officers)
(1) A personal information controller shall designate a privacy officer who shall have general supervision and control of the work regarding personal information processing: Provided, That a personal information controller whose number of employees, turnover, etc. meet the criteria prescribed by Presidential Decree need not designate a privacy officer. <Amended on Mar. 14, 2023>
(2) Where a privacy officer is not designated under the proviso of paragraph (1), the business owner or representative of the personal information controller shall become the privacy officer. <Newly Inserted on Mar. 14, 2023>
(3) A privacy officer shall perform the following work: <Amended on Mar. 14, 2023>
1. To establish and implement a personal information protection plan;
2. To conduct a regular survey of the status and practices of personal information processing, and to improve shortcomings;
3. To handle grievances and remedial compensation in relation to personal information processing;
4. To build the internal control system to prevent the divulgence, abuse, and misuse of personal information;
5. To prepare and implement an education program about personal information protection;
6. To protect, control, and manage the personal information files;
7. Other work prescribed by Presidential Decree for the appropriate processing of personal information.
(4) In performing the work provided in the subparagraphs of paragraph (3), a privacy officer may occasionally inspect the current status of personal information processing, processing systems, etc. if necessary, and may request a report thereon from the relevant parties. <Amended on Mar. 14, 2023>
(5) Where a privacy officer becomes aware of any violation of this Act or other relevant statutes or regulations in relation to the protection of personal information, he or she shall take corrective measures immediately, and shall report such corrective measures to the head of the institution or organization to which he or she belongs, if necessary. <Amended on Mar. 14, 2023>
(6) A personal information controller shall not allow the privacy officer to give or be subject to disadvantages without good cause while performing the affairs provided in the subparagraphs of paragraph (3), and shall guarantee the independent performance of work by the privacy officer. <Amended on Mar. 14, 2023>
(7) A personal information controller may organize and operate a council of privacy officers comprised of the privacy officers provided in paragraph (1) so as to safely process and protect personal information, exchange information, and conduct other joint projects prescribed by Presidential Decree. <Newly Inserted on Mar. 14, 2023>
(8) The Protection Commission may provide support necessary for the activities of the council of privacy officers under paragraph (7). <Newly Inserted on Mar. 14, 2023>
(9) Matters necessary for the qualification requirements for a privacy officer under paragraph (1), the work under paragraph (3), the guarantee of independence under paragraph (6), and other relevant matters, shall be prescribed by Presidential Decree, taking into consideration sales, the scale of personal information retained, etc. <Amended on Mar. 14, 2023>
[Title Amended on Mar. 14, 2023]
Article 31-2 (Designation of Domestic Agents)
(1) A personal information controller with no address or place of business in the Republic of Korea who is prescribed by Presidential Decree in consideration of the sales, the scale of personal information retained, and other factors shall designate a person who acts as an agent for the following (hereinafter referred to as "domestic agent"). In such cases, the domestic agent shall be designated in writing: <Amended on Mar. 14, 2023>
1. Work of a privacy officer under Article 31 (3);
2. Notification and reporting of the personal data under Article 34 (1) and (3);
3. Submission of materials such as articles and documents under Article 63 (1).
(2) A domestic agent shall have an address or business office in Korea. <Amended on Mar. 14, 2023>
(3) The personal information controller shall include the following in the Privacy Policy if he or she designates a domestic agent pursuant to paragraph (1): <Amended on Mar. 14, 2023>
1. Name of the domestic agent (in cases of a corporation, referring to its name and the name of its representative);
2. Address (in cases of a corporation, referring to the location of a business office), telephone number, and e-mail address of the domestic agent.
(4) If a domestic agent violates this Act in relation to the subparagraphs of paragraph (1), the personal information controller shall be deemed to have committed such a violation. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
[Moved from Article 39-11 <Mar. 14, 2023>]
제31조의2(국내대리인의 지정)
① 국내에 주소 또는 영업소가 없는 개인정보처리자로서 매출액, 개인정보의 보유 규모 등을 고려하여 대통령령으로 정하는 자는 다음 각 호의 사항을 대리하는 자(이하 “국내대리인”이라 한다)를 지정하여야 한다. 이 경우 국내대리인의 지정은 문서로 하여야 한다. <개정 2023. 3. 14.>
1. 제31조제3항에 따른 개인정보 보호책임자의 업무
2. 제34조제1항 및 제3항에 따른 개인정보 유출 등의 통지 및 신고
3. 제63조제1항에 따른 물품ㆍ서류 등 자료의 제출
② 국내대리인은 국내에 주소 또는 영업소가 있어야 한다. <개정 2023. 3. 14.>
③ 개인정보처리자는 제1항에 따라 국내대리인을 지정하는 경우에는 다음 각 호의 사항을 개인정보 처리방침에 포함하여야 한다. <개정 2023. 3. 14.>
1. 국내대리인의 성명(법인의 경우에는 그 명칭 및 대표자의 성명을 말한다)
2. 국내대리인의 주소(법인의 경우에는 영업소의 소재지를 말한다), 전화번호 및 전자우편 주소
④ 국내대리인이 제1항 각 호와 관련하여 이 법을 위반한 경우에는 개인정보처리자가 그 행위를 한 것으로 본다. <개정 2023. 3. 14.>
[본조신설 2020. 2. 4.]
[제39조의11에서 이동 <2023. 3. 14.>]
Article 31-2 (Designation of Domestic Agents)
(1) A personal information controller with no address or place of business in the Republic of Korea who is prescribed by Presidential Decree in consideration of the sales, the scale of personal information retained, and other factors shall designate a person who acts as an agent for the following (hereinafter referred to as "domestic agent"). In such cases, the domestic agent shall be designated in writing: <Amended on Mar. 14, 2023>
1. Work of a privacy officer under Article 31 (3);
2. Notification and reporting of the personal data under Article 34 (1) and (3);
3. Submission of materials such as articles and documents under Article 63 (1).
(2) A domestic agent shall have an address or business office in Korea. <Amended on Mar. 14, 2023>
(3) The personal information controller shall include the following in the Privacy Policy if he or she designates a domestic agent pursuant to paragraph (1): <Amended on Mar. 14, 2023>
1. Name of the domestic agent (in cases of a corporation, referring to its name and the name of its representative);
2. Address (in cases of a corporation, referring to the location of a business office), telephone number, and e-mail address of the domestic agent.
(4) If a domestic agent violates this Act in relation to the subparagraphs of paragraph (1), the personal information controller shall be deemed to have committed such a violation. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
[Moved from Article 39-11 <Mar. 14, 2023>]
Article 32 (Registration and Disclosure of Personal Information Files)
(1) Upon operating personal information files, the head of a public institution shall register the following matters with the Protection Commission. The same shall also apply where the registered matters are modified: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
1. The titles of the personal information files;
2. The grounds and purposes for the operation of the personal information files;
3. Particulars of personal information that are recorded in the personal information files;
4. The method of processing personal information;
5. The period for retaining personal information;
6. The recipient of personal information, if it is provided routinely or repetitively;
7. Other matters prescribed by Presidential Decree.
(2) Paragraph (1) shall not apply to any of the following personal information files: <Amended on Mar. 14, 2023>
1. Personal information files that record national security, diplomatic secrets, and other matters relating to grave national interests;
2. Personal information files that record the investigation of crimes, institution and maintenance of a prosecution, punishment, and probation and custody, corrective orders, protective orders, security observation orders, and immigration;
3. Personal information files that record the investigations of violations of the Punishment of Tax Offenses Act and the Customs Act;
4. Personal information files prescribed by Presidential Decree, which are recognized as having little need for continuous management, such as ephemeral files;
5. Classified personal information files pursuant to other statutes or regulations.
(3) The Protection Commission may, if necessary, review where personal information files are registered and the content thereof under paragraph (1), and may recommend that the head of a relevant public institution make improvements. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(4) If necessary to guarantee the rights of data subjects, the Protection Commission shall make public the status of registered personal information files under paragraph (1) so that anyone may access them with ease. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(5) Matters necessary for the registration referred to in paragraph (1), the method, scope, and procedure of public disclosure referred to in paragraph (4), shall be prescribed by Presidential Decree.
(6) The registration and public disclosure of the personal information files retained by the National Assembly, the Court, the Constitutional Court and the National Election Commission (including their affiliated entities) shall be prescribed by the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, and the National Election Commission Regulations.
제32조(개인정보파일의 등록 및 공개)
① 공공기관의 장이 개인정보파일을 운용하는 경우에는 다음 각 호의 사항을 보호위원회에 등록하여야 한다. 등록한 사항이 변경된 경우에도 또한 같다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
1. 개인정보파일의 명칭
2. 개인정보파일의 운영 근거 및 목적
3. 개인정보파일에 기록되는 개인정보의 항목
4. 개인정보의 처리방법
5. 개인정보의 보유기간
6. 개인정보를 통상적 또는 반복적으로 제공하는 경우에는 그 제공받는 자
7. 그 밖에 대통령령으로 정하는 사항
② 다음 각 호의 어느 하나에 해당하는 개인정보파일에 대하여는 제1항을 적용하지 아니한다. <개정 2023. 3. 14.>
1. 국가 안전, 외교상 비밀, 그 밖에 국가의 중대한 이익에 관한 사항을 기록한 개인정보파일
2. 범죄의 수사, 공소의 제기 및 유지, 형 및 감호의 집행, 교정처분, 보호처분, 보안관찰처분과 출입국관리에 관한 사항을 기록한 개인정보파일
3. 「조세범처벌법」에 따른 범칙행위 조사 및 「관세법」에 따른 범칙행위 조사에 관한 사항을 기록한 개인정보파일
4. 일회적으로 운영되는 파일 등 지속적으로 관리할 필요성이 낮다고 인정되어 대통령령으로 정하는 개인정보파일
5. 다른 법령에 따라 비밀로 분류된 개인정보파일
③ 보호위원회는 필요하면 제1항에 따른 개인정보파일의 등록여부와 그 내용을 검토하여 해당 공공기관의 장에게 개선을 권고할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
④ 보호위원회는 정보주체의 권리 보장 등을 위하여 필요한 경우 제1항에 따른 개인정보파일의 등록 현황을 누구든지 쉽게 열람할 수 있도록 공개할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
⑤ 제1항에 따른 등록과 제4항에 따른 공개의 방법, 범위 및 절차에 관하여 필요한 사항은 대통령령으로 정한다.
⑥ 국회, 법원, 헌법재판소, 중앙선거관리위원회(그 소속 기관을 포함한다)의 개인정보파일 등록 및 공개에 관하여는 국회규칙, 대법원규칙, 헌법재판소규칙 및 중앙선거관리위원회규칙으로 정한다.
Article 32 (Registration and Disclosure of Personal Information Files)
(1) Upon operating personal information files, the head of a public institution shall register the following matters with the Protection Commission. The same shall also apply where the registered matters are modified: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
1. The titles of the personal information files;
2. The grounds and purposes for the operation of the personal information files;
3. Particulars of personal information that are recorded in the personal information files;
4. The method of processing personal information;
5. The period for retaining personal information;
6. The recipient of personal information, if it is provided routinely or repetitively;
7. Other matters prescribed by Presidential Decree.
(2) Paragraph (1) shall not apply to any of the following personal information files: <Amended on Mar. 14, 2023>
1. Personal information files that record national security, diplomatic secrets, and other matters relating to grave national interests;
2. Personal information files that record the investigation of crimes, institution and maintenance of a prosecution, punishment, and probation and custody, corrective orders, protective orders, security observation orders, and immigration;
3. Personal information files that record the investigations of violations of the Punishment of Tax Offenses Act and the Customs Act;
4. Personal information files prescribed by Presidential Decree, which are recognized as having little need for continuous management, such as ephemeral files;
5. Classified personal information files pursuant to other statutes or regulations.
(3) The Protection Commission may, if necessary, review where personal information files are registered and the content thereof under paragraph (1), and may recommend that the head of a relevant public institution make improvements. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(4) If necessary to guarantee the rights of data subjects, the Protection Commission shall make public the status of registered personal information files under paragraph (1) so that anyone may access them with ease. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(5) Matters necessary for the registration referred to in paragraph (1), the method, scope, and procedure of public disclosure referred to in paragraph (4), shall be prescribed by Presidential Decree.
(6) The registration and public disclosure of the personal information files retained by the National Assembly, the Court, the Constitutional Court and the National Election Commission (including their affiliated entities) shall be prescribed by the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, and the National Election Commission Regulations.
Article 32-2 (Certification of Personal Information Protection)
(1) The Protection Commission may certify whether the data processing and other data protection-related action of a personal information controller abide by this Act, etc. <Amended on Jul. 26, 2017; Feb. 4, 2020>
(2) The certification provided for in paragraph (1) shall be effective for three years.
(3) In any of the following cases, the Protection Commission may revoke the certification granted under paragraph (1), as prescribed by Presidential Decree: Provided, That it shall be revoked in cases falling under subparagraph 1: <Amended on Jul. 26, 2017; Feb. 4, 2020>
1. Where personal information protection has been certified by fraud or other improper means;
2. Where follow-up management provided for in paragraph (4) has been denied or obstructed;
3. Where the certification criteria provided for in paragraph (8) have not been satisfied;
4. Where personal information protection-related statutes or regulations are breached, and the grounds for the violation are material.
(4) The Protection Commission shall conduct follow-up management at least once annually to maintain the effectiveness of the certification of personal information protection. <Amended on Jul. 26, 2017; Feb. 4, 2020>
(5) The Protection Commission may authorize the specialized institutions prescribed by Presidential Decree to perform the work related to certification under paragraph (1), revocation of certification under paragraph (3), follow-up management under paragraph (4), management of certification examiners under paragraph (7). <Amended on Jul. 26, 2017; Feb. 4, 2020>
(6) Any person who has obtained certification under paragraph (1) may indicate or promote the details of the certification, as prescribed by Presidential Decree.
(7) Qualifications of certification examiners who conduct the certification examination subject to paragraph (1), criteria for disqualification, and other related matters shall be prescribed by Presidential Decree, taking into account specialty, career, and other necessary matters.
(8) Other matters necessary for the certification criteria, method, procedure, etc. subject to paragraph (1), including whether the personal information management system, guarantee of data subjects’ rights, and measures to ensure safety are based on this Act, shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Jul. 24, 2015]
제32조의2(개인정보 보호 인증)
① 보호위원회는 개인정보처리자의 개인정보 처리 및 보호와 관련한 일련의 조치가 이 법에 부합하는지 등에 관하여 인증할 수 있다. <개정 2017. 7. 26., 2020. 2. 4.>
② 제1항에 따른 인증의 유효기간은 3년으로 한다.
③ 보호위원회는 다음 각 호의 어느 하나에 해당하는 경우에는 대통령령으로 정하는 바에 따라 제1항에 따른 인증을 취소할 수 있다. 다만, 제1호에 해당하는 경우에는 취소하여야 한다. <개정 2017. 7. 26., 2020. 2. 4.>
1. 거짓이나 그 밖의 부정한 방법으로 개인정보 보호 인증을 받은 경우
2. 제4항에 따른 사후관리를 거부 또는 방해한 경우
3. 제8항에 따른 인증기준에 미달하게 된 경우
4. 개인정보 보호 관련 법령을 위반하고 그 위반사유가 중대한 경우
④ 보호위원회는 개인정보 보호 인증의 실효성 유지를 위하여 연 1회 이상 사후관리를 실시하여야 한다. <개정 2017. 7. 26., 2020. 2. 4.>
⑤ 보호위원회는 대통령령으로 정하는 전문기관으로 하여금 제1항에 따른 인증, 제3항에 따른 인증 취소, 제4항에 따른 사후관리 및 제7항에 따른 인증 심사원 관리 업무를 수행하게 할 수 있다. <개정 2017. 7. 26., 2020. 2. 4.>
⑥ 제1항에 따른 인증을 받은 자는 대통령령으로 정하는 바에 따라 인증의 내용을 표시하거나 홍보할 수 있다.
⑦ 제1항에 따른 인증을 위하여 필요한 심사를 수행할 심사원의 자격 및 자격 취소 요건 등에 관하여는 전문성과 경력 및 그 밖에 필요한 사항을 고려하여 대통령령으로 정한다.
⑧ 그 밖에 개인정보 관리체계, 정보주체 권리보장, 안전성 확보조치가 이 법에 부합하는지 여부 등 제1항에 따른 인증의 기준ㆍ방법ㆍ절차 등 필요한 사항은 대통령령으로 정한다.
[본조신설 2015. 7. 24.]
Article 32-2 (Certification of Personal Information Protection)
(1) The Protection Commission may certify whether the data processing and other data protection-related action of a personal information controller abide by this Act, etc. <Amended on Jul. 26, 2017; Feb. 4, 2020>
(2) The certification provided for in paragraph (1) shall be effective for three years.
(3) In any of the following cases, the Protection Commission may revoke the certification granted under paragraph (1), as prescribed by Presidential Decree: Provided, That it shall be revoked in cases falling under subparagraph 1: <Amended on Jul. 26, 2017; Feb. 4, 2020>
1. Where personal information protection has been certified by fraud or other improper means;
2. Where follow-up management provided for in paragraph (4) has been denied or obstructed;
3. Where the certification criteria provided for in paragraph (8) have not been satisfied;
4. Where personal information protection-related statutes or regulations are breached, and the grounds for the violation are material.
(4) The Protection Commission shall conduct follow-up management at least once annually to maintain the effectiveness of the certification of personal information protection. <Amended on Jul. 26, 2017; Feb. 4, 2020>
(5) The Protection Commission may authorize the specialized institutions prescribed by Presidential Decree to perform the work related to certification under paragraph (1), revocation of certification under paragraph (3), follow-up management under paragraph (4), management of certification examiners under paragraph (7). <Amended on Jul. 26, 2017; Feb. 4, 2020>
(6) Any person who has obtained certification under paragraph (1) may indicate or promote the details of the certification, as prescribed by Presidential Decree.
(7) Qualifications of certification examiners who conduct the certification examination subject to paragraph (1), criteria for disqualification, and other related matters shall be prescribed by Presidential Decree, taking into account specialty, career, and other necessary matters.
(8) Other matters necessary for the certification criteria, method, procedure, etc. subject to paragraph (1), including whether the personal information management system, guarantee of data subjects’ rights, and measures to ensure safety are based on this Act, shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Jul. 24, 2015]
Article 33 (Privacy Impact Assessment)
(1) Where there is a risk of a personal information breach of data subjects due to the operation of personal information files meeting the criteria prescribed by Presidential Decree, the head of a public institution shall conduct an assessment to analyze risk factors and to improve them (hereinafter referred to as “privacy impact assessment”), and submit the results thereof to the Protection Commission. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(2) The Protection Commission may designate a person who satisfies the requirements prescribed by Presidential Decree such as human resources and facilities as an institution that performs a privacy impact assessment (hereinafter referred to as "assessment institution"), and the head of a public institution shall request the assessment institution to conduct the privacy impact assessment. <Newly Inserted on Mar. 14, 2023>
(3) Privacy impact assessments shall take into account the following: <Amended on Mar. 14, 2023>
1. The number of personal information being processed;
2. Whether the personal information is provided to a third party;
3. The probability to violate the rights of the data subjects and the degree of risks;
4. Other matters prescribed by Presidential Decree.
(4) The Protection Commission may provide its opinion on the privacy impact assessment results submitted under paragraph (1). <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(5) The head of a public institution shall register the personal information files in accordance with Article 32 (1), for which the privacy impact assessment has been conducted pursuant to paragraph (1), with the results of the privacy impact assessment attached thereto. <Amended on Mar. 14, 2023>
(6) The Protection Commission shall take necessary measures, such as fostering relevant specialists, and developing and disseminating criteria for the privacy impact assessment, to promote the privacy impact assessment. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(7) The Protection Commission may revoke the designation of an assessment institution that has obtained designation under paragraph (2) in any of the following cases: Provided, That it shall revoke the designation in cases falling under subparagraph 1 or 2: <Newly Inserted on Mar. 14, 2023>
1. Where the designated assessment institution has obtained its designation by fraud or other improper means;
2. Where the designated assessment institution wants revocation of such designation or has closed its business;
3. Where the designated assessment institution ceases to meet the requirements for designation provided in paragraph (2);
4. Where the designated assessment institution has poorly performed its work either by intention or gross negligence, and is deemed incapable of duly performing its affairs;
5. Other cases that fall under any ground prescribed by Presidential Decree.
(8) Where the Protection Commission revokes designation pursuant to paragraph (7), it shall hold a hearing in accordance with the Administrative Procedures Act. <Newly Inserted on Mar. 14, 2023>
(9) Matters necessary for the criteria, methods, procedures, etc. for privacy impact assessments under paragraph (1) shall be prescribed by Presidential Decree. <Amended on Mar. 14, 2023>
(10) Matters regarding the privacy impact assessment conducted by the National Assembly, the Court, the Constitutional Court and the National Election Commission (including their affiliated entities) shall be prescribed by the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, and the National Election Commission Regulations. <Amended on Mar. 14, 2023>
(11) A personal information controller other than public institutions shall proactively endeavor to conduct a privacy impact assessment, if there is a risk of a personal information beach of data subjects in operating the personal information files. <Amended on Mar. 14, 2023>
제33조(개인정보 영향평가)
① 공공기관의 장은 대통령령으로 정하는 기준에 해당하는 개인정보파일의 운용으로 인하여 정보주체의 개인정보 침해가 우려되는 경우에는 그 위험요인의 분석과 개선 사항 도출을 위한 평가(이하 “영향평가”라 한다)를 하고 그 결과를 보호위원회에 제출하여야 한다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
② 보호위원회는 대통령령으로 정하는 인력ㆍ설비 및 그 밖에 필요한 요건을 갖춘 자를 영향평가를 수행하는 기관(이하 “평가기관”이라 한다)으로 지정할 수 있으며, 공공기관의 장은 영향평가를 평가기관에 의뢰하여야 한다. <신설 2023. 3. 14.>
③ 영향평가를 하는 경우에는 다음 각 호의 사항을 고려하여야 한다. <개정 2023. 3. 14.>
1. 처리하는 개인정보의 수
2. 개인정보의 제3자 제공 여부
3. 정보주체의 권리를 해할 가능성 및 그 위험 정도
4. 그 밖에 대통령령으로 정한 사항
④ 보호위원회는 제1항에 따라 제출받은 영향평가 결과에 대하여 의견을 제시할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
⑤ 공공기관의 장은 제1항에 따라 영향평가를 한 개인정보파일을 제32조제1항에 따라 등록할 때에는 영향평가 결과를 함께 첨부하여야 한다. <개정 2023. 3. 14.>
⑥ 보호위원회는 영향평가의 활성화를 위하여 관계 전문가의 육성, 영향평가 기준의 개발ㆍ보급 등 필요한 조치를 마련하여야 한다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
⑦ 보호위원회는 제2항에 따라 지정된 평가기관이 다음 각 호의 어느 하나에 해당하는 경우에는 평가기관의 지정을 취소할 수 있다. 다만, 제1호 또는 제2호에 해당하는 경우에는 평가기관의 지정을 취소하여야 한다. <신설 2023. 3. 14.>
1. 거짓이나 그 밖의 부정한 방법으로 지정을 받은 경우
2. 지정된 평가기관 스스로 지정취소를 원하거나 폐업한 경우
3. 제2항에 따른 지정요건을 충족하지 못하게 된 경우
4. 고의 또는 중대한 과실로 영향평가업무를 부실하게 수행하여 그 업무를 적정하게 수행할 수 없다고 인정되는 경우
5. 그 밖에 대통령령으로 정하는 사유에 해당하는 경우
⑧ 보호위원회는 제7항에 따라 지정을 취소하는 경우에는 「행정절차법」에 따른 청문을 실시하여야 한다. <신설 2023. 3. 14.>
⑨ 제1항에 따른 영향평가의 기준ㆍ방법ㆍ절차 등에 관하여 필요한 사항은 대통령령으로 정한다. <개정 2023. 3. 14.>
⑩ 국회, 법원, 헌법재판소, 중앙선거관리위원회(그 소속 기관을 포함한다)의 영향평가에 관한 사항은 국회규칙, 대법원규칙, 헌법재판소규칙 및 중앙선거관리위원회규칙으로 정하는 바에 따른다. <개정 2023. 3. 14.>
⑪ 공공기관 외의 개인정보처리자는 개인정보파일 운용으로 인하여 정보주체의 개인정보 침해가 우려되는 경우에는 영향평가를 하기 위하여 적극 노력하여야 한다. <개정 2023. 3. 14.>
Article 33 (Privacy Impact Assessment)
(1) Where there is a risk of a personal information breach of data subjects due to the operation of personal information files meeting the criteria prescribed by Presidential Decree, the head of a public institution shall conduct an assessment to analyze risk factors and to improve them (hereinafter referred to as “privacy impact assessment”), and submit the results thereof to the Protection Commission. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(2) The Protection Commission may designate a person who satisfies the requirements prescribed by Presidential Decree such as human resources and facilities as an institution that performs a privacy impact assessment (hereinafter referred to as "assessment institution"), and the head of a public institution shall request the assessment institution to conduct the privacy impact assessment. <Newly Inserted on Mar. 14, 2023>
(3) Privacy impact assessments shall take into account the following: <Amended on Mar. 14, 2023>
1. The number of personal information being processed;
2. Whether the personal information is provided to a third party;
3. The probability to violate the rights of the data subjects and the degree of risks;
4. Other matters prescribed by Presidential Decree.
(4) The Protection Commission may provide its opinion on the privacy impact assessment results submitted under paragraph (1). <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(5) The head of a public institution shall register the personal information files in accordance with Article 32 (1), for which the privacy impact assessment has been conducted pursuant to paragraph (1), with the results of the privacy impact assessment attached thereto. <Amended on Mar. 14, 2023>
(6) The Protection Commission shall take necessary measures, such as fostering relevant specialists, and developing and disseminating criteria for the privacy impact assessment, to promote the privacy impact assessment. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(7) The Protection Commission may revoke the designation of an assessment institution that has obtained designation under paragraph (2) in any of the following cases: Provided, That it shall revoke the designation in cases falling under subparagraph 1 or 2: <Newly Inserted on Mar. 14, 2023>
1. Where the designated assessment institution has obtained its designation by fraud or other improper means;
2. Where the designated assessment institution wants revocation of such designation or has closed its business;
3. Where the designated assessment institution ceases to meet the requirements for designation provided in paragraph (2);
4. Where the designated assessment institution has poorly performed its work either by intention or gross negligence, and is deemed incapable of duly performing its affairs;
5. Other cases that fall under any ground prescribed by Presidential Decree.
(8) Where the Protection Commission revokes designation pursuant to paragraph (7), it shall hold a hearing in accordance with the Administrative Procedures Act. <Newly Inserted on Mar. 14, 2023>
(9) Matters necessary for the criteria, methods, procedures, etc. for privacy impact assessments under paragraph (1) shall be prescribed by Presidential Decree. <Amended on Mar. 14, 2023>
(10) Matters regarding the privacy impact assessment conducted by the National Assembly, the Court, the Constitutional Court and the National Election Commission (including their affiliated entities) shall be prescribed by the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, and the National Election Commission Regulations. <Amended on Mar. 14, 2023>
(11) A personal information controller other than public institutions shall proactively endeavor to conduct a privacy impact assessment, if there is a risk of a personal information beach of data subjects in operating the personal information files. <Amended on Mar. 14, 2023>
Article 34 (Notification and Reporting of Divulgence of Personal Information)
(1) A personal information controller shall notify data subjects of the following matters without delay when the personal information controller becomes aware of loss, theft, or divulgence (hereafter in this Article referred to as "divulgence, etc.") of personal information: Provided, That if the contact information of the data subject is unknown or if any other good cause exists, a measure may be taken in lieu of giving notice, as prescribed by Presidential Decree: <Amended on Mar. 14, 2023>
1. Particulars of divulgence, etc. of personal information;
2. When and how divulgence, etc. of personal is made;
3. Any information about how the data subjects can minimize the risk of damage from divulgence, etc.;
4. Countermeasures taken by the personal information controller and remedial procedure;
5. Help desk and contact points for the data subjects to report damage.
(2) A personal information controller shall prepare countermeasures to minimize the risk of damage in the case of divulgence, etc. of personal information and take necessary measures. <Amended on Mar. 14, 2023>
(3) Upon becoming aware of divulgence, etc. of personal information, the personal information controller shall, without delay, file a report with the Protection Commission or a specialized institution designated by Presidential Decree with respect to the matters provided in the subparagraphs of paragraph (1), as prescribed by Presidential Decree in consideration of the types of personal information, the process and scale of divulgence, etc., and other factors. In such cases, the Protection Commission and the specialized institution designated by Presidential Decree may provide technical assistance for the prevention of the spread of damage, recovery from damage, and other purposes. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(4) Matters necessary for notifying divulgence, etc. under paragraph (1) and timing, methods, and procedures for reporting breach, etc. under paragraph (3) shall be prescribed by Presidential Decree. <Amended on Mar. 14, 2023>
[Title Amended on Mar. 14, 2023]
제34조(개인정보 유출 등의 통지ㆍ신고)
① 개인정보처리자는 개인정보가 분실ㆍ도난ㆍ유출(이하 이 조에서 “유출등”이라 한다)되었음을 알게 되었을 때에는 지체 없이 해당 정보주체에게 다음 각 호의 사항을 알려야 한다. 다만, 정보주체의 연락처를 알 수 없는 경우 등 정당한 사유가 있는 경우에는 대통령령으로 정하는 바에 따라 통지를 갈음하는 조치를 취할 수 있다. <개정 2023. 3. 14.>
1. 유출등이 된 개인정보의 항목
2. 유출등이 된 시점과 그 경위
3. 유출등으로 인하여 발생할 수 있는 피해를 최소화하기 위하여 정보주체가 할 수 있는 방법 등에 관한 정보
4. 개인정보처리자의 대응조치 및 피해 구제절차
5. 정보주체에게 피해가 발생한 경우 신고 등을 접수할 수 있는 담당부서 및 연락처
② 개인정보처리자는 개인정보가 유출등이 된 경우 그 피해를 최소화하기 위한 대책을 마련하고 필요한 조치를 하여야 한다. <개정 2023. 3. 14.>
③ 개인정보처리자는 개인정보의 유출등이 있음을 알게 되었을 때에는 개인정보의 유형, 유출등의 경로 및 규모 등을 고려하여 대통령령으로 정하는 바에 따라 제1항 각 호의 사항을 지체 없이 보호위원회 또는 대통령령으로 정하는 전문기관에 신고하여야 한다. 이 경우 보호위원회 또는 대통령령으로 정하는 전문기관은 피해 확산방지, 피해 복구 등을 위한 기술을 지원할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
④ 제1항에 따른 유출등의 통지 및 제3항에 따른 유출등의 신고의 시기, 방법, 절차 등에 필요한 사항은 대통령령으로 정한다. <개정 2023. 3. 14.>
[제목개정 2023. 3. 14.]
Article 34 (Notification and Reporting of Divulgence of Personal Information)
(1) A personal information controller shall notify data subjects of the following matters without delay when the personal information controller becomes aware of loss, theft, or divulgence (hereafter in this Article referred to as "divulgence, etc.") of personal information: Provided, That if the contact information of the data subject is unknown or if any other good cause exists, a measure may be taken in lieu of giving notice, as prescribed by Presidential Decree: <Amended on Mar. 14, 2023>
1. Particulars of divulgence, etc. of personal information;
2. When and how divulgence, etc. of personal is made;
3. Any information about how the data subjects can minimize the risk of damage from divulgence, etc.;
4. Countermeasures taken by the personal information controller and remedial procedure;
5. Help desk and contact points for the data subjects to report damage.
(2) A personal information controller shall prepare countermeasures to minimize the risk of damage in the case of divulgence, etc. of personal information and take necessary measures. <Amended on Mar. 14, 2023>
(3) Upon becoming aware of divulgence, etc. of personal information, the personal information controller shall, without delay, file a report with the Protection Commission or a specialized institution designated by Presidential Decree with respect to the matters provided in the subparagraphs of paragraph (1), as prescribed by Presidential Decree in consideration of the types of personal information, the process and scale of divulgence, etc., and other factors. In such cases, the Protection Commission and the specialized institution designated by Presidential Decree may provide technical assistance for the prevention of the spread of damage, recovery from damage, and other purposes. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(4) Matters necessary for notifying divulgence, etc. under paragraph (1) and timing, methods, and procedures for reporting breach, etc. under paragraph (3) shall be prescribed by Presidential Decree. <Amended on Mar. 14, 2023>
[Title Amended on Mar. 14, 2023]
Article 34-2 (Erasure and Blocking of Exposed Personal Information)
(1) A personal information processor shall make sure to prevent personal information such as personally identifiable information, account information, and credit card information from being exposed to the public through information and communications networks. <Amended on Mar. 14, 2023>
(2) With respect to personal information exposed to the public, if requested by the Protection Commission or a specialized institution designated by Presidential Decree, the personal information controller shall take necessary measures such as erasing or blocking the relevant information. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
[Moved from Article 39-10; previous Article 34-2 Deleted]
제34조의2(노출된 개인정보의 삭제ㆍ차단)
① 개인정보처리자는 고유식별정보, 계좌정보, 신용카드정보 등 개인정보가 정보통신망을 통하여 공중(公衆)에 노출되지 아니하도록 하여야 한다. <개정 2023. 3. 14.>
② 개인정보처리자는 공중에 노출된 개인정보에 대하여 보호위원회 또는 대통령령으로 지정한 전문기관의 요청이 있는 경우에는 해당 정보를 삭제하거나 차단하는 등 필요한 조치를 하여야 한다. <개정 2023. 3. 14.>
[본조신설 2020. 2. 4.]
[제39조의10에서 이동, 종전 제34조의2는 삭제
Article 34-2 (Erasure and Blocking of Exposed Personal Information)
(1) A personal information processor shall make sure to prevent personal information such as personally identifiable information, account information, and credit card information from being exposed to the public through information and communications networks. <Amended on Mar. 14, 2023>
(2) With respect to personal information exposed to the public, if requested by the Protection Commission or a specialized institution designated by Presidential Decree, the personal information controller shall take necessary measures such as erasing or blocking the relevant information. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
[Moved from Article 39-10; previous Article 34-2 Deleted]
CHAPTER V GUARANTEE OF RIGHTS OF DATA SUBJECTS
제5장 정보주체의 권리 보장
CHAPTER V GUARANTEE OF RIGHTS OF DATA SUBJECTS
Article 35 (Access to Personal Information)
(1) A data subject may request access to his or her own personal information, which is processed by a personal information controller, from the personal information controller.
(2) Notwithstanding paragraph (1), where a data subject intends to request access to his or her own personal information from a public institution, the data subject may request such access directly from the said public institution, or indirectly via the Protection Commission, as prescribed by Presidential Decree. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) Upon receipt of a request for access filed under paragraphs (1) and (2), a personal information controller shall grant the data subject access to his or her own personal information within the period prescribed by Presidential Decree. In such cases, if there is good cause for not permitting access during such period, the personal information controller may postpone access after notifying the relevant data subject of the said ground and if the said ground ceases to exist, the data subject shall be permitted to access the personal information without delay.
(4) In any of the following cases, a personal information controller may limit or deny access after it notifies a data subject of the cause:
1. Where access is prohibited or limited by statutes;
2. Where access may cause damage to the life or body of a third party, or unjustified infringement of property and other interests of any other person;
3. Where a public institution has grave difficulties in performing any of the following work:
(a) Imposition, collection or refund of taxes;
(b) Evaluation of academic achievements or admission affairs at the schools of each level established under the Elementary and Secondary Education Act and the Higher Education Act, lifelong educational facilities established under the Lifelong Education Act, and other higher educational institutions established under other statutes;
(c) Testing and qualification examination regarding academic competence, technical capability and employment;
(d) Ongoing evaluation or decision-making in relation to compensation or grant assessment;
(e) Ongoing audit and examination under other statutes.
(5) Matters necessary for the methods and procedures to file access requests, to limit access, to give notification, etc. pursuant to paragraphs (1) through (4) shall be prescribed by Presidential Decree.
제35조(개인정보의 열람)
① 정보주체는 개인정보처리자가 처리하는 자신의 개인정보에 대한 열람을 해당 개인정보처리자에게 요구할 수 있다.
② 제1항에도 불구하고 정보주체가 자신의 개인정보에 대한 열람을 공공기관에 요구하고자 할 때에는 공공기관에 직접 열람을 요구하거나 대통령령으로 정하는 바에 따라 보호위원회를 통하여 열람을 요구할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
③ 개인정보처리자는 제1항 및 제2항에 따른 열람을 요구받았을 때에는 대통령령으로 정하는 기간 내에 정보주체가 해당 개인정보를 열람할 수 있도록 하여야 한다. 이 경우 해당 기간 내에 열람할 수 없는 정당한 사유가 있을 때에는 정보주체에게 그 사유를 알리고 열람을 연기할 수 있으며, 그 사유가 소멸하면 지체 없이 열람하게 하여야 한다.
④ 개인정보처리자는 다음 각 호의 어느 하나에 해당하는 경우에는 정보주체에게 그 사유를 알리고 열람을 제한하거나 거절할 수 있다.
1. 법률에 따라 열람이 금지되거나 제한되는 경우
2. 다른 사람의 생명ㆍ신체를 해할 우려가 있거나 다른 사람의 재산과 그 밖의 이익을 부당하게 침해할 우려가 있는 경우
3. 공공기관이 다음 각 목의 어느 하나에 해당하는 업무를 수행할 때 중대한 지장을 초래하는 경우
가. 조세의 부과ㆍ징수 또는 환급에 관한 업무
나. 「초ㆍ중등교육법」 및 「고등교육법」에 따른 각급 학교, 「평생교육법」에 따른 평생교육시설, 그 밖의 다른 법률에 따라 설치된 고등교육기관에서의 성적 평가 또는 입학자 선발에 관한 업무
다. 학력ㆍ기능 및 채용에 관한 시험, 자격 심사에 관한 업무
라. 보상금ㆍ급부금 산정 등에 대하여 진행 중인 평가 또는 판단에 관한 업무
마. 다른 법률에 따라 진행 중인 감사 및 조사에 관한 업무
⑤ 제1항부터 제4항까지의 규정에 따른 열람 요구, 열람 제한, 통지 등의 방법 및 절차에 관하여 필요한 사항은 대통령령으로 정한다.
Article 35 (Access to Personal Information)
(1) A data subject may request access to his or her own personal information, which is processed by a personal information controller, from the personal information controller.
(2) Notwithstanding paragraph (1), where a data subject intends to request access to his or her own personal information from a public institution, the data subject may request such access directly from the said public institution, or indirectly via the Protection Commission, as prescribed by Presidential Decree. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) Upon receipt of a request for access filed under paragraphs (1) and (2), a personal information controller shall grant the data subject access to his or her own personal information within the period prescribed by Presidential Decree. In such cases, if there is good cause for not permitting access during such period, the personal information controller may postpone access after notifying the relevant data subject of the said ground and if the said ground ceases to exist, the data subject shall be permitted to access the personal information without delay.
(4) In any of the following cases, a personal information controller may limit or deny access after it notifies a data subject of the cause:
1. Where access is prohibited or limited by statutes;
2. Where access may cause damage to the life or body of a third party, or unjustified infringement of property and other interests of any other person;
3. Where a public institution has grave difficulties in performing any of the following work:
(a) Imposition, collection or refund of taxes;
(b) Evaluation of academic achievements or admission affairs at the schools of each level established under the Elementary and Secondary Education Act and the Higher Education Act, lifelong educational facilities established under the Lifelong Education Act, and other higher educational institutions established under other statutes;
(c) Testing and qualification examination regarding academic competence, technical capability and employment;
(d) Ongoing evaluation or decision-making in relation to compensation or grant assessment;
(e) Ongoing audit and examination under other statutes.
(5) Matters necessary for the methods and procedures to file access requests, to limit access, to give notification, etc. pursuant to paragraphs (1) through (4) shall be prescribed by Presidential Decree.
Article 35-2 (Request for Transmission of Personal Information)
(1) A data subject may request the personal information controller satisfying the criteria prescribed by Presidential Decree in consideration of the ability to process personal information, etc. to transmit to him or her personal information that satisfies all of the following requirements:
1. The personal information, the transmission of which is requested by the data subject, shall be any of the following personal information on himself or herself:
(a) Personal information processed with consent under Article 15 (1) 1, 23 (1) 1, or 24 (1) 1;
(b) Personal information processed to take measures at the request of a data subject in the course of performing or concluding a contract under Article 15 (1) 4;
(c) Among the personal information processed pursuant to Article 15 (1) 2 and 3, Article 23 (1) 2, or Article 24 (1) 2, the personal information designated as being subject to request for transmission by deliberation and resolution by the Protection Commission at the request of the head of a relevant central administrative agency for the interest of a data subject or public interest of a data subject;
2. Personal information, the transmission of which is requested, shall not be information separately generated by analyzing and processing the personal information collected by a personal information controller;
3. The personal information, the transmission of which is requested, shall be the personal information processed by a computer or any other information processing device.
(2) A data subject may request a personal information controller satisfying the criteria prescribed by Presidential Decree in consideration of the sales, the scale of personal information retained, the capability of personal information processing, industrial characteristics, and other relevant factors, to transmit his or her personal information requested under paragraph (1) to the following persons, to the extent it is technically feasible and reasonable:
1. Institutions specializing in managing personal information under Article 35-3 (1);
2. A person who fulfills his or her duty of safeguards under Article 29 and meets the standards for facilities and technology prescribed by Presidential Decree.
(3) Upon receipt of a request for transmission under paragraphs (1) and (2), the personal information controller shall transmit the relevant information in a form processable through a computer or other information processing device to the extent reasonable in terms of time, expenses, and technology.
(4) Upon receipt of a request for transmission under paragraphs (1) and (2), a personal information controller shall transmit the personal information of the data subject, notwithstanding the relevant provisions of any of the following statutes:
1. Article 81-13 of the Framework Act on National Taxes;
2. Article 86 of the Framework Act on Local Taxes;
3. Provisions of statutes prescribed by Presidential Decree, which are similar to those provided in subparagraphs 1 and 2.
(5) A data subject may withdraw his or her request for transmission under paragraphs (1) and (2).
(6) A personal information controller may refuse the request for transmission under paragraph (1) or (2) or suspend the transmission in cases prescribed by Presidential Decree, such as where it is impossible to verify whether a data subject is the person in question.
(7) No data subject shall infringe upon another person's rights or legitimate interests on the grounds of a request for transmission under paragraphs (1) and (2).
(8) Except as provided in paragraphs (1) through (7), necessary matters, such as the scope of information subject to a request for transmission, methods of requesting transmission, deadlines and methods for transmission, methods of withdrawing requests for transmission, rejection of requests for transmission, and methods of suspending transmission, shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제35조의2(개인정보의 전송 요구)
① 정보주체는 개인정보 처리 능력 등을 고려하여 대통령령으로 정하는 기준에 해당하는 개인정보처리자에 대하여 다음 각 호의 요건을 모두 충족하는 개인정보를 자신에게로 전송할 것을 요구할 수 있다.
1. 정보주체가 전송을 요구하는 개인정보가 정보주체 본인에 관한 개인정보로서 다음 각 목의 어느 하나에 해당하는 정보일 것
가. 제15조제1항제1호, 제23조제1항제1호 또는 제24조제1항제1호에 따른 동의를 받아 처리되는 개인정보
나. 제15조제1항제4호에 따라 체결한 계약을 이행하거나 계약을 체결하는 과정에서 정보주체의 요청에 따른 조치를 이행하기 위하여 처리되는 개인정보
다. 제15조제1항제2호ㆍ제3호, 제23조제1항제2호 또는 제24조제1항제2호에 따라 처리되는 개인정보 중 정보주체의 이익이나 공익적 목적을 위하여 관계 중앙행정기관의 장의 요청에 따라 보호위원회가 심의ㆍ의결하여 전송 요구의 대상으로 지정한 개인정보
2. 전송을 요구하는 개인정보가 개인정보처리자가 수집한 개인정보를 기초로 분석ㆍ가공하여 별도로 생성한 정보가 아닐 것
3. 전송을 요구하는 개인정보가 컴퓨터 등 정보처리장치로 처리되는 개인정보일 것
② 정보주체는 매출액, 개인정보의 보유 규모, 개인정보 처리 능력, 산업별 특성 등을 고려하여 대통령령으로 정하는 기준에 해당하는 개인정보처리자에 대하여 제1항에 따른 전송 요구 대상인 개인정보를 기술적으로 허용되는 합리적인 범위에서 다음 각 호의 자에게 전송할 것을 요구할 수 있다.
1. 제35조의3제1항에 따른 개인정보관리 전문기관
2. 제29조에 따른 안전조치의무를 이행하고 대통령령으로 정하는 시설 및 기술 기준을 충족하는 자
③ 개인정보처리자는 제1항 및 제2항에 따른 전송 요구를 받은 경우에는 시간, 비용, 기술적으로 허용되는 합리적인 범위에서 해당 정보를 컴퓨터 등 정보처리장치로 처리 가능한 형태로 전송하여야 한다.
④ 제1항 및 제2항에 따른 전송 요구를 받은 개인정보처리자는 다음 각 호의 어느 하나에 해당하는 법률의 관련 규정에도 불구하고 정보주체에 관한 개인정보를 전송하여야 한다.
1. 「국세기본법」 제81조의13
2. 「지방세기본법」 제86조
3. 그 밖에 제1호 및 제2호와 유사한 규정으로서 대통령령으로 정하는 법률의 규정
⑤ 정보주체는 제1항 및 제2항에 따른 전송 요구를 철회할 수 있다.
⑥ 개인정보처리자는 정보주체의 본인 여부가 확인되지 아니하는 경우 등 대통령령으로 정하는 경우에는 제1항 및 제2항에 따른 전송 요구를 거절하거나 전송을 중단할 수 있다.
⑦ 정보주체는 제1항 및 제2항에 따른 전송 요구로 인하여 타인의 권리나 정당한 이익을 침해하여서는 아니 된다.
⑧ 제1항부터 제7항까지에서 규정한 사항 외에 전송 요구의 대상이 되는 정보의 범위, 전송 요구의 방법, 전송의 기한 및 방법, 전송 요구 철회의 방법, 전송 요구의 거절 및 전송 중단의 방법 등 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 35-2 (Request for Transmission of Personal Information)
(1) A data subject may request the personal information controller satisfying the criteria prescribed by Presidential Decree in consideration of the ability to process personal information, etc. to transmit to him or her personal information that satisfies all of the following requirements:
1. The personal information, the transmission of which is requested by the data subject, shall be any of the following personal information on himself or herself:
(a) Personal information processed with consent under Article 15 (1) 1, 23 (1) 1, or 24 (1) 1;
(b) Personal information processed to take measures at the request of a data subject in the course of performing or concluding a contract under Article 15 (1) 4;
(c) Among the personal information processed pursuant to Article 15 (1) 2 and 3, Article 23 (1) 2, or Article 24 (1) 2, the personal information designated as being subject to request for transmission by deliberation and resolution by the Protection Commission at the request of the head of a relevant central administrative agency for the interest of a data subject or public interest of a data subject;
2. Personal information, the transmission of which is requested, shall not be information separately generated by analyzing and processing the personal information collected by a personal information controller;
3. The personal information, the transmission of which is requested, shall be the personal information processed by a computer or any other information processing device.
(2) A data subject may request a personal information controller satisfying the criteria prescribed by Presidential Decree in consideration of the sales, the scale of personal information retained, the capability of personal information processing, industrial characteristics, and other relevant factors, to transmit his or her personal information requested under paragraph (1) to the following persons, to the extent it is technically feasible and reasonable:
1. Institutions specializing in managing personal information under Article 35-3 (1);
2. A person who fulfills his or her duty of safeguards under Article 29 and meets the standards for facilities and technology prescribed by Presidential Decree.
(3) Upon receipt of a request for transmission under paragraphs (1) and (2), the personal information controller shall transmit the relevant information in a form processable through a computer or other information processing device to the extent reasonable in terms of time, expenses, and technology.
(4) Upon receipt of a request for transmission under paragraphs (1) and (2), a personal information controller shall transmit the personal information of the data subject, notwithstanding the relevant provisions of any of the following statutes:
1. Article 81-13 of the Framework Act on National Taxes;
2. Article 86 of the Framework Act on Local Taxes;
3. Provisions of statutes prescribed by Presidential Decree, which are similar to those provided in subparagraphs 1 and 2.
(5) A data subject may withdraw his or her request for transmission under paragraphs (1) and (2).
(6) A personal information controller may refuse the request for transmission under paragraph (1) or (2) or suspend the transmission in cases prescribed by Presidential Decree, such as where it is impossible to verify whether a data subject is the person in question.
(7) No data subject shall infringe upon another person's rights or legitimate interests on the grounds of a request for transmission under paragraphs (1) and (2).
(8) Except as provided in paragraphs (1) through (7), necessary matters, such as the scope of information subject to a request for transmission, methods of requesting transmission, deadlines and methods for transmission, methods of withdrawing requests for transmission, rejection of requests for transmission, and methods of suspending transmission, shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 35-3 (Institutions Specializing in Managing Personal Information)
(1) A person who intends to perform any of the following work shall be designated by the Protection Commission or the head of a relevant central administrative agency as an institution specializing in managing personal Information:
1. Support for the exercise of the right to request the transmission of personal information under Article 35-2;
2. Establishing and standardizing a personal information transmission system to support the exercise of the rights of data subjects;
3. Managing and analyzing personal information to support the exercise of rights of data subjects;
4. Other affairs prescribed by Presidential Decree to effectively support the exercise of the rights of data subjects.
(2) Requirements for designation as an institution specializing in managing personal information under paragraph (1) shall be as follows:
1. The applicant shall have the technical level and expertise to transmit, manage, and analyze personal information;
2. The applicant shall be equipped with a level of measures to ensure safety for safely managing personal information;
3. The applicant shall have the financial capability necessary for the stable operation of an institution specializing in managing personal Information.
(3) No institution specializing in managing personal information shall engage in any of the following acts:
1. Forcing a data subject to request the transmission of his or her personal information, or unfairly inducing it;
2. Any other act prescribed by Presidential Decree, which is likely to infringe on personal information or restrict the rights of a data subject.
(4) If an institution specializing in managing personal information falls under any of the following, the head of the Protection Commission or of a relevant central administrative agency may revoke the designation of the institution specializing in managing personal information: Provided, that he or she shall revoke such designation in cases falling under subparagraph 1:
1. Where the institution has obtained the designation by fraud or other improper means;
2. Where the institution ceases to meet the requirements for designation under paragraph (2).
(5) If the Protection Commission or the head of a relevant central administrative agency intends to revoke the designation under paragraph (4), he or she shall hold hearings under the Administrative Procedures Act.
(6) The Protection Commission and the head of a relevant central administrative agency may provide an institution specializing in managing personal information support necessary for performing its work.
(7) In performing affairs under the subparagraphs of paragraph (1) at the request of a data subject, an institution specializing in managing personal information may collect from the data subject expenses incurred in performing such work.
(8) Matters necessary for the procedures for the designation of an institution specializing in managing personal information under paragraph (1), the detailed requirements for designation under paragraph (2), the procedures for revocation of designation under paragraph (4), etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제35조의3(개인정보관리 전문기관)
① 다음 각 호의 업무를 수행하려는 자는 보호위원회 또는 관계 중앙행정기관의 장으로부터 개인정보관리 전문기관의 지정을 받아야 한다.
1. 제35조의2에 따른 개인정보의 전송 요구권 행사 지원
2. 정보주체의 권리행사를 지원하기 위한 개인정보 전송시스템의 구축 및 표준화
3. 정보주체의 권리행사를 지원하기 위한 개인정보의 관리ㆍ분석
4. 그 밖에 정보주체의 권리행사를 효과적으로 지원하기 위하여 대통령령으로 정하는 업무
② 제1항에 따른 개인정보관리 전문기관의 지정요건은 다음 각 호와 같다.
1. 개인정보를 전송ㆍ관리ㆍ분석할 수 있는 기술수준 및 전문성을 갖추었을 것
2. 개인정보를 안전하게 관리할 수 있는 안전성 확보조치 수준을 갖추었을 것
3. 개인정보관리 전문기관의 안정적인 운영에 필요한 재정능력을 갖추었을 것
③ 개인정보관리 전문기관은 다음 각 호의 어느 하나에 해당하는 행위를 하여서는 아니 된다.
1. 정보주체에게 개인정보의 전송 요구를 강요하거나 부당하게 유도하는 행위
2. 그 밖에 개인정보를 침해하거나 정보주체의 권리를 제한할 우려가 있는 행위로서 대통령령으로 정하는 행위
④ 보호위원회 및 관계 중앙행정기관의 장은 개인정보관리 전문기관이 다음 각 호의 어느 하나에 해당하는 경우에는 개인정보관리 전문기관의 지정을 취소할 수 있다. 다만, 제1호에 해당하는 경우에는 지정을 취소하여야 한다.
1. 거짓이나 부정한 방법으로 지정을 받은 경우
2. 제2항에 따른 지정요건을 갖추지 못하게 된 경우
⑤ 보호위원회 및 관계 중앙행정기관의 장은 제4항에 따라 지정을 취소하는 경우에는 「행정절차법」에 따른 청문을 실시하여야 한다.
⑥ 보호위원회 및 관계 중앙행정기관의 장은 개인정보관리 전문기관에 대하여 업무 수행에 필요한 지원을 할 수 있다.
⑦ 개인정보관리 전문기관은 정보주체의 요구에 따라 제1항 각 호의 업무를 수행하는 경우 정보주체로부터 그 업무 수행에 필요한 비용을 받을 수 있다.
⑧ 제1항에 따른 개인정보관리 전문기관의 지정 절차, 제2항에 따른 지정요건의 세부기준, 제4항에 따른 지정취소의 절차 등에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 35-3 (Institutions Specializing in Managing Personal Information)
(1) A person who intends to perform any of the following work shall be designated by the Protection Commission or the head of a relevant central administrative agency as an institution specializing in managing personal Information:
1. Support for the exercise of the right to request the transmission of personal information under Article 35-2;
2. Establishing and standardizing a personal information transmission system to support the exercise of the rights of data subjects;
3. Managing and analyzing personal information to support the exercise of rights of data subjects;
4. Other affairs prescribed by Presidential Decree to effectively support the exercise of the rights of data subjects.
(2) Requirements for designation as an institution specializing in managing personal information under paragraph (1) shall be as follows:
1. The applicant shall have the technical level and expertise to transmit, manage, and analyze personal information;
2. The applicant shall be equipped with a level of measures to ensure safety for safely managing personal information;
3. The applicant shall have the financial capability necessary for the stable operation of an institution specializing in managing personal Information.
(3) No institution specializing in managing personal information shall engage in any of the following acts:
1. Forcing a data subject to request the transmission of his or her personal information, or unfairly inducing it;
2. Any other act prescribed by Presidential Decree, which is likely to infringe on personal information or restrict the rights of a data subject.
(4) If an institution specializing in managing personal information falls under any of the following, the head of the Protection Commission or of a relevant central administrative agency may revoke the designation of the institution specializing in managing personal information: Provided, that he or she shall revoke such designation in cases falling under subparagraph 1:
1. Where the institution has obtained the designation by fraud or other improper means;
2. Where the institution ceases to meet the requirements for designation under paragraph (2).
(5) If the Protection Commission or the head of a relevant central administrative agency intends to revoke the designation under paragraph (4), he or she shall hold hearings under the Administrative Procedures Act.
(6) The Protection Commission and the head of a relevant central administrative agency may provide an institution specializing in managing personal information support necessary for performing its work.
(7) In performing affairs under the subparagraphs of paragraph (1) at the request of a data subject, an institution specializing in managing personal information may collect from the data subject expenses incurred in performing such work.
(8) Matters necessary for the procedures for the designation of an institution specializing in managing personal information under paragraph (1), the detailed requirements for designation under paragraph (2), the procedures for revocation of designation under paragraph (4), etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 35-4 (Management of Transmitting Personal Information and Support Therefor)
(1) The Protection Commission shall systematically manage and supervise the current status of personal information controllers provided in Articles 35-2 (1) and (2) and institutions specializing in managing personal information provided in Article 35-3 (1), the details of use, the actual status of management, etc.
(2) The Protection Commission may build and operate a personal information transmission support platform to ensure the safe and efficient transmission of personal information, including the following:
1. The current status of institutions specializing in managing personal information and a list of personal information items that can be transmitted;
2. Details of a data subject's request for transmission and withdrawal of such request;
3. Support functions such as managing the history of transmission of personal information;
4. Other matters necessary to transmit personal information.
(3) The Protection Commission may interlink or integrate the transmission systems built and operated by institutions specializing in managing personal information for the efficient operation of personal information transmission support platforms under paragraph (2). In such cases, it shall have a prior consultation with the head of a relevant central administrative agency and the relevant institution specializing in managing personal information.
(5) Matters necessary for management and supervision and the establishment and operation of a personal information transmission support system under paragraphs (1) through (3) shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제35조의4(개인정보 전송 관리 및 지원)
① 보호위원회는 제35조의2제1항 및 제2항에 따른 개인정보처리자 및 제35조의3제1항에 따른 개인정보관리 전문기관 현황, 활용내역 및 관리실태 등을 체계적으로 관리ㆍ감독하여야 한다.
② 보호위원회는 개인정보가 안전하고 효율적으로 전송될 수 있도록 다음 각 호의 사항을 포함한 개인정보 전송 지원 플랫폼을 구축ㆍ운영할 수 있다.
1. 개인정보관리 전문기관 현황 및 전송 가능한 개인정보 항목 목록
2. 정보주체의 개인정보 전송 요구ㆍ철회 내역
3. 개인정보의 전송 이력 관리 등 지원 기능
4. 그 밖에 개인정보 전송을 위하여 필요한 사항
③ 보호위원회는 제2항에 따른 개인정보 전송지원 플랫폼의 효율적 운영을 위하여 개인정보관리 전문기관에서 구축ㆍ운영하고 있는 전송 시스템을 상호 연계하거나 통합할 수 있다. 이 경우 관계 중앙행정기관의 장 및 해당 개인정보관리 전문기관과 사전에 협의하여야 한다.
④ 제1항부터 제3항까지의 규정에 따른 관리ㆍ감독과 개인정보 전송지원 플랫폼의 구축 및 운영에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 35-4 (Management of Transmitting Personal Information and Support Therefor)
(1) The Protection Commission shall systematically manage and supervise the current status of personal information controllers provided in Articles 35-2 (1) and (2) and institutions specializing in managing personal information provided in Article 35-3 (1), the details of use, the actual status of management, etc.
(2) The Protection Commission may build and operate a personal information transmission support platform to ensure the safe and efficient transmission of personal information, including the following:
1. The current status of institutions specializing in managing personal information and a list of personal information items that can be transmitted;
2. Details of a data subject's request for transmission and withdrawal of such request;
3. Support functions such as managing the history of transmission of personal information;
4. Other matters necessary to transmit personal information.
(3) The Protection Commission may interlink or integrate the transmission systems built and operated by institutions specializing in managing personal information for the efficient operation of personal information transmission support platforms under paragraph (2). In such cases, it shall have a prior consultation with the head of a relevant central administrative agency and the relevant institution specializing in managing personal information.
(5) Matters necessary for management and supervision and the establishment and operation of a personal information transmission support system under paragraphs (1) through (3) shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 36 (Correction or Erasure of Personal Information)
(1) A data subject who has accessed his or her personal information pursuant to Article 35 may request a correction or erasure of such personal information from the relevant personal information controller: Provided, That the erasure is not permitted where the said personal information shall be collected by other statutes or regulations.
(2) Upon receipt of a request by a data subject pursuant to paragraph (1), the personal information controller shall investigate the personal information in question without delay; shall take measures necessary to correct or erase as requested by the data subject unless otherwise specifically provided by other statutes or regulations in relation to correction or erasure; and shall notify such data subject of the result.
(3) The personal information controller shall take measures not to recover or revive the personal information in case of erasure pursuant to paragraph (2).
(4) Where the request of a data subject falls under the proviso of paragraph (1), a personal information controller shall notify the data subject of the details thereof without delay.
(5) While investigating the personal information in question pursuant to paragraph (2), the personal information controller may, if necessary, request from the relevant data subject the evidence necessary to confirm a correction or erasure of the personal information.
(6) Matters necessary for the request of correction and erasure, notification method and procedure, etc. pursuant to paragraphs (1), (2) and (4) shall be prescribed by Presidential Decree.
제36조(개인정보의 정정ㆍ삭제)
① 제35조에 따라 자신의 개인정보를 열람한 정보주체는 개인정보처리자에게 그 개인정보의 정정 또는 삭제를 요구할 수 있다. 다만, 다른 법령에서 그 개인정보가 수집 대상으로 명시되어 있는 경우에는 그 삭제를 요구할 수 없다.
② 개인정보처리자는 제1항에 따른 정보주체의 요구를 받았을 때에는 개인정보의 정정 또는 삭제에 관하여 다른 법령에 특별한 절차가 규정되어 있는 경우를 제외하고는 지체 없이 그 개인정보를 조사하여 정보주체의 요구에 따라 정정ㆍ삭제 등 필요한 조치를 한 후 그 결과를 정보주체에게 알려야 한다.
③ 개인정보처리자가 제2항에 따라 개인정보를 삭제할 때에는 복구 또는 재생되지 아니하도록 조치하여야 한다.
④ 개인정보처리자는 정보주체의 요구가 제1항 단서에 해당될 때에는 지체 없이 그 내용을 정보주체에게 알려야 한다.
⑤ 개인정보처리자는 제2항에 따른 조사를 할 때 필요하면 해당 정보주체에게 정정ㆍ삭제 요구사항의 확인에 필요한 증거자료를 제출하게 할 수 있다.
⑥ 제1항ㆍ제2항 및 제4항에 따른 정정 또는 삭제 요구, 통지 방법 및 절차 등에 필요한 사항은 대통령령으로 정한다.
Article 36 (Correction or Erasure of Personal Information)
(1) A data subject who has accessed his or her personal information pursuant to Article 35 may request a correction or erasure of such personal information from the relevant personal information controller: Provided, That the erasure is not permitted where the said personal information shall be collected by other statutes or regulations.
(2) Upon receipt of a request by a data subject pursuant to paragraph (1), the personal information controller shall investigate the personal information in question without delay; shall take measures necessary to correct or erase as requested by the data subject unless otherwise specifically provided by other statutes or regulations in relation to correction or erasure; and shall notify such data subject of the result.
(3) The personal information controller shall take measures not to recover or revive the personal information in case of erasure pursuant to paragraph (2).
(4) Where the request of a data subject falls under the proviso of paragraph (1), a personal information controller shall notify the data subject of the details thereof without delay.
(5) While investigating the personal information in question pursuant to paragraph (2), the personal information controller may, if necessary, request from the relevant data subject the evidence necessary to confirm a correction or erasure of the personal information.
(6) Matters necessary for the request of correction and erasure, notification method and procedure, etc. pursuant to paragraphs (1), (2) and (4) shall be prescribed by Presidential Decree.
Article 37 (Suspension of Processing of Personal Information)
(1) A data subject may request the relevant personal information controller to suspend the processing of his or her personal information or may withdraw his or her consent to personal information processing. In such cases, if the personal information controller is a public institution, the data subject may request the institution to suspend the processing of his or her personal information contained in the personal information files to be registered pursuant to Article 32 or may withdraw his or her consent to personal information processing. <Amended on Mar. 14, 2023>
(2) Upon receipt of the request for suspension of processing under paragraph (1), the personal information controller shall, without delay, suspend processing of some or all of the personal information as requested by the data subject: Provided, That, where any of the following is applicable, the personal information controller may deny the request of such data subject: <Amended on Mar. 14, 2023>
1. Where special provisions exist in other statutes or it is unavoidable to observe obligations under statutes or regulations;
2. Where access may cause damage to the life or body of a third party, or unjustified infringement of property and other interests of any other person;
3. Where the public institution cannot perform its work as prescribed by any Act without processing the personal information in question;
4. Where it is impracticable to perform a contract such as the provision of services as agreed upon with the said data subject without processing the personal information in question, and the data subject has not clearly expressed the desire to terminate the agreement.
(3) A personal information controller shall, when a data subject withdraws his or her consent pursuant to paragraph (1), take necessary measures without delay, such as destroying collected personal information to prevent recovery and reproduction thereof: Provided, That in cases falling under any subparagraph of paragraph (2), a personal information controller need not take measures following the withdrawal of consent. <Newly Inserted on Mar. 14, 2023>
(4) When rejecting a request for suspension of processing pursuant to the proviso of paragraph (2) or failing to take measures following the withdrawal of consent pursuant to the proviso of paragraph (3), the personal information controller shall notify the data subject of the reason without delay. <Amended on Mar. 14, 2023>
(5) The personal information controller shall, without delay, take necessary measures including destruction of the relevant personal information when suspending the processing of personal information as requested by data subjects. <Amended on Mar. 14, 2023>
(6) Matters necessary for the methods and procedures to request the suspension of processing, to withdraw consent, to reject such request, and to give notification, etc. pursuant to paragraphs (1) through (5) shall be prescribed by Presidential Decree. <Amended on Mar. 14, 2023>
제37조(개인정보의 처리정지 등)
① 정보주체는 개인정보처리자에 대하여 자신의 개인정보 처리의 정지를 요구하거나 개인정보 처리에 대한 동의를 철회할 수 있다. 이 경우 공공기관에 대해서는 제32조에 따라 등록 대상이 되는 개인정보파일 중 자신의 개인정보에 대한 처리의 정지를 요구하거나 개인정보 처리에 대한 동의를 철회할 수 있다. <개정 2023. 3. 14.>
② 개인정보처리자는 제1항에 따른 처리정지 요구를 받았을 때에는 지체 없이 정보주체의 요구에 따라 개인정보 처리의 전부를 정지하거나 일부를 정지하여야 한다. 다만, 다음 각 호의 어느 하나에 해당하는 경우에는 정보주체의 처리정지 요구를 거절할 수 있다. <개정 2023. 3. 14.>
1. 법률에 특별한 규정이 있거나 법령상 의무를 준수하기 위하여 불가피한 경우
2. 다른 사람의 생명ㆍ신체를 해할 우려가 있거나 다른 사람의 재산과 그 밖의 이익을 부당하게 침해할 우려가 있는 경우
3. 공공기관이 개인정보를 처리하지 아니하면 다른 법률에서 정하는 소관 업무를 수행할 수 없는 경우
4. 개인정보를 처리하지 아니하면 정보주체와 약정한 서비스를 제공하지 못하는 등 계약의 이행이 곤란한 경우로서 정보주체가 그 계약의 해지 의사를 명확하게 밝히지 아니한 경우
③ 개인정보처리자는 정보주체가 제1항에 따라 동의를 철회한 때에는 지체 없이 수집된 개인정보를 복구ㆍ재생할 수 없도록 파기하는 등 필요한 조치를 하여야 한다. 다만, 제2항 각 호의 어느 하나에 해당하는 경우에는 동의 철회에 따른 조치를 하지 아니할 수 있다. <신설 2023. 3. 14.>
④ 개인정보처리자는 제2항 단서에 따라 처리정지 요구를 거절하거나 제3항 단서에 따라 동의 철회에 따른 조치를 하지 아니하였을 때에는 정보주체에게 지체 없이 그 사유를 알려야 한다. <개정 2023. 3. 14.>
⑤ 개인정보처리자는 정보주체의 요구에 따라 처리가 정지된 개인정보에 대하여 지체 없이 해당 개인정보의 파기 등 필요한 조치를 하여야 한다. <개정 2023. 3. 14.>
⑥ 제1항부터 제5항까지의 규정에 따른 처리정지의 요구, 동의 철회, 처리정지의 거절, 통지 등의 방법 및 절차에 필요한 사항은 대통령령으로 정한다. <개정 2023. 3. 14.>
Article 37 (Suspension of Processing of Personal Information)
(1) A data subject may request the relevant personal information controller to suspend the processing of his or her personal information or may withdraw his or her consent to personal information processing. In such cases, if the personal information controller is a public institution, the data subject may request the institution to suspend the processing of his or her personal information contained in the personal information files to be registered pursuant to Article 32 or may withdraw his or her consent to personal information processing. <Amended on Mar. 14, 2023>
(2) Upon receipt of the request for suspension of processing under paragraph (1), the personal information controller shall, without delay, suspend processing of some or all of the personal information as requested by the data subject: Provided, That, where any of the following is applicable, the personal information controller may deny the request of such data subject: <Amended on Mar. 14, 2023>
1. Where special provisions exist in other statutes or it is unavoidable to observe obligations under statutes or regulations;
2. Where access may cause damage to the life or body of a third party, or unjustified infringement of property and other interests of any other person;
3. Where the public institution cannot perform its work as prescribed by any Act without processing the personal information in question;
4. Where it is impracticable to perform a contract such as the provision of services as agreed upon with the said data subject without processing the personal information in question, and the data subject has not clearly expressed the desire to terminate the agreement.
(3) A personal information controller shall, when a data subject withdraws his or her consent pursuant to paragraph (1), take necessary measures without delay, such as destroying collected personal information to prevent recovery and reproduction thereof: Provided, That in cases falling under any subparagraph of paragraph (2), a personal information controller need not take measures following the withdrawal of consent. <Newly Inserted on Mar. 14, 2023>
(4) When rejecting a request for suspension of processing pursuant to the proviso of paragraph (2) or failing to take measures following the withdrawal of consent pursuant to the proviso of paragraph (3), the personal information controller shall notify the data subject of the reason without delay. <Amended on Mar. 14, 2023>
(5) The personal information controller shall, without delay, take necessary measures including destruction of the relevant personal information when suspending the processing of personal information as requested by data subjects. <Amended on Mar. 14, 2023>
(6) Matters necessary for the methods and procedures to request the suspension of processing, to withdraw consent, to reject such request, and to give notification, etc. pursuant to paragraphs (1) through (5) shall be prescribed by Presidential Decree. <Amended on Mar. 14, 2023>
Article 37-2 (Rights of Data Subjects for Automated Decision)
(1) If a decision (excluding an automatic disposition by an administrative authority under Article 20 of the Framework Act on Administration; hereafter in this Article referred to as "automated decision") made by processing personal information with a completely automated system (including a system to which artificial intelligence technologies are applied) has a significant effect on his or her right or duty, a data subject shall have the right to file with the relevant personal information controller an objection against the relevant decision: Provided, That this shall not apply to cases where automated decisions are made pursuant to Article 15 (1) 1, 2, and 4.
(2) A data subject may, if the personal information controller has made an automated decision, request explanation, etc. thereof.
(3) Where a data subject refuses to accept an automated decision or requests a personal information controller to provide explanations, etc. thereof pursuant to paragraph (1) or (2), the personal information controller shall not apply the automated decision unless there is a compelling reason not to do so, or shall take necessary measures, such as re-processing through human involvement and providing explanations.
(4) A personal information controller shall disclose the criteria and procedures for making automated decisions and the methods, etc. of processing personal information so that data subjects can easily confirm them.
(5) Except as provided in paragraphs (1) through (4), matters necessary for the procedures and methods for refusing to accept automated decisions, requesting explanations, etc. thereof, necessary measures in response to refusal, a request for explanations, etc., the criteria and procedures for making automated decisions, the disclosure of the method in which personal information is processed, etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
제37조의2(자동화된 결정에 대한 정보주체의 권리 등)
① 정보주체는 완전히 자동화된 시스템(인공지능 기술을 적용한 시스템을 포함한다)으로 개인정보를 처리하여 이루어지는 결정(「행정기본법」 제20조에 따른 행정청의 자동적 처분은 제외하며, 이하 이 조에서 “자동화된 결정”이라 한다)이 자신의 권리 또는 의무에 중대한 영향을 미치는 경우에는 해당 개인정보처리자에 대하여 해당 결정을 거부할 수 있는 권리를 가진다. 다만, 자동화된 결정이 제15조제1항제1호ㆍ제2호 및 제4호에 따라 이루어지는 경우에는 그러하지 아니하다.
② 정보주체는 개인정보처리자가 자동화된 결정을 한 경우에는 그 결정에 대하여 설명 등을 요구할 수 있다.
③ 개인정보처리자는 제1항 또는 제2항에 따라 정보주체가 자동화된 결정을 거부하거나 이에 대한 설명 등을 요구한 경우에는 정당한 사유가 없는 한 자동화된 결정을 적용하지 아니하거나 인적 개입에 의한 재처리ㆍ설명 등 필요한 조치를 하여야 한다.
④ 개인정보처리자는 자동화된 결정의 기준과 절차, 개인정보가 처리되는 방식 등을 정보주체가 쉽게 확인할 수 있도록 공개하여야 한다.
⑤ 제1항부터 제4항까지에서 규정한 사항 외에 자동화된 결정의 거부ㆍ설명 등을 요구하는 절차 및 방법, 거부ㆍ설명 등의 요구에 따른 필요한 조치, 자동화된 결정의 기준ㆍ절차 및 개인정보가 처리되는 방식의 공개 등에 필요한 사항은 대통령령으로 정한다.
[본조신설 2023. 3. 14.]
Article 37-2 (Rights of Data Subjects for Automated Decision)
(1) If a decision (excluding an automatic disposition by an administrative authority under Article 20 of the Framework Act on Administration; hereafter in this Article referred to as "automated decision") made by processing personal information with a completely automated system (including a system to which artificial intelligence technologies are applied) has a significant effect on his or her right or duty, a data subject shall have the right to file with the relevant personal information controller an objection against the relevant decision: Provided, That this shall not apply to cases where automated decisions are made pursuant to Article 15 (1) 1, 2, and 4.
(2) A data subject may, if the personal information controller has made an automated decision, request explanation, etc. thereof.
(3) Where a data subject refuses to accept an automated decision or requests a personal information controller to provide explanations, etc. thereof pursuant to paragraph (1) or (2), the personal information controller shall not apply the automated decision unless there is a compelling reason not to do so, or shall take necessary measures, such as re-processing through human involvement and providing explanations.
(4) A personal information controller shall disclose the criteria and procedures for making automated decisions and the methods, etc. of processing personal information so that data subjects can easily confirm them.
(5) Except as provided in paragraphs (1) through (4), matters necessary for the procedures and methods for refusing to accept automated decisions, requesting explanations, etc. thereof, necessary measures in response to refusal, a request for explanations, etc., the criteria and procedures for making automated decisions, the disclosure of the method in which personal information is processed, etc. shall be prescribed by Presidential Decree.
[This Article Newly Inserted on Mar. 14, 2023]
Article 38 (Methods and Procedures for Exercise of Rights)
(1) A data subject may authorize his or her representative to file requests for access under Article 35, transmission under Article 35-2, rectification or erasure under Article 36, suspension of processing and withdrawal of consent under Article 37, and refusal and requests for explanation, etc. under Article 37-2 (hereinafter referred to as “request for access, etc.”) by the methods and procedures prescribed by Presidential Decree, such as written documents. <Amended on Feb. 4, 2020; Mar. 14, 2023>
(2) The legal representative of a child under 14 years of age may file a request for access, etc. to the personal information of the child with a personal information controller.
(3) A personal information controller may charge a person who files a request for access, etc. a fee and postage (only in cases of a request to mail the copies), as prescribed by Presidential Decree: Provided, That in cases of a request for transmission under Article 35-2 (2), the personal information controller may assess a fee, taking into account additional facilities necessary for transmission and other factors as well. <Amended on Mar. 14, 2023>
(4) A personal information controller shall prepare detailed methods and procedures to enable data subjects to file requests for access, etc., and disclose such methods and procedures so that the data subjects may become aware of them. In such cases, the methods and procedures for filing requests for access, etc. shall be no more difficult than the methods and procedures for the collection of the relevant personal information. <Amended on Mar. 14, 2023>
(5) A personal information controller shall prepare and provide necessary procedures for data subjects to raise objections regarding the denial of a request for access, etc. from such data subjects.
제38조(권리행사의 방법 및 절차)
① 정보주체는 제35조에 따른 열람, 제35조의2에 따른 전송, 제36조에 따른 정정ㆍ삭제, 제37조에 따른 처리정지 및 동의 철회, 제37조의2에 따른 거부ㆍ설명 등의 요구(이하 “열람등요구”라 한다)를 문서 등 대통령령으로 정하는 방법ㆍ절차에 따라 대리인에게 하게 할 수 있다. <개정 2020. 2. 4., 2023. 3. 14.>
② 만 14세 미만 아동의 법정대리인은 개인정보처리자에게 그 아동의 개인정보 열람등요구를 할 수 있다.
③ 개인정보처리자는 열람등요구를 하는 자에게 대통령령으로 정하는 바에 따라 수수료와 우송료(사본의 우송을 청구하는 경우에 한한다)를 청구할 수 있다. 다만, 제35조의2제2항에 따른 전송 요구의 경우에는 전송을 위해 추가로 필요한 설비 등을 함께 고려하여 수수료를 산정할 수 있다. <개정 2023. 3. 14.>
④ 개인정보처리자는 정보주체가 열람등요구를 할 수 있는 구체적인 방법과 절차를 마련하고, 이를 정보주체가 알 수 있도록 공개하여야 한다. 이 경우 열람등요구의 방법과 절차는 해당 개인정보의 수집 방법과 절차보다 어렵지 아니하도록 하여야 한다. <개정 2023. 3. 14.>
⑤ 개인정보처리자는 정보주체가 열람등요구에 대한 거절 등 조치에 대하여 불복이 있는 경우 이의를 제기할 수 있도록 필요한 절차를 마련하고 안내하여야 한다.
Article 38 (Methods and Procedures for Exercise of Rights)
(1) A data subject may authorize his or her representative to file requests for access under Article 35, transmission under Article 35-2, rectification or erasure under Article 36, suspension of processing and withdrawal of consent under Article 37, and refusal and requests for explanation, etc. under Article 37-2 (hereinafter referred to as “request for access, etc.”) by the methods and procedures prescribed by Presidential Decree, such as written documents. <Amended on Feb. 4, 2020; Mar. 14, 2023>
(2) The legal representative of a child under 14 years of age may file a request for access, etc. to the personal information of the child with a personal information controller.
(3) A personal information controller may charge a person who files a request for access, etc. a fee and postage (only in cases of a request to mail the copies), as prescribed by Presidential Decree: Provided, That in cases of a request for transmission under Article 35-2 (2), the personal information controller may assess a fee, taking into account additional facilities necessary for transmission and other factors as well. <Amended on Mar. 14, 2023>
(4) A personal information controller shall prepare detailed methods and procedures to enable data subjects to file requests for access, etc., and disclose such methods and procedures so that the data subjects may become aware of them. In such cases, the methods and procedures for filing requests for access, etc. shall be no more difficult than the methods and procedures for the collection of the relevant personal information. <Amended on Mar. 14, 2023>
(5) A personal information controller shall prepare and provide necessary procedures for data subjects to raise objections regarding the denial of a request for access, etc. from such data subjects.
Article 39 (Liability for Damages)
(1) A data subject who suffers damage by reason of a violation of this Act by a personal information controller is entitled to claim compensation from the personal information controller for such damage. In such cases, the said personal information controller may not be released from responsibility for compensation if it fails to prove the absence of intention or negligence.
(2) Deleted. <Jul. 24, 2015>
(3) Where a data subject suffers damage out of loss, theft, divulgence, forgery, alteration, or damage of his or her own personal information, caused by intention or negligence of a personal information controller, the Court may determine the amount of compensation for damage not exceeding five times such damage: Provided, That the same shall not apply to the personal information controller who has proved the absence of intention or negligence. <Newly Inserted on Jul. 24, 2015; Mar. 14, 2023>
(4) The Court shall take into account the following when determining the amount of compensation for damage under paragraph (3): <Newly Inserted on Jul. 24, 2015>
1. The degree of intention or expectation of damage;
2. The amount of loss caused by the violation;
3. Economic benefits the personal information controller gained in relation to the violation;
4. A fine and a penalty surcharge to be levied subject to the violation;
5. The duration, frequency, etc. of violations;
6. The property of the personal information controller;
7. The personal information controller’s efforts to retrieve the affected personal information after the loss, theft, or divulgence of personal information;
8. The personal information controller’s efforts to remedy damage suffered by the data subject.
제39조(손해배상책임)
① 정보주체는 개인정보처리자가 이 법을 위반한 행위로 손해를 입으면 개인정보처리자에게 손해배상을 청구할 수 있다. 이 경우 그 개인정보처리자는 고의 또는 과실이 없음을 입증하지 아니하면 책임을 면할 수 없다.
② 삭제 <2015. 7. 24.>
③ 개인정보처리자의 고의 또는 중대한 과실로 인하여 개인정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손된 경우로서 정보주체에게 손해가 발생한 때에는 법원은 그 손해액의 5배를 넘지 아니하는 범위에서 손해배상액을 정할 수 있다. 다만, 개인정보처리자가 고의 또는 중대한 과실이 없음을 증명한 경우에는 그러하지 아니하다. <신설 2015. 7. 24., 2023. 3. 14.>
④ 법원은 제3항의 배상액을 정할 때에는 다음 각 호의 사항을 고려하여야 한다. <신설 2015. 7. 24.>
1. 고의 또는 손해 발생의 우려를 인식한 정도
2. 위반행위로 인하여 입은 피해 규모
3. 위법행위로 인하여 개인정보처리자가 취득한 경제적 이익
4. 위반행위에 따른 벌금 및 과징금
5. 위반행위의 기간ㆍ횟수 등
6. 개인정보처리자의 재산상태
7. 개인정보처리자가 정보주체의 개인정보 분실ㆍ도난ㆍ유출 후 해당 개인정보를 회수하기 위하여 노력한 정도
8. 개인정보처리자가 정보주체의 피해구제를 위하여 노력한 정도
Article 39 (Liability for Damages)
(1) A data subject who suffers damage by reason of a violation of this Act by a personal information controller is entitled to claim compensation from the personal information controller for such damage. In such cases, the said personal information controller may not be released from responsibility for compensation if it fails to prove the absence of intention or negligence.
(2) Deleted. <Jul. 24, 2015>
(3) Where a data subject suffers damage out of loss, theft, divulgence, forgery, alteration, or damage of his or her own personal information, caused by intention or negligence of a personal information controller, the Court may determine the amount of compensation for damage not exceeding five times such damage: Provided, That the same shall not apply to the personal information controller who has proved the absence of intention or negligence. <Newly Inserted on Jul. 24, 2015; Mar. 14, 2023>
(4) The Court shall take into account the following when determining the amount of compensation for damage under paragraph (3): <Newly Inserted on Jul. 24, 2015>
1. The degree of intention or expectation of damage;
2. The amount of loss caused by the violation;
3. Economic benefits the personal information controller gained in relation to the violation;
4. A fine and a penalty surcharge to be levied subject to the violation;
5. The duration, frequency, etc. of violations;
6. The property of the personal information controller;
7. The personal information controller’s efforts to retrieve the affected personal information after the loss, theft, or divulgence of personal information;
8. The personal information controller’s efforts to remedy damage suffered by the data subject.
Article 39-2 (Claims for Statutory Compensation)
(1) Notwithstanding Article 39 (1), a data subject, who suffers damage out of loss, theft, divulgence, forgery, alteration, or damage of his or her own personal information, caused by intention or negligence of a personal information controller, may claim a reasonable amount of damages not exceeding three million won. In such cases, the said personal information controller may not be released from the responsibility for compensation if it fails to prove the absence of intention or negligence.
(2) In the case of a claim made under paragraph (1), the Court may determine a reasonable amount of damages not exceeding the amount provided for in paragraph (1) taking into account all arguments in the proceedings and the results of examining evidence.
(3) A data subject who has claimed compensation pursuant to Article 39 may change such claim to the claim provided for in paragraph (1) until the closure of fact-finding proceedings.
[This Article Newly Inserted on Jul. 24, 2015]
제39조의2(법정손해배상의 청구)
① 제39조제1항에도 불구하고 정보주체는 개인정보처리자의 고의 또는 과실로 인하여 개인정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손된 경우에는 300만원 이하의 범위에서 상당한 금액을 손해액으로 하여 배상을 청구할 수 있다. 이 경우 해당 개인정보처리자는 고의 또는 과실이 없음을 입증하지 아니하면 책임을 면할 수 없다.
② 법원은 제1항에 따른 청구가 있는 경우에 변론 전체의 취지와 증거조사의 결과를 고려하여 제1항의 범위에서 상당한 손해액을 인정할 수 있다.
③ 제39조에 따라 손해배상을 청구한 정보주체는 사실심(事實審)의 변론이 종결되기 전까지 그 청구를 제1항에 따른 청구로 변경할 수 있다.
[본조신설 2015. 7. 24.]
Article 39-2 (Claims for Statutory Compensation)
(1) Notwithstanding Article 39 (1), a data subject, who suffers damage out of loss, theft, divulgence, forgery, alteration, or damage of his or her own personal information, caused by intention or negligence of a personal information controller, may claim a reasonable amount of damages not exceeding three million won. In such cases, the said personal information controller may not be released from the responsibility for compensation if it fails to prove the absence of intention or negligence.
(2) In the case of a claim made under paragraph (1), the Court may determine a reasonable amount of damages not exceeding the amount provided for in paragraph (1) taking into account all arguments in the proceedings and the results of examining evidence.
(3) A data subject who has claimed compensation pursuant to Article 39 may change such claim to the claim provided for in paragraph (1) until the closure of fact-finding proceedings.
[This Article Newly Inserted on Jul. 24, 2015]
CHAPTER VI Deleted
제6장 삭제
CHAPTER VI Deleted
Article 39-3 (Submission of Data)
(1) In a lawsuit seeking damages resulting from an act in violation of this Act, the court may, upon a request of a party, order the other party to prove the damage or to submit data necessary for the calculation of the amount of damages: Provided, That this shall not apply if the person upon receipt of an order to submit data has good cause for refusing to do so.
(2) Where a person upon receipt of an order to submit data under paragraph (1) asserts that there is good cause for refusing to do so, the court may order the presentation of data in order to determine propriety of such assertion. In such cases, the court shall not allow others to view the data.
(3) Even if the data to be submitted under paragraph (1) are trade secrets under subparagraph 2 of Article 2 of the Unfair Competition Prevention and Trade Secret Protection Act (hereinafter referred to as “trade secrets”), if the data are absolutely necessary in proving damage or calculating the amount of damages, it shall not be deemed that there is good cause under the proviso of paragraph (1). In such cases, the court shall determine the scope of access or persons allowed access within the purpose of the submission order.
(4) Where the party upon receipt of an order to submit data under paragraph (1) fails to comply with the order without good cause, the court may recognize that the claim of the applicant on the description of data is true.
(5) In cases falling under paragraph (4), where the applicant who has requested the submission of data is in a considerably difficult situation to make a detailed assertion on the description of data and where it is also impractical to expect that other evidence would verify the facts to be proved by the data, the court may recognize that the claim of the applicant on the facts which he or she intends to verify through the description of the data is true.
[This Article Wholly Amended on Mar. 14, 2023]
제39조의3(자료의 제출)
① 법원은 이 법을 위반한 행위로 인한 손해배상청구소송에서 당사자의 신청에 따라 상대방 당사자에게 해당 손해의 증명 또는 손해액의 산정에 필요한 자료의 제출을 명할 수 있다. 다만, 제출명령을 받은 자가 그 자료의 제출을 거부할 정당한 이유가 있으면 그러하지 아니하다.
② 법원은 제1항에 따른 제출명령을 받은 자가 그 자료의 제출을 거부할 정당한 이유가 있다고 주장하는 경우에는 그 주장의 당부(當否)를 판단하기 위하여 자료의 제시를 명할 수 있다. 이 경우 법원은 그 자료를 다른 사람이 보게 하여서는 아니 된다.
③ 제1항에 따라 제출되어야 할 자료가 「부정경쟁방지 및 영업비밀보호에 관한 법률」 제2조제2호에 따른 영업비밀(이하 “영업비밀”이라 한다)에 해당하나 손해의 증명 또는 손해액의 산정에 반드시 필요한 경우에는 제1항 단서에 따른 정당한 이유로 보지 아니한다. 이 경우 법원은 제출명령의 목적 내에서 열람할 수 있는 범위 또는 열람할 수 있는 사람을 지정하여야 한다.
④ 법원은 제1항에 따른 제출명령을 받은 자가 정당한 이유 없이 그 명령에 따르지 아니한 경우에는 자료의 기재에 대한 신청인의 주장을 진실한 것으로 인정할 수 있다.
⑤ 법원은 제4항에 해당하는 경우 신청인이 자료의 기재에 관하여 구체적으로 주장하기에 현저히 곤란한 사정이 있고 자료로 증명할 사실을 다른 증거로 증명하는 것을 기대하기도 어려운 경우에는 신청인이 자료의 기재로 증명하려는 사실에 관한 주장을 진실한 것으로 인정할 수 있다.
[전문개정 2023. 3. 14.]
Article 39-3 (Submission of Data)
(1) In a lawsuit seeking damages resulting from an act in violation of this Act, the court may, upon a request of a party, order the other party to prove the damage or to submit data necessary for the calculation of the amount of damages: Provided, That this shall not apply if the person upon receipt of an order to submit data has good cause for refusing to do so.
(2) Where a person upon receipt of an order to submit data under paragraph (1) asserts that there is good cause for refusing to do so, the court may order the presentation of data in order to determine propriety of such assertion. In such cases, the court shall not allow others to view the data.
(3) Even if the data to be submitted under paragraph (1) are trade secrets under subparagraph 2 of Article 2 of the Unfair Competition Prevention and Trade Secret Protection Act (hereinafter referred to as “trade secrets”), if the data are absolutely necessary in proving damage or calculating the amount of damages, it shall not be deemed that there is good cause under the proviso of paragraph (1). In such cases, the court shall determine the scope of access or persons allowed access within the purpose of the submission order.
(4) Where the party upon receipt of an order to submit data under paragraph (1) fails to comply with the order without good cause, the court may recognize that the claim of the applicant on the description of data is true.
(5) In cases falling under paragraph (4), where the applicant who has requested the submission of data is in a considerably difficult situation to make a detailed assertion on the description of data and where it is also impractical to expect that other evidence would verify the facts to be proved by the data, the court may recognize that the claim of the applicant on the facts which he or she intends to verify through the description of the data is true.
[This Article Wholly Amended on Mar. 14, 2023]
Article 39-4 (Confidentiality Order)
(1) In a lawsuit seeking damages resulting from an act in violation of this Act, the court may order the following persons not to use the trade secrets held by the party for any purpose other than proceeding with the relevant lawsuit, by a decision upon the request of a party, or not to disclose to persons other than those who have received an order under this paragraph: Provided, That this shall not apply where the following persons have already acquired the trade secrets by means other than the perusal to briefs or the examination of evidence as of the time the application is filed:
1. The other party (referring to the representative in the case of a corporation);
2. A person who represents the party in the relevant lawsuit;
3. Any other person who has become aware of the trade secrets through the lawsuit.
(2) A person who applies for an order under paragraph (1) (hereinafter referred to as “confidentiality order”) shall account for all of the following points:
1. The trade secret is contained in briefs already submitted or to be submitted, evidence already examined or to be examined, or data submitted or to be submitted pursuant to Article 39-3 (1);
2. The trade secrets referred to in subparagraph 1, if used or disclosed for purposes other than for conducting said litigation, are likely to impede the business operation of the relevant party, so that it is required to place a restriction on the use or disclosure of such trade secrets in order to prevent the impediment.
(3) An application for a confidentiality order shall be made in writing stating the following:
1. A person who will be subject to the confidentiality order;
2. The facts sufficient to specify the trade secrets to be protected by the confidentiality order;
3. Facts falling under the subparagraphs of paragraph (2).
(4) Where a decision is made to issue a confidentiality order, the court shall serve the written decision on the person to whom the confidentiality order is to be issued.
(5) A confidentiality order shall take effect when the written decision referred to in paragraph (4) is served on the person subject to the confidentiality order.
(6) An immediate appeal may be filed against a judgment that dismisses, with or without prejudice, an application for a confidentiality order.
[This Article Wholly Amended on Mar. 14, 2023]
제39조의4(비밀유지명령)
① 법원은 이 법을 위반한 행위로 인한 손해배상청구소송에서 당사자의 신청에 따른 결정으로 다음 각 호의 자에게 그 당사자가 보유한 영업비밀을 해당 소송의 계속적인 수행 외의 목적으로 사용하거나 그 영업비밀에 관계된 이 항에 따른 명령을 받은 자 외의 자에게 공개하지 아니할 것을 명할 수 있다. 다만, 그 신청 시점까지 다음 각 호의 자가 준비서면의 열람이나 증거조사 외의 방법으로 그 영업비밀을 이미 취득하고 있는 경우에는 그러하지 아니하다.
1. 다른 당사자(법인인 경우에는 그 대표자를 말한다)
2. 당사자를 위하여 해당 소송을 대리하는 자
3. 그 밖에 해당 소송으로 영업비밀을 알게 된 자
② 제1항에 따른 명령(이하 “비밀유지명령”이라 한다)을 신청하는 자는 다음 각 호의 사유를 모두 소명하여야 한다.
1. 이미 제출하였거나 제출하여야 할 준비서면, 이미 조사하였거나 조사하여야 할 증거 또는 제39조의3제1항에 따라 제출하였거나 제출하여야 할 자료에 영업비밀이 포함되어 있다는 것
2. 제1호의 영업비밀이 해당 소송 수행 외의 목적으로 사용되거나 공개되면 당사자의 영업에 지장을 줄 우려가 있어 이를 방지하기 위하여 영업비밀의 사용 또는 공개를 제한할 필요가 있다는 것
③ 비밀유지명령의 신청은 다음 각 호의 사항을 적은 서면으로 하여야 한다.
1. 비밀유지명령을 받을 자
2. 비밀유지명령의 대상이 될 영업비밀을 특정하기에 충분한 사실
3. 제2항 각 호의 사유에 해당하는 사실
④ 법원은 비밀유지명령이 결정된 경우에는 그 결정서를 비밀유지명령을 받을 자에게 송달하여야 한다.
⑤ 비밀유지명령은 제4항의 결정서가 비밀유지명령을 받을 자에게 송달된 때부터 효력이 발생한다.
⑥ 비밀유지명령의 신청을 기각하거나 각하한 재판에 대해서는 즉시항고를 할 수 있다.
[전문개정 2023. 3. 14.]
Article 39-4 (Confidentiality Order)
(1) In a lawsuit seeking damages resulting from an act in violation of this Act, the court may order the following persons not to use the trade secrets held by the party for any purpose other than proceeding with the relevant lawsuit, by a decision upon the request of a party, or not to disclose to persons other than those who have received an order under this paragraph: Provided, That this shall not apply where the following persons have already acquired the trade secrets by means other than the perusal to briefs or the examination of evidence as of the time the application is filed:
1. The other party (referring to the representative in the case of a corporation);
2. A person who represents the party in the relevant lawsuit;
3. Any other person who has become aware of the trade secrets through the lawsuit.
(2) A person who applies for an order under paragraph (1) (hereinafter referred to as “confidentiality order”) shall account for all of the following points:
1. The trade secret is contained in briefs already submitted or to be submitted, evidence already examined or to be examined, or data submitted or to be submitted pursuant to Article 39-3 (1);
2. The trade secrets referred to in subparagraph 1, if used or disclosed for purposes other than for conducting said litigation, are likely to impede the business operation of the relevant party, so that it is required to place a restriction on the use or disclosure of such trade secrets in order to prevent the impediment.
(3) An application for a confidentiality order shall be made in writing stating the following:
1. A person who will be subject to the confidentiality order;
2. The facts sufficient to specify the trade secrets to be protected by the confidentiality order;
3. Facts falling under the subparagraphs of paragraph (2).
(4) Where a decision is made to issue a confidentiality order, the court shall serve the written decision on the person to whom the confidentiality order is to be issued.
(5) A confidentiality order shall take effect when the written decision referred to in paragraph (4) is served on the person subject to the confidentiality order.
(6) An immediate appeal may be filed against a judgment that dismisses, with or without prejudice, an application for a confidentiality order.
[This Article Wholly Amended on Mar. 14, 2023]
Article 39-5 (Revocation of Confidentiality Order)
(1) Where there are facts or circumstances that do not correspond to the points in the subparagraphs of Article 39-4 (2), the person who has applied for a confidentiality order or the person who has received a confidentiality order may request the court that keeps the litigation records (if there is no court keeping the records, it refers to the court that issued the confidentiality order) to revoke the confidentiality order.
(2) When a court makes a decision on a request to revoke a confidentiality order, it shall serve a written decision on the applicant for request and the other party.
(3) An immediate complaint may be raised against a decision on revocation of a confidentiality order.
(4) A decision to revoke a confidentiality order shall take effect when it becomes final and conclusive.
(5) When a court decides to revoke a confidentiality order, it shall immediately notify a person to whom a confidentiality order of the relevant trade secret was issued, if any, of the fact that a decision is made to revoke the confidentiality order, in addition to the applicant for request to revoke the confidentiality order and the other party.
[This Article Wholly Amended on Mar. 14, 2023]
제39조의5(비밀유지명령의 취소)
① 비밀유지명령을 신청한 자 또는 비밀유지명령을 받은 자는 제39조의4제2항 각 호의 사유에 부합하지 아니하는 사실이나 사정이 있는 경우 소송기록을 보관하고 있는 법원(소송기록을 보관하고 있는 법원이 없는 경우에는 비밀유지명령을 내린 법원을 말한다)에 비밀유지명령의 취소를 신청할 수 있다.
② 법원은 비밀유지명령의 취소신청에 대한 재판이 있는 경우에는 그 결정서를 그 신청을 한 자 및 상대방에게 송달하여야 한다.
③ 비밀유지명령의 취소신청에 대한 재판에 대해서는 즉시항고를 할 수 있다.
④ 비밀유지명령을 취소하는 재판은 확정되어야 효력이 발생한다.
⑤ 비밀유지명령을 취소하는 재판을 한 법원은 비밀유지명령의 취소신청을 한 자 또는 상대방 외에 해당 영업비밀에 관한 비밀유지명령을 받은 자가 있는 경우에는 그 자에게 즉시 비밀유지명령의 취소 재판을 한 사실을 알려야 한다.
[전문개정 2023. 3. 14.]
Article 39-5 (Revocation of Confidentiality Order)
(1) Where there are facts or circumstances that do not correspond to the points in the subparagraphs of Article 39-4 (2), the person who has applied for a confidentiality order or the person who has received a confidentiality order may request the court that keeps the litigation records (if there is no court keeping the records, it refers to the court that issued the confidentiality order) to revoke the confidentiality order.
(2) When a court makes a decision on a request to revoke a confidentiality order, it shall serve a written decision on the applicant for request and the other party.
(3) An immediate complaint may be raised against a decision on revocation of a confidentiality order.
(4) A decision to revoke a confidentiality order shall take effect when it becomes final and conclusive.
(5) When a court decides to revoke a confidentiality order, it shall immediately notify a person to whom a confidentiality order of the relevant trade secret was issued, if any, of the fact that a decision is made to revoke the confidentiality order, in addition to the applicant for request to revoke the confidentiality order and the other party.
[This Article Wholly Amended on Mar. 14, 2023]
Article 39-6 (Notification of Request for Perusal of Litigation Records)
(1) Where a decision under Article 163 (1) of the Civil Procedure Act has been rendered for litigation records regarding lawsuit proceedings for which a confidentiality order had been issued (excluding lawsuit proceedings for which any and all confidentiality orders have been revoked), and the party has made a request for perusal, etc. of confidential records prescribed in that paragraph but the procedures for such request have been followed by a person not subject to a confidentiality order in the lawsuit at issue; a court official of Grade IV, V, VI, or VII (hereafter in this Article referred to as "court official of Grade V, etc.") shall notify the party who has made a request under that paragraph (excluding a person who has made the aforementioned request for perusal, etc.; hereafter in paragraph (3), the same shall apply) of the fact that the request for perusal, etc. was made immediately after the request.
(2) No court official of Grade V, etc. shall allow a person who has followed the procedures for the request for perusal, etc. to peruse the confidential records under paragraph (1) until two weeks have elapsed from the date the request under paragraph (1) was made (referring to the time when a judgment on the request becomes final and conclusive, if a request for issuing a confidentiality order to a person who has followed the request procedures is made within the period).
(3) Paragraph (2) shall not apply where all the parties who have filed a request under Article 163 (1) of the Civil Procedure Act give their consent to permitting a person who has made a request for perusal, etc. under paragraph (1) to peruse, etc. the confidential records under paragraph (1).
[This Article Wholly Amended on Mar. 14, 2023]
제39조의6(소송기록 열람 등의 청구 통지 등)
① 비밀유지명령이 내려진 소송(모든 비밀유지명령이 취소된 소송은 제외한다)에 관한 소송기록에 대하여 「민사소송법」 제163조제1항에 따라 열람 등의 신청인을 당사자로 제한하는 결정이 있었던 경우로서 당사자가 같은 항에서 규정하는 비밀 기재부분의 열람 등의 청구를 하였으나 그 청구 절차를 해당 소송에서 비밀유지명령을 받지 아니한 자가 밟은 경우에는 법원서기관, 법원사무관, 법원주사 또는 법원주사보(이하 이 조에서 “법원사무관등”이라 한다)는 같은 항의 신청을 한 당사자(그 열람 등의 청구를 한 자는 제외한다. 이하 제3항에서 같다)에게 그 청구 직후에 그 열람 등의 청구가 있었다는 사실을 알려야 한다.
② 법원사무관등은 제1항의 청구가 있었던 날부터 2주일이 지날 때까지(그 청구 절차를 밟은 자에 대한 비밀유지명령 신청이 그 기간 내에 이루어진 경우에는 그 신청에 대한 재판이 확정되는 시점까지를 말한다) 그 청구 절차를 밟은 자에게 제1항의 비밀 기재부분의 열람 등을 하게 하여서는 아니 된다.
③ 제2항은 제1항의 열람 등의 청구를 한 자에게 제1항의 비밀 기재부분의 열람 등을 하게 하는 것에 대하여 「민사소송법」 제163조제1항의 신청을 한 당사자 모두가 동의하는 경우에는 적용되지 아니한다.
[전문개정 2023. 3. 14.]
Article 39-6 (Notification of Request for Perusal of Litigation Records)
(1) Where a decision under Article 163 (1) of the Civil Procedure Act has been rendered for litigation records regarding lawsuit proceedings for which a confidentiality order had been issued (excluding lawsuit proceedings for which any and all confidentiality orders have been revoked), and the party has made a request for perusal, etc. of confidential records prescribed in that paragraph but the procedures for such request have been followed by a person not subject to a confidentiality order in the lawsuit at issue; a court official of Grade IV, V, VI, or VII (hereafter in this Article referred to as "court official of Grade V, etc.") shall notify the party who has made a request under that paragraph (excluding a person who has made the aforementioned request for perusal, etc.; hereafter in paragraph (3), the same shall apply) of the fact that the request for perusal, etc. was made immediately after the request.
(2) No court official of Grade V, etc. shall allow a person who has followed the procedures for the request for perusal, etc. to peruse the confidential records under paragraph (1) until two weeks have elapsed from the date the request under paragraph (1) was made (referring to the time when a judgment on the request becomes final and conclusive, if a request for issuing a confidentiality order to a person who has followed the request procedures is made within the period).
(3) Paragraph (2) shall not apply where all the parties who have filed a request under Article 163 (1) of the Civil Procedure Act give their consent to permitting a person who has made a request for perusal, etc. under paragraph (1) to peruse, etc. the confidential records under paragraph (1).
[This Article Wholly Amended on Mar. 14, 2023]
Article 39-7 (Coverage of Liabilities for Damages)
(1) A personal information controller that meets the criteria prescribed by Presidential Decree in consideration of sales and the scale of personal information retained shall take necessary measures such as purchasing insurance or joining a mutual aid organization or accumulating reserves to meet its liabilities for damages under Articles 39 and 39-2. <Amended on Mar. 14, 2023>
(2) Notwithstanding paragraph (1), any of the following need not take measures provided in paragraph (1): <Amended on Mar. 14, 2023>
1. A public institution, non-profit corporation, or organization prescribed by Presidential Decree;
2. A person who entrusts the processing of personal information to a person prescribed by Presidential Decree, who is a micro enterprise defined in Article 2 (1) of the Framework Act on Micro Enterprises;
3. A personal information controller that has purchased insurance or joined a mutual aid organization, or accumulated reserves pursuant to other statutes to cover liabilities for damages under Articles 39 and 39-2.
(3) Matters necessary for the criteria for meeting liabilities for damages, etc. under paragraphs (1) and (2) shall be prescribed by Presidential Decree. <Newly Inserted on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
[Moved from Article 39-9; previous Article 39-7 deleted <Mar. 14, 2023>]
제39조의7(손해배상의 보장)
① 개인정보처리자로서 매출액, 개인정보의 보유 규모 등을 고려하여 대통령령으로 정하는 기준에 해당하는 자는 제39조 및 제39조의2에 따른 손해배상책임의 이행을 위하여 보험 또는 공제에 가입하거나 준비금을 적립하는 등 필요한 조치를 하여야 한다. <개정 2023. 3. 14.>
② 제1항에도 불구하고 다음 각 호의 어느 하나에 해당하는 자는 제1항에 따른 조치를 하지 아니할 수 있다. <개정 2023. 3. 14.>
1. 대통령령으로 정하는 공공기관, 비영리법인 및 단체
2. 「소상공인기본법」 제2조제1항에 따른 소상공인으로서 대통령령으로 정하는 자에게 개인정보 처리를 위탁한 자
3. 다른 법률에 따라 제39조 및 제39조의2에 따른 손해배상책임의 이행을 보장하는 보험 또는 공제에 가입하거나 준비금을 적립한 개인정보처리자
③ 제1항 및 제2항에 따른 개인정보처리자의 손해배상책임 이행 기준 등에 필요한 사항은 대통령령으로 정한다. <신설 2023. 3. 14.>
[본조신설 2020. 2. 4.]
[제39조의9에서 이동, 종전 제39조의7은 삭제
Article 39-7 (Coverage of Liabilities for Damages)
(1) A personal information controller that meets the criteria prescribed by Presidential Decree in consideration of sales and the scale of personal information retained shall take necessary measures such as purchasing insurance or joining a mutual aid organization or accumulating reserves to meet its liabilities for damages under Articles 39 and 39-2. <Amended on Mar. 14, 2023>
(2) Notwithstanding paragraph (1), any of the following need not take measures provided in paragraph (1): <Amended on Mar. 14, 2023>
1. A public institution, non-profit corporation, or organization prescribed by Presidential Decree;
2. A person who entrusts the processing of personal information to a person prescribed by Presidential Decree, who is a micro enterprise defined in Article 2 (1) of the Framework Act on Micro Enterprises;
3. A personal information controller that has purchased insurance or joined a mutual aid organization, or accumulated reserves pursuant to other statutes to cover liabilities for damages under Articles 39 and 39-2.
(3) Matters necessary for the criteria for meeting liabilities for damages, etc. under paragraphs (1) and (2) shall be prescribed by Presidential Decree. <Newly Inserted on Mar. 14, 2023>
[This Article Newly Inserted on Feb. 4, 2020]
[Moved from Article 39-9; previous Article 39-7 deleted <Mar. 14, 2023>]
CHAPTER VII PERSONAL INFORMATION DISPUTE MEDIATION COMMITTEE
제7장 개인정보 분쟁조정위원회
CHAPTER VII PERSONAL INFORMATION DISPUTE MEDIATION COMMITTEE
Article 40 (Establishment and Composition)
(1) There shall be established a Personal Information Dispute Mediation Committee (hereinafter referred to as the “Dispute Mediation Committee”) to mediate disputes over personal information.
(2) The Dispute Mediation Committee shall be composed of up to 30 members, including one chairperson, and the members shall be ex officio members and commissioned members. <Amended on Jul. 24, 2015; Mar. 14, 2023>
(3) The commissioned members shall be commissioned by the Chairperson of the Protection Commission from among the following persons, and public officials of the national agencies prescribed by Presidential Decree shall be ex officio members: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015>
1. Persons who previously served as members of the Senior Executive Service of the central administrative agencies in charge of personal information protection, or persons who presently work or have worked at equivalent positions in the public sector and related organizations, and have job experience in personal information protection;
2. Persons who presently serve or have served as associate professors or higher positions in universities or in publicly recognized research institutes;
3. Persons who presently serve or have served as judges, public prosecutors, or attorneys-at-law;
4. Persons recommended by data protection-related civic organizations or consumer groups;
5. Persons who presently work or have worked as senior officers for the trade associations comprised of personal information controllers.
(4) The chairperson shall be commissioned by the Chairperson of the Protection Commission from among Committee members who are not public officials. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015>
(5) The term of office for the chairperson and commissioned members shall be two years, and their term may be renewable for one further term. <Amended on Jul. 24, 2015>
(6) In order to conduct dispute settlement efficiently, the Dispute Mediation Committee may, if necessary, establish a mediation panel that is comprised of not more than five Committee members in each sector of mediation cases, as prescribed by Presidential Decree. In such cases, the resolution of the mediation panel delegated by the Dispute Mediation Committee shall be construed as that of the Dispute Mediation Committee.
(7) The quorum for holding a Dispute Mediation Committee or a mediation panel shall be the presence of a majority of its members, and any resolution shall require the affirmative votes of a majority of the members present.
(8) The Protection Commission may deal with the business affairs necessary for dispute mediation, such as receiving dispute mediation cases and fact-finding. <Amended on Jul. 24, 2015>
(9) Except as provided in this Act, matters necessary to operate the Dispute Mediation Committee shall be prescribed by Presidential Decree.
제40조(설치 및 구성)
① 개인정보에 관한 분쟁의 조정(調停)을 위하여 개인정보 분쟁조정위원회(이하 “분쟁조정위원회”라 한다)를 둔다.
② 분쟁조정위원회는 위원장 1명을 포함한 30명 이내의 위원으로 구성하며, 위원은 당연직위원과 위촉위원으로 구성한다. <개정 2015. 7. 24., 2023. 3. 14.>
③ 위촉위원은 다음 각 호의 어느 하나에 해당하는 사람 중에서 보호위원회 위원장이 위촉하고, 대통령령으로 정하는 국가기관 소속 공무원은 당연직위원이 된다. <개정 2013. 3. 23., 2014. 11. 19., 2015. 7. 24.>
1. 개인정보 보호업무를 관장하는 중앙행정기관의 고위공무원단에 속하는 공무원으로 재직하였던 사람 또는 이에 상당하는 공공부문 및 관련 단체의 직에 재직하고 있거나 재직하였던 사람으로서 개인정보 보호업무의 경험이 있는 사람
2. 대학이나 공인된 연구기관에서 부교수 이상 또는 이에 상당하는 직에 재직하고 있거나 재직하였던 사람
3. 판사ㆍ검사 또는 변호사로 재직하고 있거나 재직하였던 사람
4. 개인정보 보호와 관련된 시민사회단체 또는 소비자단체로부터 추천을 받은 사람
5. 개인정보처리자로 구성된 사업자단체의 임원으로 재직하고 있거나 재직하였던 사람
④ 위원장은 위원 중에서 공무원이 아닌 사람으로 보호위원회 위원장이 위촉한다. <개정 2013. 3. 23., 2014. 11. 19., 2015. 7. 24.>
⑤ 위원장과 위촉위원의 임기는 2년으로 하되, 1차에 한하여 연임할 수 있다. <개정 2015. 7. 24.>
⑥ 분쟁조정위원회는 분쟁조정 업무를 효율적으로 수행하기 위하여 필요하면 대통령령으로 정하는 바에 따라 조정사건의 분야별로 5명 이내의 위원으로 구성되는 조정부를 둘 수 있다. 이 경우 조정부가 분쟁조정위원회에서 위임받아 의결한 사항은 분쟁조정위원회에서 의결한 것으로 본다.
⑦ 분쟁조정위원회 또는 조정부는 재적위원 과반수의 출석으로 개의하며 출석위원 과반수의 찬성으로 의결한다.
⑧ 보호위원회는 분쟁조정 접수, 사실 확인 등 분쟁조정에 필요한 사무를 처리할 수 있다. <개정 2015. 7. 24.>
⑨ 이 법에서 정한 사항 외에 분쟁조정위원회 운영에 필요한 사항은 대통령령으로 정한다.
Article 40 (Establishment and Composition)
(1) There shall be established a Personal Information Dispute Mediation Committee (hereinafter referred to as the “Dispute Mediation Committee”) to mediate disputes over personal information.
(2) The Dispute Mediation Committee shall be composed of up to 30 members, including one chairperson, and the members shall be ex officio members and commissioned members. <Amended on Jul. 24, 2015; Mar. 14, 2023>
(3) The commissioned members shall be commissioned by the Chairperson of the Protection Commission from among the following persons, and public officials of the national agencies prescribed by Presidential Decree shall be ex officio members: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015>
1. Persons who previously served as members of the Senior Executive Service of the central administrative agencies in charge of personal information protection, or persons who presently work or have worked at equivalent positions in the public sector and related organizations, and have job experience in personal information protection;
2. Persons who presently serve or have served as associate professors or higher positions in universities or in publicly recognized research institutes;
3. Persons who presently serve or have served as judges, public prosecutors, or attorneys-at-law;
4. Persons recommended by data protection-related civic organizations or consumer groups;
5. Persons who presently work or have worked as senior officers for the trade associations comprised of personal information controllers.
(4) The chairperson shall be commissioned by the Chairperson of the Protection Commission from among Committee members who are not public officials. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015>
(5) The term of office for the chairperson and commissioned members shall be two years, and their term may be renewable for one further term. <Amended on Jul. 24, 2015>
(6) In order to conduct dispute settlement efficiently, the Dispute Mediation Committee may, if necessary, establish a mediation panel that is comprised of not more than five Committee members in each sector of mediation cases, as prescribed by Presidential Decree. In such cases, the resolution of the mediation panel delegated by the Dispute Mediation Committee shall be construed as that of the Dispute Mediation Committee.
(7) The quorum for holding a Dispute Mediation Committee or a mediation panel shall be the presence of a majority of its members, and any resolution shall require the affirmative votes of a majority of the members present.
(8) The Protection Commission may deal with the business affairs necessary for dispute mediation, such as receiving dispute mediation cases and fact-finding. <Amended on Jul. 24, 2015>
(9) Except as provided in this Act, matters necessary to operate the Dispute Mediation Committee shall be prescribed by Presidential Decree.
Article 41 (Guarantee of Members’ Status)
None of the Committee members shall be dismissed or de-commissioned against his or her will except when he or she is sentenced to the suspension of qualification or a heavier punishment, or unable to perform his or her duties due to mental or physical incompetence.
제41조(위원의 신분보장)
위원은 자격정지 이상의 형을 선고받거나 심신상의 장애로 직무를 수행할 수 없는 경우를 제외하고는 그의 의사에 반하여 면직되거나 해촉되지 아니한다.
Article 41 (Guarantee of Members’ Status)
None of the Committee members shall be dismissed or de-commissioned against his or her will except when he or she is sentenced to the suspension of qualification or a heavier punishment, or unable to perform his or her duties due to mental or physical incompetence.
Article 42 (Exclusion of, Challenge to, or Recusal, of Members)
(1) A member of the Dispute Mediation Committee shall be excluded from deliberation and resolution on a case requested for dispute mediation pursuant to Article 43 (1) (hereafter in this Article referred to as “case”) if:
1. The member or his or her current or former spouse is a party to the case or is a joint right holder or a joint obligor with respect to the case;
2. The member is or was a relative of a party to the case;
3. The member has given any testimony, expert opinion, or legal advice with respect to the case;
4. The member is or was involved in the case as an agent or representative of a party to the case.
(2) Where the circumstances indicate that it would be impracticable to expect fair deliberations and resolution by a Committee member, any party may file a motion for challenge to the chairperson. In such cases, the chairperson shall determine whether or not to accept the motion without referring the motion to the Dispute Mediation Committee for resolution.
(3) Where any committee member falls under the case of paragraph (1) or (2), he or she may recuse himself or herself from deliberation and resolution on the case in question.
제42조(위원의 제척ㆍ기피ㆍ회피)
① 분쟁조정위원회의 위원은 다음 각 호의 어느 하나에 해당하는 경우에는 제43조제1항에 따라 분쟁조정위원회에 신청된 분쟁조정사건(이하 이 조에서 “사건”이라 한다)의 심의ㆍ의결에서 제척(除斥)된다.
1. 위원 또는 그 배우자나 배우자였던 자가 그 사건의 당사자가 되거나 그 사건에 관하여 공동의 권리자 또는 의무자의 관계에 있는 경우
2. 위원이 그 사건의 당사자와 친족이거나 친족이었던 경우
3. 위원이 그 사건에 관하여 증언, 감정, 법률자문을 한 경우
4. 위원이 그 사건에 관하여 당사자의 대리인으로서 관여하거나 관여하였던 경우
② 당사자는 위원에게 공정한 심의ㆍ의결을 기대하기 어려운 사정이 있으면 위원장에게 기피신청을 할 수 있다. 이 경우 위원장은 기피신청에 대하여 분쟁조정위원회의 의결을 거치지 아니하고 결정한다.
③ 위원이 제1항 또는 제2항의 사유에 해당하는 경우에는 스스로 그 사건의 심의ㆍ의결에서 회피할 수 있다.
Article 42 (Exclusion of, Challenge to, or Recusal, of Members)
(1) A member of the Dispute Mediation Committee shall be excluded from deliberation and resolution on a case requested for dispute mediation pursuant to Article 43 (1) (hereafter in this Article referred to as “case”) if:
1. The member or his or her current or former spouse is a party to the case or is a joint right holder or a joint obligor with respect to the case;
2. The member is or was a relative of a party to the case;
3. The member has given any testimony, expert opinion, or legal advice with respect to the case;
4. The member is or was involved in the case as an agent or representative of a party to the case.
(2) Where the circumstances indicate that it would be impracticable to expect fair deliberations and resolution by a Committee member, any party may file a motion for challenge to the chairperson. In such cases, the chairperson shall determine whether or not to accept the motion without referring the motion to the Dispute Mediation Committee for resolution.
(3) Where any committee member falls under the case of paragraph (1) or (2), he or she may recuse himself or herself from deliberation and resolution on the case in question.
Article 43 (Application for Mediation)
(1) Any person who wishes a dispute over personal information mediated may apply for mediation of the dispute to the Dispute Mediation Committee.
(2) Upon receipt of an application for dispute mediation from a party to the case, the Dispute Mediation Committee shall notify the counterparty of the application for mediation.
(3) Where a personal information controller is notified of dispute mediation under paragraph (2), he or she shall respond to it unless there is a compelling reason not to do so. <Amended on Mar. 14, 2023>
제43조(조정의 신청 등)
① 개인정보와 관련한 분쟁의 조정을 원하는 자는 분쟁조정위원회에 분쟁조정을 신청할 수 있다.
② 분쟁조정위원회는 당사자 일방으로부터 분쟁조정 신청을 받았을 때에는 그 신청내용을 상대방에게 알려야 한다.
③ 개인정보처리자가 제2항에 따른 분쟁조정의 통지를 받은 경우에는 특별한 사유가 없으면 분쟁조정에 응하여야 한다. <개정 2023. 3. 14.>
Article 43 (Application for Mediation)
(1) Any person who wishes a dispute over personal information mediated may apply for mediation of the dispute to the Dispute Mediation Committee.
(2) Upon receipt of an application for dispute mediation from a party to the case, the Dispute Mediation Committee shall notify the counterparty of the application for mediation.
(3) Where a personal information controller is notified of dispute mediation under paragraph (2), he or she shall respond to it unless there is a compelling reason not to do so. <Amended on Mar. 14, 2023>
Article 44 (Time Limitation of Mediation Proceedings)
(1) The Dispute Mediation Committee shall examine the case and prepare a proposal of mediation within 60 days from the date of receiving an application pursuant to Article 43 (1): Provided, That the Dispute Mediation Committee may pass a resolution to extend such period by reason of inevitable circumstances.
(2) Where the period is extended pursuant to the proviso of paragraph (1), the Dispute Mediation Committee shall inform the applicant of the reasons for extending the period and other matters concerning the extension of such period.
제44조(처리기간)
① 분쟁조정위원회는 제43조제1항에 따른 분쟁조정 신청을 받은 날부터 60일 이내에 이를 심사하여 조정안을 작성하여야 한다. 다만, 부득이한 사정이 있는 경우에는 분쟁조정위원회의 의결로 처리기간을 연장할 수 있다.
② 분쟁조정위원회는 제1항 단서에 따라 처리기간을 연장한 경우에는 기간연장의 사유와 그 밖의 기간연장에 관한 사항을 신청인에게 알려야 한다.
Article 44 (Time Limitation of Mediation Proceedings)
(1) The Dispute Mediation Committee shall examine the case and prepare a proposal of mediation within 60 days from the date of receiving an application pursuant to Article 43 (1): Provided, That the Dispute Mediation Committee may pass a resolution to extend such period by reason of inevitable circumstances.
(2) Where the period is extended pursuant to the proviso of paragraph (1), the Dispute Mediation Committee shall inform the applicant of the reasons for extending the period and other matters concerning the extension of such period.
Article 45 (Requests for Materials and Fact-Finding Investigation)
(1) Upon receipt of an application for dispute mediation pursuant to Article 43 (1), the Dispute Mediation Committee may request disputing parties to provide materials necessary to mediate the dispute. In such cases, such parties shall comply with the request in the absence of good cause.
(2) Where it is necessary to verify facts for the mediation of a dispute, the Dispute Mediation Committee may require members of the Dispute Mediation Committee or public officials belonging to the secretariat prescribed by Presidential Decree to enter the place related to the case and to investigate or inspect relevant data. In such cases, where any party to the relevant dispute has good cause for refusing the relevant investigation or inspection, he or she may refuse the investigation or access by explaining such grounds therefor. <Newly Inserted on Mar. 14, 2023>
(3) A public official who performs his or her duties pursuant to Article 2 shall carry identification verifying his or her authority and present it to relevant persons. <Newly Inserted on Mar. 14, 2023>
(4) If deemed necessary to mediate a dispute, the Dispute Mediation Committee may request relevant agencies, etc. to provide necessary cooperation, such as the submission of materials or opinions. <Newly Inserted on Mar. 14, 2023>
(5) The Dispute Mediation Committee may summon disputing parties or relevant witnesses to appear before the Committee to hear their opinions, if deemed necessary. <Amended on Mar. 14, 2023>
[Title Amended on Mar. 14, 2023]
제45조(자료의 요청 및 사실조사 등)
① 분쟁조정위원회는 제43조제1항에 따라 분쟁조정 신청을 받았을 때에는 해당 분쟁의 조정을 위하여 필요한 자료를 분쟁당사자에게 요청할 수 있다. 이 경우 분쟁당사자는 정당한 사유가 없으면 요청에 따라야 한다.
② 분쟁조정위원회는 분쟁의 조정을 위하여 사실 확인이 필요한 경우에는 분쟁조정위원회의 위원 또는 대통령령으로 정하는 사무기구의 소속 공무원으로 하여금 사건과 관련된 장소에 출입하여 관련 자료를 조사하거나 열람하게 할 수 있다. 이 경우 분쟁당사자는 해당 조사ㆍ열람을 거부할 정당한 사유가 있을 때에는 그 사유를 소명하고 조사ㆍ열람에 따르지 아니할 수 있다. <신설 2023. 3. 14.>
③ 제2항에 따른 조사ㆍ열람을 하는 위원 또는 공무원은 그 권한을 표시하는 증표를 지니고 이를 관계인에게 내보여야 한다. <신설 2023. 3. 14.>
④ 분쟁조정위원회는 분쟁의 조정을 위하여 필요하다고 인정하면 관계 기관 등에 자료 또는 의견의 제출 등 필요한 협조를 요청할 수 있다. <신설 2023. 3. 14.>
⑤ 분쟁조정위원회는 필요하다고 인정하면 분쟁당사자나 참고인을 위원회에 출석하도록 하여 그 의견을 들을 수 있다. <개정 2023. 3. 14.>
[제목개정 2023. 3. 14.]
Article 45 (Requests for Materials and Fact-Finding Investigation)
(1) Upon receipt of an application for dispute mediation pursuant to Article 43 (1), the Dispute Mediation Committee may request disputing parties to provide materials necessary to mediate the dispute. In such cases, such parties shall comply with the request in the absence of good cause.
(2) Where it is necessary to verify facts for the mediation of a dispute, the Dispute Mediation Committee may require members of the Dispute Mediation Committee or public officials belonging to the secretariat prescribed by Presidential Decree to enter the place related to the case and to investigate or inspect relevant data. In such cases, where any party to the relevant dispute has good cause for refusing the relevant investigation or inspection, he or she may refuse the investigation or access by explaining such grounds therefor. <Newly Inserted on Mar. 14, 2023>
(3) A public official who performs his or her duties pursuant to Article 2 shall carry identification verifying his or her authority and present it to relevant persons. <Newly Inserted on Mar. 14, 2023>
(4) If deemed necessary to mediate a dispute, the Dispute Mediation Committee may request relevant agencies, etc. to provide necessary cooperation, such as the submission of materials or opinions. <Newly Inserted on Mar. 14, 2023>
(5) The Dispute Mediation Committee may summon disputing parties or relevant witnesses to appear before the Committee to hear their opinions, if deemed necessary. <Amended on Mar. 14, 2023>
[Title Amended on Mar. 14, 2023]
Article 45-2 (Restriction on Invoking Statements)
Opinions and statements made in mediation proceedings shall not be invoked in a lawsuit (excluding quasi-retrial of the relevant conciliation).
[This Article Newly Inserted on Mar. 14, 2023]
제45조의2(진술의 원용 제한)
조정절차에서의 의견과 진술은 소송(해당 조정에 대한 준재심은 제외한다)에서 원용(援用)하지 못한다.
[본조신설 2023. 3. 14.]
Article 45-2 (Restriction on Invoking Statements)
Opinions and statements made in mediation proceedings shall not be invoked in a lawsuit (excluding quasi-retrial of the relevant conciliation).
[This Article Newly Inserted on Mar. 14, 2023]
Article 46 (Settlement Advice before Mediation)
Upon receipt of an application for dispute mediation pursuant to Article 43 (1), the Dispute Mediation Committee may present a draft settlement to the disputing parties and recommend a settlement before mediation.
제46조(조정 전 합의 권고)
분쟁조정위원회는 제43조제1항에 따라 분쟁조정 신청을 받았을 때에는 당사자에게 그 내용을 제시하고 조정 전 합의를 권고할 수 있다.
Article 46 (Settlement Advice before Mediation)
Upon receipt of an application for dispute mediation pursuant to Article 43 (1), the Dispute Mediation Committee may present a draft settlement to the disputing parties and recommend a settlement before mediation.
Article 47 (Dispute Mediation)
(1) The Dispute Mediation Committee may prepare a proposal of mediation including the following matters:
1. Suspension of the violation to be investigated;
2. Restitution, compensation and other necessary remedies;
3. Any measure necessary to prevent recurrence of the identical or similar violations.
(2) Upon preparing proposal of mediation pursuant to paragraph (1), the Dispute Mediation Committee shall present the proposal of mediation to each party without delay.
(3) If a party presented with the proposal of mediation prepared under paragraph (2) fails to notify the Dispute Mediation Committee of his or her acceptance or denial of the proposal of mediation within 15 days from the date of receipt of such decision, he or she shall be deemed to have accepted the decision. <Amended on Mar. 14, 2023>
(4) If the parties accept the draft mediation decision (including deemed acceptance under paragraph (3)), the Dispute Mediation Committee shall prepare a written mediation decision and deliver the original copies thereof to each party or his or her agents after the chairperson of the Dispute Mediation Committee and the parties affix their names and seals thereto: Provided, That in cases of deemed acceptance under paragraph (3), the names, seals, and signatures of each party may be omitted. <Amended on Mar. 14, 2023>
(5) The mediation agreed upon pursuant to paragraph (4) shall have the same effect as a settlement before the court.
제47조(분쟁의 조정)
① 분쟁조정위원회는 다음 각 호의 어느 하나의 사항을 포함하여 조정안을 작성할 수 있다.
1. 조사 대상 침해행위의 중지
2. 원상회복, 손해배상, 그 밖에 필요한 구제조치
3. 같거나 비슷한 침해의 재발을 방지하기 위하여 필요한 조치
② 분쟁조정위원회는 제1항에 따라 조정안을 작성하면 지체 없이 각 당사자에게 제시하여야 한다.
③ 제2항에 따라 조정안을 제시받은 당사자가 제시받은 날부터 15일 이내에 수락 여부를 알리지 아니하면 조정을 수락한 것으로 본다. <개정 2023. 3. 14.>
④ 당사자가 조정내용을 수락한 경우(제3항에 따라 수락한 것으로 보는 경우를 포함한다) 분쟁조정위원회는 조정서를 작성하고, 분쟁조정위원회의 위원장과 각 당사자가 기명날인 또는 서명을 한 후 조정서 정본을 지체 없이 각 당사자 또는 그 대리인에게 송달하여야 한다. 다만, 제3항에 따라 수락한 것으로 보는 경우에는 각 당사자의 기명날인 및 서명을 생략할 수 있다. <개정 2023. 3. 14.>
⑤ 제4항에 따른 조정의 내용은 재판상 화해와 동일한 효력을 갖는다.
Article 47 (Dispute Mediation)
(1) The Dispute Mediation Committee may prepare a proposal of mediation including the following matters:
1. Suspension of the violation to be investigated;
2. Restitution, compensation and other necessary remedies;
3. Any measure necessary to prevent recurrence of the identical or similar violations.
(2) Upon preparing proposal of mediation pursuant to paragraph (1), the Dispute Mediation Committee shall present the proposal of mediation to each party without delay.
(3) If a party presented with the proposal of mediation prepared under paragraph (2) fails to notify the Dispute Mediation Committee of his or her acceptance or denial of the proposal of mediation within 15 days from the date of receipt of such decision, he or she shall be deemed to have accepted the decision. <Amended on Mar. 14, 2023>
(4) If the parties accept the draft mediation decision (including deemed acceptance under paragraph (3)), the Dispute Mediation Committee shall prepare a written mediation decision and deliver the original copies thereof to each party or his or her agents after the chairperson of the Dispute Mediation Committee and the parties affix their names and seals thereto: Provided, That in cases of deemed acceptance under paragraph (3), the names, seals, and signatures of each party may be omitted. <Amended on Mar. 14, 2023>
(5) The mediation agreed upon pursuant to paragraph (4) shall have the same effect as a settlement before the court.
Article 48 (Rejection and Suspension of Mediation)
(1) Where the Dispute Mediation Committee deems that it is inappropriate to mediate any dispute in view of its nature, or that an application for mediation of any dispute is filed for an improper purpose, it may reject the mediation. In this case, the reasons for rejecting the mediation shall be notified to the applicant.
(2) If one of the parties files a lawsuit while mediation proceedings are pending, the Dispute Mediation Committee shall suspend the dispute mediation and notify the parties thereof.
제48조(조정의 거부 및 중지)
① 분쟁조정위원회는 분쟁의 성질상 분쟁조정위원회에서 조정하는 것이 적합하지 아니하다고 인정하거나 부정한 목적으로 조정이 신청되었다고 인정하는 경우에는 그 조정을 거부할 수 있다. 이 경우 조정거부의 사유 등을 신청인에게 알려야 한다.
② 분쟁조정위원회는 신청된 조정사건에 대한 처리절차를 진행하던 중에 한 쪽 당사자가 소를 제기하면 그 조정의 처리를 중지하고 이를 당사자에게 알려야 한다.
Article 48 (Rejection and Suspension of Mediation)
(1) Where the Dispute Mediation Committee deems that it is inappropriate to mediate any dispute in view of its nature, or that an application for mediation of any dispute is filed for an improper purpose, it may reject the mediation. In this case, the reasons for rejecting the mediation shall be notified to the applicant.
(2) If one of the parties files a lawsuit while mediation proceedings are pending, the Dispute Mediation Committee shall suspend the dispute mediation and notify the parties thereof.
Article 49 (Collective Dispute Mediation)
(1) The State, a local government, a data protection organization or institution, a data subject, and a personal information controller may request or apply for a collective dispute mediation (hereinafter referred to as “collective dispute mediation”) to the Dispute Mediation Committee where damages or infringement on rights occur to multiple data subjects in an identical or similar manner, and such incident is such as prescribed by Presidential Decree.
(2) Upon receipt of a request or an application for collective dispute mediation under paragraph (1), the Dispute Mediation Committee may commence, by its resolution, collective dispute mediation proceedings pursuant to paragraphs (3) through (7). In such cases, the Dispute Mediation Committee shall publicly announce the commencement of such proceedings for a period prescribed by Presidential Decree.
(3) The Dispute Mediation Committee may accept an application from any data subject or personal information controller other than the parties to the collective dispute mediation to participate in the collective dispute mediation additionally as a party.
(4) The Dispute Mediation Committee may, by its resolution, select one or a few persons as a representative party, who most appropriately represents the common interest among the parties to the collective dispute mediation pursuant to paragraphs (1) and (3).
(5) When the personal information controller accepts a collective dispute mediation award presented by the Dispute Mediation Committee, the Dispute Mediation Committee may advise the personal information controller to prepare and submit a compensation plan for the benefit of the non-party data subjects suffered from the same incident.
(6) Notwithstanding Article 48 (2), if a group of data subjects among a multitude of data subject parties to the collective dispute mediation files a lawsuit before the court, the Dispute Mediation Committee shall not suspend the proceedings but exclude the relevant data subjects, who have filed the lawsuit, from the proceedings.
(7) The period for collective dispute mediation shall not exceed 60 days from the following day when public announcement referred to in paragraph (2) ends: Provided, That the period can be extended by the resolution of the Dispute Mediation Committee in extenuating circumstances.
(8) Other necessary matters, such as the procedures for collective dispute mediation, shall be prescribed by Presidential Decree.
제49조(집단분쟁조정)
① 국가 및 지방자치단체, 개인정보 보호단체 및 기관, 정보주체, 개인정보처리자는 정보주체의 피해 또는 권리침해가 다수의 정보주체에게 같거나 비슷한 유형으로 발생하는 경우로서 대통령령으로 정하는 사건에 대하여는 분쟁조정위원회에 일괄적인 분쟁조정(이하 “집단분쟁조정”이라 한다)을 의뢰 또는 신청할 수 있다.
② 제1항에 따라 집단분쟁조정을 의뢰받거나 신청받은 분쟁조정위원회는 그 의결로써 제3항부터 제7항까지의 규정에 따른 집단분쟁조정의 절차를 개시할 수 있다. 이 경우 분쟁조정위원회는 대통령령으로 정하는 기간 동안 그 절차의 개시를 공고하여야 한다.
③ 분쟁조정위원회는 집단분쟁조정의 당사자가 아닌 정보주체 또는 개인정보처리자로부터 그 분쟁조정의 당사자에 추가로 포함될 수 있도록 하는 신청을 받을 수 있다.
④ 분쟁조정위원회는 그 의결로써 제1항 및 제3항에 따른 집단분쟁조정의 당사자 중에서 공동의 이익을 대표하기에 가장 적합한 1인 또는 수인을 대표당사자로 선임할 수 있다.
⑤ 분쟁조정위원회는 개인정보처리자가 분쟁조정위원회의 집단분쟁조정의 내용을 수락한 경우에는 집단분쟁조정의 당사자가 아닌 자로서 피해를 입은 정보주체에 대한 보상계획서를 작성하여 분쟁조정위원회에 제출하도록 권고할 수 있다.
⑥ 제48조제2항에도 불구하고 분쟁조정위원회는 집단분쟁조정의 당사자인 다수의 정보주체 중 일부의 정보주체가 법원에 소를 제기한 경우에는 그 절차를 중지하지 아니하고, 소를 제기한 일부의 정보주체를 그 절차에서 제외한다.
⑦ 집단분쟁조정의 기간은 제2항에 따른 공고가 종료된 날의 다음 날부터 60일 이내로 한다. 다만, 부득이한 사정이 있는 경우에는 분쟁조정위원회의 의결로 처리기간을 연장할 수 있다.
⑧ 집단분쟁조정의 절차 등에 관하여 필요한 사항은 대통령령으로 정한다.
Article 49 (Collective Dispute Mediation)
(1) The State, a local government, a data protection organization or institution, a data subject, and a personal information controller may request or apply for a collective dispute mediation (hereinafter referred to as “collective dispute mediation”) to the Dispute Mediation Committee where damages or infringement on rights occur to multiple data subjects in an identical or similar manner, and such incident is such as prescribed by Presidential Decree.
(2) Upon receipt of a request or an application for collective dispute mediation under paragraph (1), the Dispute Mediation Committee may commence, by its resolution, collective dispute mediation proceedings pursuant to paragraphs (3) through (7). In such cases, the Dispute Mediation Committee shall publicly announce the commencement of such proceedings for a period prescribed by Presidential Decree.
(3) The Dispute Mediation Committee may accept an application from any data subject or personal information controller other than the parties to the collective dispute mediation to participate in the collective dispute mediation additionally as a party.
(4) The Dispute Mediation Committee may, by its resolution, select one or a few persons as a representative party, who most appropriately represents the common interest among the parties to the collective dispute mediation pursuant to paragraphs (1) and (3).
(5) When the personal information controller accepts a collective dispute mediation award presented by the Dispute Mediation Committee, the Dispute Mediation Committee may advise the personal information controller to prepare and submit a compensation plan for the benefit of the non-party data subjects suffered from the same incident.
(6) Notwithstanding Article 48 (2), if a group of data subjects among a multitude of data subject parties to the collective dispute mediation files a lawsuit before the court, the Dispute Mediation Committee shall not suspend the proceedings but exclude the relevant data subjects, who have filed the lawsuit, from the proceedings.
(7) The period for collective dispute mediation shall not exceed 60 days from the following day when public announcement referred to in paragraph (2) ends: Provided, That the period can be extended by the resolution of the Dispute Mediation Committee in extenuating circumstances.
(8) Other necessary matters, such as the procedures for collective dispute mediation, shall be prescribed by Presidential Decree.
Article 50 (Mediation Procedures)
(1) Except as provided in Articles 43 through 49, the method and procedures to mediate disputes and matters necessary to deal with such dispute mediation shall be prescribed by Presidential Decree.
(2) Except as provided in this Act, the Judicial Conciliation of Civil Disputes Act shall apply mutatis mutandis to the operation of the Dispute Mediation Committee and dispute mediation proceedings.
제50조(조정절차 등)
① 제43조부터 제49조까지의 규정에서 정한 것 외에 분쟁의 조정방법, 조정절차 및 조정업무의 처리 등에 필요한 사항은 대통령령으로 정한다.
② 분쟁조정위원회의 운영 및 분쟁조정 절차에 관하여 이 법에서 규정하지 아니한 사항에 대하여는 「민사조정법」을 준용한다.
Article 50 (Mediation Procedures)
(1) Except as provided in Articles 43 through 49, the method and procedures to mediate disputes and matters necessary to deal with such dispute mediation shall be prescribed by Presidential Decree.
(2) Except as provided in this Act, the Judicial Conciliation of Civil Disputes Act shall apply mutatis mutandis to the operation of the Dispute Mediation Committee and dispute mediation proceedings.
Article 50-2 (Notification of Opinion for Improvement)
The Dispute Mediation Committee may notify the Protection Commission and the heads of relevant central administrative agencies of its opinions for the improvement of the protection of personal information and the protection of the rights of data subjects in connection with the performance of the work under its jurisdiction.
[This Article Newly Inserted on Mar. 14, 2023]
제50조의2(개선의견의 통보)
분쟁조정위원회는 소관 업무 수행과 관련하여 개인정보 보호 및 정보주체의 권리 보호를 위한 개선의견을 보호위원회 및 관계 중앙행정기관의 장에게 통보할 수 있다.
[본조신설 2023. 3. 14.]
Article 50-2 (Notification of Opinion for Improvement)
The Dispute Mediation Committee may notify the Protection Commission and the heads of relevant central administrative agencies of its opinions for the improvement of the protection of personal information and the protection of the rights of data subjects in connection with the performance of the work under its jurisdiction.
[This Article Newly Inserted on Mar. 14, 2023]
CHAPTER VIII CLASS-ACTION LAWSUIT OVER DATA INFRINGEMENT
제8장 개인정보 단체소송
CHAPTER VIII CLASS-ACTION LAWSUIT OVER DATA INFRINGEMENT
Article 51 (Parties to Class Action Lawsuit)
Any of the following organizations may file a lawsuit (hereinafter referred to as “class action lawsuit”) with the court to prevent or suspend an infringement with respect to personal information if a personal information controller rejects or would not accept the collective dispute mediation under Article 49:
1. A consumer group registered with the Fair Trade Commission pursuant to Article 29 of the Framework Act on Consumers that meets all of the following criteria:
(a) Its by-laws shall constantly state the purpose to augment the rights and interests of data subjects;
(b) The number of full members shall exceed 1,000;
(c) Three years shall have passed since the registration under Article 29 of the Framework Act on Consumers;
2. A non-profit, non-governmental organization referred to in Article 2 of the Assistance for Non-Profit, Non-Governmental Organizations Act that meets all of the following criteria:
(a) At least 100 data subjects, who experienced the same infringement as a matter of law or fact, shall submit a request to file a class action lawsuit;
(b) Its by-laws shall state the purpose of data protection and it has conducted such activities for the most recent three years;
(c) The number of regular members shall be at least 5,000;
(d) It shall be registered with any central administrative agency.
제51조(단체소송의 대상 등)
다음 각 호의 어느 하나에 해당하는 단체는 개인정보처리자가 제49조에 따른 집단분쟁조정을 거부하거나 집단분쟁조정의 결과를 수락하지 아니한 경우에는 법원에 권리침해 행위의 금지ㆍ중지를 구하는 소송(이하 “단체소송”이라 한다)을 제기할 수 있다.
1. 「소비자기본법」 제29조에 따라 공정거래위원회에 등록한 소비자단체로서 다음 각 목의 요건을 모두 갖춘 단체
가. 정관에 따라 상시적으로 정보주체의 권익증진을 주된 목적으로 하는 단체일 것
나. 단체의 정회원수가 1천명 이상일 것
다. 「소비자기본법」 제29조에 따른 등록 후 3년이 경과하였을 것
2. 「비영리민간단체 지원법」 제2조에 따른 비영리민간단체로서 다음 각 목의 요건을 모두 갖춘 단체
가. 법률상 또는 사실상 동일한 침해를 입은 100명 이상의 정보주체로부터 단체소송의 제기를 요청받을 것
나. 정관에 개인정보 보호를 단체의 목적으로 명시한 후 최근 3년 이상 이를 위한 활동실적이 있을 것
다. 단체의 상시 구성원수가 5천명 이상일 것
라. 중앙행정기관에 등록되어 있을 것
Article 51 (Parties to Class Action Lawsuit)
Any of the following organizations may file a lawsuit (hereinafter referred to as “class action lawsuit”) with the court to prevent or suspend an infringement with respect to personal information if a personal information controller rejects or would not accept the collective dispute mediation under Article 49:
1. A consumer group registered with the Fair Trade Commission pursuant to Article 29 of the Framework Act on Consumers that meets all of the following criteria:
(a) Its by-laws shall constantly state the purpose to augment the rights and interests of data subjects;
(b) The number of full members shall exceed 1,000;
(c) Three years shall have passed since the registration under Article 29 of the Framework Act on Consumers;
2. A non-profit, non-governmental organization referred to in Article 2 of the Assistance for Non-Profit, Non-Governmental Organizations Act that meets all of the following criteria:
(a) At least 100 data subjects, who experienced the same infringement as a matter of law or fact, shall submit a request to file a class action lawsuit;
(b) Its by-laws shall state the purpose of data protection and it has conducted such activities for the most recent three years;
(c) The number of regular members shall be at least 5,000;
(d) It shall be registered with any central administrative agency.
Article 52 (Exclusive Jurisdictions)
(1) A class action lawsuit shall be subject to the exclusive jurisdiction of the competent district court (panel of judges) at the place of business or main office, or at the address of the business manager in the case of no business establishment, of the defendant.
(2) Where paragraph (1) applies to a foreign business entity, the same shall be determined by the place of business or main office, or the address of the business manager located in the Republic of Korea.
제52조(전속관할)
① 단체소송의 소는 피고의 주된 사무소 또는 영업소가 있는 곳, 주된 사무소나 영업소가 없는 경우에는 주된 업무담당자의 주소가 있는 곳의 지방법원 본원 합의부의 관할에 전속한다.
② 제1항을 외국사업자에 적용하는 경우 대한민국에 있는 이들의 주된 사무소ㆍ영업소 또는 업무담당자의 주소에 따라 정한다.
Article 52 (Exclusive Jurisdictions)
(1) A class action lawsuit shall be subject to the exclusive jurisdiction of the competent district court (panel of judges) at the place of business or main office, or at the address of the business manager in the case of no business establishment, of the defendant.
(2) Where paragraph (1) applies to a foreign business entity, the same shall be determined by the place of business or main office, or the address of the business manager located in the Republic of Korea.
Article 53 (Retention of Litigation Attorney)
The plaintiff of a class-action lawsuit shall retain an attorney-at-law as a litigation attorney.
제53조(소송대리인의 선임)
단체소송의 원고는 변호사를 소송대리인으로 선임하여야 한다.
Article 53 (Retention of Litigation Attorney)
The plaintiff of a class-action lawsuit shall retain an attorney-at-law as a litigation attorney.
Article 54 (Application for Permission of Lawsuit)
(1) An organization that intends to file a class action shall submit to the court an application for permission of lawsuit describing the following in addition to the complaint:
1. Plaintiff and his or her litigation attorney;
2. Defendant;
3. Detailed violation of the rights of data subjects.
(2) An application for certification of lawsuit filed under paragraph (1) shall be accompanied by the following materials:
1. Materials that prove that the organization which has filed a lawsuit meets all criteria provided for in Article 51;
2. Documentary evidence that proves that the personal information controller has rejected the dispute mediation or would not accept the mediation award.
제54조(소송허가신청)
① 단체소송을 제기하는 단체는 소장과 함께 다음 각 호의 사항을 기재한 소송허가신청서를 법원에 제출하여야 한다.
1. 원고 및 그 소송대리인
2. 피고
3. 정보주체의 침해된 권리의 내용
② 제1항에 따른 소송허가신청서에는 다음 각 호의 자료를 첨부하여야 한다.
1. 소제기단체가 제51조 각 호의 어느 하나에 해당하는 요건을 갖추고 있음을 소명하는 자료
2. 개인정보처리자가 조정을 거부하였거나 조정결과를 수락하지 아니하였음을 증명하는 서류
Article 54 (Application for Permission of Lawsuit)
(1) An organization that intends to file a class action shall submit to the court an application for permission of lawsuit describing the following in addition to the complaint:
1. Plaintiff and his or her litigation attorney;
2. Defendant;
3. Detailed violation of the rights of data subjects.
(2) An application for certification of lawsuit filed under paragraph (1) shall be accompanied by the following materials:
1. Materials that prove that the organization which has filed a lawsuit meets all criteria provided for in Article 51;
2. Documentary evidence that proves that the personal information controller has rejected the dispute mediation or would not accept the mediation award.
Article 55 (Requirements for Permission of Lawsuit)
(1) The court shall permit a class action only when all of the following requirements are satisfied:
1. That the personal information controller has rejected the dispute mediation or would not accept the mediation award;
2. That none of the descriptions in the application for permission of lawsuit filed under Article 54 is defective.
(2) The court decision that permits, or refuses to permit, a class action may be challenged through immediate appeal.
제55조(소송허가요건 등)
① 법원은 다음 각 호의 요건을 모두 갖춘 경우에 한하여 결정으로 단체소송을 허가한다.
1. 개인정보처리자가 분쟁조정위원회의 조정을 거부하거나 조정결과를 수락하지 아니하였을 것
2. 제54조에 따른 소송허가신청서의 기재사항에 흠결이 없을 것
② 단체소송을 허가하거나 불허가하는 결정에 대하여는 즉시항고할 수 있다.
Article 55 (Requirements for Permission of Lawsuit)
(1) The court shall permit a class action only when all of the following requirements are satisfied:
1. That the personal information controller has rejected the dispute mediation or would not accept the mediation award;
2. That none of the descriptions in the application for permission of lawsuit filed under Article 54 is defective.
(2) The court decision that permits, or refuses to permit, a class action may be challenged through immediate appeal.
Article 56 (Effect of Conclusive Judgment)
When a judgment dismissing a plaintiff's complaint becomes conclusive, any other organizations provided for in Article 51 cannot file a class-action lawsuit regarding the identical case: Provided, That this shall not apply in any of the following circumstances:
1. Where, after the judgment became conclusive, new evidence has been found by the State, a local government, or a State or local government-invested institution regarding the said case;
2. Where the judgment dismissing the lawsuit proves to have been caused by intention by the plaintiff.
제56조(확정판결의 효력)
원고의 청구를 기각하는 판결이 확정된 경우 이와 동일한 사안에 관하여는 제51조에 따른 다른 단체는 단체소송을 제기할 수 없다. 다만, 다음 각 호의 어느 하나에 해당하는 경우에는 그러하지 아니하다.
1. 판결이 확정된 후 그 사안과 관련하여 국가ㆍ지방자치단체 또는 국가ㆍ지방자치단체가 설립한 기관에 의하여 새로운 증거가 나타난 경우
2. 기각판결이 원고의 고의로 인한 것임이 밝혀진 경우
Article 56 (Effect of Conclusive Judgment)
When a judgment dismissing a plaintiff's complaint becomes conclusive, any other organizations provided for in Article 51 cannot file a class-action lawsuit regarding the identical case: Provided, That this shall not apply in any of the following circumstances:
1. Where, after the judgment became conclusive, new evidence has been found by the State, a local government, or a State or local government-invested institution regarding the said case;
2. Where the judgment dismissing the lawsuit proves to have been caused by intention by the plaintiff.
Article 57 (Application of Civil Procedure Act)
(1) Except as otherwise expressly provided for in this Act, the Civil Procedure Act shall apply to a class action.
(2) When a decision to permit a class action lawsuit is made under Article 55, a preservation order provided for in Part IV of the Civil Execution Act may be issued.
(3) Matters necessary for class action lawsuit proceedings shall be provided by the Supreme Court Regulations.
제57조(「민사소송법」의 적용 등)
① 단체소송에 관하여 이 법에 특별한 규정이 없는 경우에는 「민사소송법」을 적용한다.
② 제55조에 따른 단체소송의 허가결정이 있는 경우에는 「민사집행법」 제4편에 따른 보전처분을 할 수 있다.
③ 단체소송의 절차에 관하여 필요한 사항은 대법원규칙으로 정한다.
Article 57 (Application of Civil Procedure Act)
(1) Except as otherwise expressly provided for in this Act, the Civil Procedure Act shall apply to a class action.
(2) When a decision to permit a class action lawsuit is made under Article 55, a preservation order provided for in Part IV of the Civil Execution Act may be issued.
(3) Matters necessary for class action lawsuit proceedings shall be provided by the Supreme Court Regulations.
CHAPTER IX SUPPLEMENTARY PROVISIONS
제9장 보칙
CHAPTER IX SUPPLEMENTARY PROVISIONS
Article 58 (Partial Exclusion from Application)
(1) Chapter III through VIII shall not apply to any of the following personal information: <Amended on Mar. 14, 2023>
1. Deleted; <Mar. 14, 2023>
2. Personal information collected or requested to be provided for the analysis of information related to national security;
3. Deleted; <Mar. 14, 2023>
4. Personal information collected or used for its own purposes of reporting by the press, missionary activities by religious organizations, and nomination of candidates by political parties, respectively.
(2) Articles 15, 22, 22-2, 27 (1) and (2), 34, and 37 shall not apply to any personal information that is processed by means of the fixed visual data processing devices installed and operated at open places pursuant to the subparagraphs of Article 25 (1). <Amended on Mar. 14, 2023>
(3) Articles 15, 30 and 31 shall not apply to any personal information that is processed by a personal information controller to operate a group or association for friendship, such as an alumni association and a hobby club.
(4) In the case of processing personal information pursuant to paragraph (1), a personal information controller shall process the personal information to the minimum extent necessary to attain the intended purpose for the minimum period; and shall also make necessary arrangements, such as technical, managerial and physical safeguards, individual grievance handling and other necessary measures for the safe management and appropriate processing of such personal information.
제58조(적용의 일부 제외)
① 다음 각 호의 어느 하나에 해당하는 개인정보에 관하여는 제3장부터 제8장까지를 적용하지 아니한다. <개정 2023. 3. 14.>
1. 삭제 <2023. 3. 14.>
2. 국가안전보장과 관련된 정보 분석을 목적으로 수집 또는 제공 요청되는 개인정보
3. 삭제 <2023. 3. 14.>
4. 언론, 종교단체, 정당이 각각 취재ㆍ보도, 선교, 선거 입후보자 추천 등 고유 목적을 달성하기 위하여 수집ㆍ이용하는 개인정보
② 제25조제1항 각 호에 따라 공개된 장소에 고정형 영상정보처리기기를 설치ㆍ운영하여 처리되는 개인정보에 대해서는 제15조, 제22조, 제22조의2, 제27조제1항ㆍ제2항, 제34조 및 제37조를 적용하지 아니한다. <개정 2023. 3. 14.>
③ 개인정보처리자가 동창회, 동호회 등 친목 도모를 위한 단체를 운영하기 위하여 개인정보를 처리하는 경우에는 제15조, 제30조 및 제31조를 적용하지 아니한다.
④ 개인정보처리자는 제1항 각 호에 따라 개인정보를 처리하는 경우에도 그 목적을 위하여 필요한 범위에서 최소한의 기간에 최소한의 개인정보만을 처리하여야 하며, 개인정보의 안전한 관리를 위하여 필요한 기술적ㆍ관리적 및 물리적 보호조치, 개인정보의 처리에 관한 고충처리, 그 밖에 개인정보의 적절한 처리를 위하여 필요한 조치를 마련하여야 한다.
Article 58 (Partial Exclusion from Application)
(1) Chapter III through VIII shall not apply to any of the following personal information: <Amended on Mar. 14, 2023>
1. Deleted; <Mar. 14, 2023>
2. Personal information collected or requested to be provided for the analysis of information related to national security;
3. Deleted; <Mar. 14, 2023>
4. Personal information collected or used for its own purposes of reporting by the press, missionary activities by religious organizations, and nomination of candidates by political parties, respectively.
(2) Articles 15, 22, 22-2, 27 (1) and (2), 34, and 37 shall not apply to any personal information that is processed by means of the fixed visual data processing devices installed and operated at open places pursuant to the subparagraphs of Article 25 (1). <Amended on Mar. 14, 2023>
(3) Articles 15, 30 and 31 shall not apply to any personal information that is processed by a personal information controller to operate a group or association for friendship, such as an alumni association and a hobby club.
(4) In the case of processing personal information pursuant to paragraph (1), a personal information controller shall process the personal information to the minimum extent necessary to attain the intended purpose for the minimum period; and shall also make necessary arrangements, such as technical, managerial and physical safeguards, individual grievance handling and other necessary measures for the safe management and appropriate processing of such personal information.
Article 58-2 (Exemption from Application)
This Act shall not apply to information that no longer identifies a certain individual when combined with other information, reasonably considering time, cost, technology, etc.
[This Article Newly Inserted on Feb. 4, 2020]
제58조의2(적용제외)
이 법은 시간ㆍ비용ㆍ기술 등을 합리적으로 고려할 때 다른 정보를 사용하여도 더 이상 개인을 알아볼 수 없는 정보에는 적용하지 아니한다.
[본조신설 2020. 2. 4.]
Article 58-2 (Exemption from Application)
This Act shall not apply to information that no longer identifies a certain individual when combined with other information, reasonably considering time, cost, technology, etc.
[This Article Newly Inserted on Feb. 4, 2020]
Article 59 (Prohibited Activities)
Anyone who processes or has processed personal information shall be prohibited from engaging in any of the following activities: <Amended on Mar. 14, 2023>
1. To acquire personal information or to obtain consent to personal information processing by fraud or other improper means;
2. To divulge personal information acquired in the course of performing his or her work, or to provide it for any third party’s use without authority;
3. To use, damage, destroy, alter, forge, or divulge any other person’s personal information without legitimate authority or beyond proper authority.
제59조(금지행위)
개인정보를 처리하거나 처리하였던 자는 다음 각 호의 어느 하나에 해당하는 행위를 하여서는 아니 된다. <개정 2023. 3. 14.>
1. 거짓이나 그 밖의 부정한 수단이나 방법으로 개인정보를 취득하거나 처리에 관한 동의를 받는 행위
2. 업무상 알게 된 개인정보를 누설하거나 권한 없이 다른 사람이 이용하도록 제공하는 행위
3. 정당한 권한 없이 또는 허용된 권한을 초과하여 다른 사람의 개인정보를 이용, 훼손, 멸실, 변경, 위조 또는 유출하는 행위
Article 59 (Prohibited Activities)
Anyone who processes or has processed personal information shall be prohibited from engaging in any of the following activities: <Amended on Mar. 14, 2023>
1. To acquire personal information or to obtain consent to personal information processing by fraud or other improper means;
2. To divulge personal information acquired in the course of performing his or her work, or to provide it for any third party’s use without authority;
3. To use, damage, destroy, alter, forge, or divulge any other person’s personal information without legitimate authority or beyond proper authority.
Article 60 (Confidentiality)
Any person who performs or has performed the following work shall not divulge any confidential information acquired in the course of performing his or her duties to any other person, nor use such information for any purpose other than for his or her duties: Provided, That, this shall not apply except as provided in other statutes: <Amended on Feb. 4, 2020; Mar. 14, 2023>
1. Work of the Protection Commission provided in Article 8;
2. Work of designating specialized institutions and duties of specialized institutions under Article 28-3;
3. Certification of personal information protection provided in Article 32-2;
4. Privacy impact assessments provided in Article 33;
5. Work of designating institutions specializing in managing personal information and affairs of such institutions under Article 35-3;
6. Dispute mediation of the Dispute Mediation Committee under Article 40.
[Enforcement Date: Mar. 15, 2024] Subparagraph 5 of Article 60
제60조(비밀유지 등)
다음 각 호의 업무에 종사하거나 종사하였던 자는 직무상 알게 된 비밀을 다른 사람에게 누설하거나 직무상 목적 외의 용도로 이용하여서는 아니 된다. 다만, 다른 법률에 특별한 규정이 있는 경우에는 그러하지 아니하다. <개정 2020. 2. 4., 2023. 3. 14.>
1. 제7조의8 및 제7조의9에 따른 보호위원회의 업무
2. 제28조의3에 따른 전문기관의 지정 업무 및 전문기관의 업무
3. 제32조의2에 따른 개인정보 보호 인증 업무
4. 제33조에 따른 영향평가 업무
5. 제35조의3에 따른 개인정보관리 전문기관의 지정 업무 및 개인정보관리 전문기관의 업무
6. 제40조에 따른 분쟁조정위원회의 분쟁조정 업무
[시행일: 2024. 3. 15.] 제60조제5호
Article 60 (Confidentiality)
Any person who performs or has performed the following work shall not divulge any confidential information acquired in the course of performing his or her duties to any other person, nor use such information for any purpose other than for his or her duties: Provided, That, this shall not apply except as provided in other statutes: <Amended on Feb. 4, 2020; Mar. 14, 2023>
1. Work of the Protection Commission provided in Article 8;
2. Work of designating specialized institutions and duties of specialized institutions under Article 28-3;
3. Certification of personal information protection provided in Article 32-2;
4. Privacy impact assessments provided in Article 33;
5. Work of designating institutions specializing in managing personal information and affairs of such institutions under Article 35-3;
6. Dispute mediation of the Dispute Mediation Committee under Article 40.
[Enforcement Date: Mar. 15, 2024] Subparagraph 5 of Article 60
Article 61 (Presentation of Opinions and Recommendations for Improvement)
(1) The Protection Commission may present its opinion to any relevant agency through deliberation and resolution where it is deemed necessary with respect to the statutes or regulations or municipal ordinances containing provisions that are likely to affect the protection of personal information. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) The Protection Commission may advise a personal information controller to improve the status of personal information processing where doing so is deemed necessary to protect personal information. In such cases, upon receiving the advice, the personal information controller shall make sincere efforts to comply with the advice, and shall inform the Protection Commission of the results. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) The head of a related central administrative agency may recommend that a personal information controller improve the status of personal information processing pursuant to the statutes under the related central administrative agency’s jurisdiction where doing so is deemed necessary to protect personal information. In such cases, upon receiving the recommendation, the personal information controller shall make sincere efforts to comply with the recommendation, and shall inform the head of the related central administrative agency of the results.
(4) Central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission may provide their opinions, or provide guidance or inspection with respect to the protection of personal information to their affiliated entities and the public institutions under their jurisdiction.
제61조(의견제시 및 개선권고)
① 보호위원회는 개인정보 보호에 영향을 미치는 내용이 포함된 법령이나 조례에 대하여 필요하다고 인정하면 심의ㆍ의결을 거쳐 관계 기관에 의견을 제시할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
② 보호위원회는 개인정보 보호를 위하여 필요하다고 인정하면 개인정보처리자에게 개인정보 처리 실태의 개선을 권고할 수 있다. 이 경우 권고를 받은 개인정보처리자는 이를 이행하기 위하여 성실하게 노력하여야 하며, 그 조치 결과를 보호위원회에 알려야 한다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
③ 관계 중앙행정기관의 장은 개인정보 보호를 위하여 필요하다고 인정하면 소관 법률에 따라 개인정보처리자에게 개인정보 처리 실태의 개선을 권고할 수 있다. 이 경우 권고를 받은 개인정보처리자는 이를 이행하기 위하여 성실하게 노력하여야 하며, 그 조치 결과를 관계 중앙행정기관의 장에게 알려야 한다.
④ 중앙행정기관, 지방자치단체, 국회, 법원, 헌법재판소, 중앙선거관리위원회는 그 소속 기관 및 소관 공공기관에 대하여 개인정보 보호에 관한 의견을 제시하거나 지도ㆍ점검을 할 수 있다.
Article 61 (Presentation of Opinions and Recommendations for Improvement)
(1) The Protection Commission may present its opinion to any relevant agency through deliberation and resolution where it is deemed necessary with respect to the statutes or regulations or municipal ordinances containing provisions that are likely to affect the protection of personal information. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) The Protection Commission may advise a personal information controller to improve the status of personal information processing where doing so is deemed necessary to protect personal information. In such cases, upon receiving the advice, the personal information controller shall make sincere efforts to comply with the advice, and shall inform the Protection Commission of the results. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) The head of a related central administrative agency may recommend that a personal information controller improve the status of personal information processing pursuant to the statutes under the related central administrative agency’s jurisdiction where doing so is deemed necessary to protect personal information. In such cases, upon receiving the recommendation, the personal information controller shall make sincere efforts to comply with the recommendation, and shall inform the head of the related central administrative agency of the results.
(4) Central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission may provide their opinions, or provide guidance or inspection with respect to the protection of personal information to their affiliated entities and the public institutions under their jurisdiction.
Article 62 (Reporting on Infringements)
(1) Anyone who suffers infringement of rights or interests relating to his or her personal information in the course of personal information processing by a personal information controller may report such infringement to the Protection Commission. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) The Protection Commission may designate a specialized institution in order to efficiently receive and handle the claim reports pursuant to paragraph (1), as prescribed by Presidential Decree. In such cases, such specialized institution shall establish and operate a personal information infringement call center (hereinafter referred to as the “Privacy Call Center”). <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) The Privacy Call Center shall perform the following work:
1. To receive claim reports and provide consultation in relation to personal information processing;
2. To investigate and confirm incidents and hear opinions of related parties;
3. Work incidental to those under subparagraphs 1 and 2.
(4) The Protection Commission may, if necessary, dispatch its public official to the specialized institution designated under paragraph (2) pursuant to Article 32-4 of the State Public Officials Act in order to efficiently investigate and confirm the incidents pursuant to paragraph (3) 2. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
제62조(침해 사실의 신고 등)
① 개인정보처리자가 개인정보를 처리할 때 개인정보에 관한 권리 또는 이익을 침해받은 사람은 보호위원회에 그 침해 사실을 신고할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
② 보호위원회는 제1항에 따른 신고의 접수ㆍ처리 등에 관한 업무를 효율적으로 수행하기 위하여 대통령령으로 정하는 바에 따라 전문기관을 지정할 수 있다. 이 경우 전문기관은 개인정보침해 신고센터(이하 “신고센터”라 한다)를 설치ㆍ운영하여야 한다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
③ 신고센터는 다음 각 호의 업무를 수행한다.
1. 개인정보 처리와 관련한 신고의 접수ㆍ상담
2. 사실의 조사ㆍ확인 및 관계자의 의견 청취
3. 제1호 및 제2호에 따른 업무에 딸린 업무
④ 보호위원회는 제3항제2호의 사실 조사ㆍ확인 등의 업무를 효율적으로 하기 위하여 필요하면 「국가공무원법」 제32조의4에 따라 소속 공무원을 제2항에 따른 전문기관에 파견할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
Article 62 (Reporting on Infringements)
(1) Anyone who suffers infringement of rights or interests relating to his or her personal information in the course of personal information processing by a personal information controller may report such infringement to the Protection Commission. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) The Protection Commission may designate a specialized institution in order to efficiently receive and handle the claim reports pursuant to paragraph (1), as prescribed by Presidential Decree. In such cases, such specialized institution shall establish and operate a personal information infringement call center (hereinafter referred to as the “Privacy Call Center”). <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) The Privacy Call Center shall perform the following work:
1. To receive claim reports and provide consultation in relation to personal information processing;
2. To investigate and confirm incidents and hear opinions of related parties;
3. Work incidental to those under subparagraphs 1 and 2.
(4) The Protection Commission may, if necessary, dispatch its public official to the specialized institution designated under paragraph (2) pursuant to Article 32-4 of the State Public Officials Act in order to efficiently investigate and confirm the incidents pursuant to paragraph (3) 2. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
Article 63 (Requests for Materials and Inspections)
(1) The Protection Commission may request relevant materials, such as articles and documents, from a personal information controller in any of the following cases: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
1. Where any violation of this Act is found or suspected;
2. Where any violation of this Act is reported or a civil complaint thereon is received;
3. In cases prescribed by Presidential Decree where it is necessary to protect the personal information of data subjects.
(2) Where a personal information controller fails to furnish materials pursuant to paragraph (1) or is regarded as having violated this Act, the Protection Commission may require its public official to enter the offices or places of business of the personal information controller and other persons related to such violation to inspect the status of business operations, ledgers, documents, etc. In such cases, the public official who conducts the inspection shall carry identification verifying his or her authority and show it to relevant persons. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015; Jul. 26, 2017; Feb. 4, 2020>
(3) The Protection Commission may request the heads of the following relevant institutions to cooperate in taking prompt and effective measures where any serious personal information breach occurs due to a violation of laws related to the protection of personal information, such as this Act: <Amended on Mar. 14, 2023>
1. Central administrative agencies;
2. A local government;
3. Other public institutions having, delegated or entrusted with, administrative authority pursuant to statutes and regulations or municipal ordinances and rules.
(4) The head of a relevant institution who receives a request for cooperation under paragraph (3) shall comply with such request in the absence of special circumstances. <Amended on Mar. 14, 2023>
(5) Matters necessary for requests for the submission of materials, procedures and methods for inspection, etc. under paragraphs (1) and (2) may be determined and publicly notified by the Protection Commission. <Amended on Mar. 14, 2023>
(6) The Protection Commission shall neither provide any third party with the documents, materials, etc. furnished or collected pursuant to paragraphs (1) and (2), nor disclose them to the general public, except as provided in this Act. <Newly Inserted on Feb. 4, 2020; Mar. 14, 2023>
(7) Upon receiving materials via information and communications networks, or digitalizing the collected materials, etc., the Protection Commission shall take systematic and technical supplementary measures to prevent the divulgence of personal information, trade secrets, etc. <Newly Inserted on Feb. 4, 2020; Mar. 14, 2023>
제63조(자료제출 요구 및 검사)
① 보호위원회는 다음 각 호의 어느 하나에 해당하는 경우에는 개인정보처리자에게 관계 물품ㆍ서류 등 자료를 제출하게 할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
1. 이 법을 위반하는 사항을 발견하거나 혐의가 있음을 알게 된 경우
2. 이 법 위반에 대한 신고를 받거나 민원이 접수된 경우
3. 그 밖에 정보주체의 개인정보 보호를 위하여 필요한 경우로서 대통령령으로 정하는 경우
② 보호위원회는 개인정보처리자가 제1항에 따른 자료를 제출하지 아니하거나 이 법을 위반한 사실이 있다고 인정되면 소속 공무원으로 하여금 개인정보처리자 및 해당 법 위반사실과 관련한 관계인의 사무소나 사업장에 출입하여 업무 상황, 장부 또는 서류 등을 검사하게 할 수 있다. 이 경우 검사를 하는 공무원은 그 권한을 나타내는 증표를 지니고 이를 관계인에게 내보여야 한다. <개정 2013. 3. 23., 2014. 11. 19., 2015. 7. 24., 2017. 7. 26., 2020. 2. 4.>
③ 보호위원회는 이 법 등 개인정보 보호와 관련된 법규의 위반행위로 인하여 중대한 개인정보 침해사고가 발생한 경우 신속하고 효과적인 대응을 위하여 다음 각 호의 어느 하나에 해당하는 관계 기관의 장에게 협조를 요청할 수 있다. <개정 2023. 3. 14.>
1. 중앙행정기관
2. 지방자치단체
3. 그 밖에 법령 또는 자치법규에 따라 행정권한을 가지고 있거나 위임 또는 위탁받은 공공기관
④ 제3항에 따라 협조를 요청받은 관계 기관의 장은 특별한 사정이 없으면 이에 따라야 한다. <개정 2023. 3. 14.>
⑤ 제1항 및 제2항에 따른 자료제출 요구, 검사 절차 및 방법 등에 관하여 필요한 사항은 보호위원회가 정하여 고시할 수 있다. <개정 2023. 3. 14.>
⑥ 보호위원회는 제1항 및 제2항에 따라 제출받거나 수집한 서류ㆍ자료 등을 이 법에 따른 경우를 제외하고는 제3자에게 제공하거나 일반에 공개해서는 아니 된다. <신설 2020. 2. 4., 2023. 3. 14.>
⑦ 보호위원회는 정보통신망을 통하여 자료의 제출 등을 받은 경우나 수집한 자료 등을 전자화한 경우에는 개인정보ㆍ영업비밀 등이 유출되지 아니하도록 제도적ㆍ기술적 보완조치를 하여야 한다. <신설 2020. 2. 4., 2023. 3. 14.>
Article 63 (Requests for Materials and Inspections)
(1) The Protection Commission may request relevant materials, such as articles and documents, from a personal information controller in any of the following cases: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
1. Where any violation of this Act is found or suspected;
2. Where any violation of this Act is reported or a civil complaint thereon is received;
3. In cases prescribed by Presidential Decree where it is necessary to protect the personal information of data subjects.
(2) Where a personal information controller fails to furnish materials pursuant to paragraph (1) or is regarded as having violated this Act, the Protection Commission may require its public official to enter the offices or places of business of the personal information controller and other persons related to such violation to inspect the status of business operations, ledgers, documents, etc. In such cases, the public official who conducts the inspection shall carry identification verifying his or her authority and show it to relevant persons. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 24, 2015; Jul. 26, 2017; Feb. 4, 2020>
(3) The Protection Commission may request the heads of the following relevant institutions to cooperate in taking prompt and effective measures where any serious personal information breach occurs due to a violation of laws related to the protection of personal information, such as this Act: <Amended on Mar. 14, 2023>
1. Central administrative agencies;
2. A local government;
3. Other public institutions having, delegated or entrusted with, administrative authority pursuant to statutes and regulations or municipal ordinances and rules.
(4) The head of a relevant institution who receives a request for cooperation under paragraph (3) shall comply with such request in the absence of special circumstances. <Amended on Mar. 14, 2023>
(5) Matters necessary for requests for the submission of materials, procedures and methods for inspection, etc. under paragraphs (1) and (2) may be determined and publicly notified by the Protection Commission. <Amended on Mar. 14, 2023>
(6) The Protection Commission shall neither provide any third party with the documents, materials, etc. furnished or collected pursuant to paragraphs (1) and (2), nor disclose them to the general public, except as provided in this Act. <Newly Inserted on Feb. 4, 2020; Mar. 14, 2023>
(7) Upon receiving materials via information and communications networks, or digitalizing the collected materials, etc., the Protection Commission shall take systematic and technical supplementary measures to prevent the divulgence of personal information, trade secrets, etc. <Newly Inserted on Feb. 4, 2020; Mar. 14, 2023>
Article 63-2 (Preliminary Fact-Finding Inspections)
(1) In cases not falling under the subparagraphs of Article 63 (1), the Protection Commission may inspect the status of protection of personal information of a personal information controller that is highly susceptible to a personal information breach incident and deemed to need a preliminary inspection of vulnerabilities in the protection of personal information.
(2) The Protection Commission may, if it finds any violation of this Act through a fact-finding inspection under paragraph (1), formulate a correction scheme and recommend that the relevant personal information controller comply with it.
(3) Upon receipt of the recommendation for correction under paragraph (2), a personal information controller shall notify the Protection Commission as to whether it accepts the recommendation within 10 days from the date of receipt of the recommendation, and inform the Protection Commission of the results of the implementation thereof, as prescribed by Notification of the Protection Commission.
(4) When any person upon receipt of the recommendation for correction under paragraph (2) accepts the relevant recommendation, he or she shall be deemed to have received an order for corrective measures (referring to a recommendation under Article 64 (3) in cases of central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission) under Article 64 (1).
(5) If a person upon receipt of the recommendation for correction under paragraph (2) refuses to accept or fails to comply with the relevant recommendation, the Protection Commission may conduct an inspection under Article 63 (2).
(6) The Protection Commission may inspect the status of personal information protection under paragraph (1) jointly with the head of a relevant central administrative agency.
[This Article Newly Inserted on Mar. 14, 2023]
제63조의2(사전 실태점검)
① 보호위원회는 제63조제1항 각 호에 해당하지 아니하는 경우로서 개인정보 침해사고 발생의 위험성이 높고 개인정보 보호의 취약점을 사전에 점검할 필요성이 인정되는 개인정보처리자에 대하여 개인정보 보호실태를 점검할 수 있다.
② 보호위원회는 제1항에 따른 실태점검을 실시하여 이 법을 위반하는 사항을 발견한 경우 해당 개인정보처리자에 대하여 시정방안을 정하여 이에 따를 것을 권고할 수 있다.
③ 제2항에 따른 시정권고를 받은 개인정보처리자는 이를 통보받은 날부터 10일 이내에 해당 권고를 수락하는지 여부에 관하여 보호위원회에 통지하여야 하며, 그 이행 결과를 보호위원회가 고시로 정하는 바에 따라 보호위원회에 알려야 한다.
④ 제2항에 따른 시정권고를 받은 자가 해당 권고를 수락한 때에는 제64조제1항에 따른 시정조치 명령(중앙행정기관, 지방자치단체, 국회, 법원, 헌법재판소, 중앙선거관리위원회의 경우에는 제64조제3항에 따른 권고를 말한다)을 받은 것으로 본다.
⑤ 보호위원회는 제2항에 따른 시정권고를 받은 자가 해당 권고를 수락하지 아니하거나 이행하지 아니한 경우 제63조제2항에 따른 검사를 할 수 있다.
⑥ 보호위원회는 관계 중앙행정기관의 장과 합동으로 제1항에 따른 개인정보 보호실태를 점검할 수 있다.
[본조신설 2023. 3. 14.]
Article 63-2 (Preliminary Fact-Finding Inspections)
(1) In cases not falling under the subparagraphs of Article 63 (1), the Protection Commission may inspect the status of protection of personal information of a personal information controller that is highly susceptible to a personal information breach incident and deemed to need a preliminary inspection of vulnerabilities in the protection of personal information.
(2) The Protection Commission may, if it finds any violation of this Act through a fact-finding inspection under paragraph (1), formulate a correction scheme and recommend that the relevant personal information controller comply with it.
(3) Upon receipt of the recommendation for correction under paragraph (2), a personal information controller shall notify the Protection Commission as to whether it accepts the recommendation within 10 days from the date of receipt of the recommendation, and inform the Protection Commission of the results of the implementation thereof, as prescribed by Notification of the Protection Commission.
(4) When any person upon receipt of the recommendation for correction under paragraph (2) accepts the relevant recommendation, he or she shall be deemed to have received an order for corrective measures (referring to a recommendation under Article 64 (3) in cases of central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission) under Article 64 (1).
(5) If a person upon receipt of the recommendation for correction under paragraph (2) refuses to accept or fails to comply with the relevant recommendation, the Protection Commission may conduct an inspection under Article 63 (2).
(6) The Protection Commission may inspect the status of personal information protection under paragraph (1) jointly with the head of a relevant central administrative agency.
[This Article Newly Inserted on Mar. 14, 2023]
Article 64 (Corrective Measures)
(1) The Protection Commission may order a person who violates this Act (excluding central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission) to take the following measures: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
1. To suspend personal information breach;
2. To temporarily suspend personal information processing;
3. Other measures necessary to protect personal information and to prevent personal information infringement.
(2) A local government, the National Assembly, the Court, the Constitutional Court, or the National Election Commission may order their affiliated entities and public institutions, which are found to have violated this Act, to take the measures provided in the subparagraphs of paragraph (1). <Amended on Mar. 14, 2023>
(3) When a central administrative agency, a local government, the National Assembly, the Court, the Constitutional Court, or the National Election Commission violates this Act, the Protection Commission may recommend that the head of the relevant agency take any of the measures provided in the subparagraphs of paragraph (1). In such cases, upon receiving the recommendation, the agency shall comply therewith unless there is a compelling reason not to do so. <Amended on Mar. 14, 2023>
제64조(시정조치 등)
① 보호위원회는 이 법을 위반한 자(중앙행정기관, 지방자치단체, 국회, 법원, 헌법재판소, 중앙선거관리위원회는 제외한다)에 대하여 다음 각 호에 해당하는 조치를 명할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
1. 개인정보 침해행위의 중지
2. 개인정보 처리의 일시적인 정지
3. 그 밖에 개인정보의 보호 및 침해 방지를 위하여 필요한 조치
② 지방자치단체, 국회, 법원, 헌법재판소, 중앙선거관리위원회는 그 소속 기관 및 소관 공공기관이 이 법을 위반하였을 때에는 제1항 각 호에 해당하는 조치를 명할 수 있다. <개정 2023. 3. 14.>
③ 보호위원회는 중앙행정기관, 지방자치단체, 국회, 법원, 헌법재판소, 중앙선거관리위원회가 이 법을 위반하였을 때에는 해당 기관의 장에게 제1항 각 호에 해당하는 조치를 하도록 권고할 수 있다. 이 경우 권고를 받은 기관은 특별한 사유가 없으면 이를 존중하여야 한다. <개정 2023. 3. 14.>
Article 64 (Corrective Measures)
(1) The Protection Commission may order a person who violates this Act (excluding central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission) to take the following measures: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
1. To suspend personal information breach;
2. To temporarily suspend personal information processing;
3. Other measures necessary to protect personal information and to prevent personal information infringement.
(2) A local government, the National Assembly, the Court, the Constitutional Court, or the National Election Commission may order their affiliated entities and public institutions, which are found to have violated this Act, to take the measures provided in the subparagraphs of paragraph (1). <Amended on Mar. 14, 2023>
(3) When a central administrative agency, a local government, the National Assembly, the Court, the Constitutional Court, or the National Election Commission violates this Act, the Protection Commission may recommend that the head of the relevant agency take any of the measures provided in the subparagraphs of paragraph (1). In such cases, upon receiving the recommendation, the agency shall comply therewith unless there is a compelling reason not to do so. <Amended on Mar. 14, 2023>
Article 64-2 (Imposition of Penalty Surcharges)
(1) The Protection Commission may impose a penalty surcharge on the relevant personal information controller within the scope not exceeding 3/100 of the total sales, in any of the following cases: Provided, That a penalty surcharge not exceeding two billion won may be imposed in cases prescribed by Presidential Decree where no sales have been made or where it is impracticable to calculate the sales:
1. Where the personal information controller processes personal information, in violation of Article 15 (1), 17 (1), 18 (1) and (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), or 19;
2. Where the personal information controller processes personal information of a child under 14 years of age without his or her legal representative’s consent, in violation of Article 22-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
3. Where the personal information controller processes sensitive information without the data subject’s consent, in violation of Article 23 (1) 1 (including where it is applied mutatis mutandis pursuant to Article 26 (8));
4. Where the personal information controller processes personally identifiable information or resident registration numbers, in violation of Articles 24 (1) and 24-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
5. Where the personal information controller neglects its management, supervision, or education under Article 26 (4), thereby causing the person entrusted to violate this Act;
6. Where the personal information controller processes information to uniquely identify an individual (including where it is applied mutatis mutandis pursuant to Article 26 (8)) in violation of Article 28-5 (1);
7. Where the personal information controller makes cross-border transfers of personal information, in violation of Article 28-8 (1) (including where it is applied mutatis mutandis pursuant to Articles 26 (8) and 28-11);
8. Failing to comply with an order to suspend a cross-border transfer, in violation of Article 28-9 (1) (including where it is applied mutatis mutandis pursuant to Articles 26 (8) and 28-11);
9. Where the personal information processed by the personal information controller is lost, stolen, divulged, forged, altered, or damaged; Provided, That this shall not apply where a personal information controller has taken all measures necessary to ensure safety under Article 29 (including where it is applied mutatis mutandis pursuant to Article 26 (8)) to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged.
(2) Where the Protection Commission intends to impose a penalty surcharge under paragraph (1), it shall calculate the penalty surcharge based on the gross sales net of the sales unrelated to the violation.
(3) Where the Protection Committee intends to impose a penalty surcharge pursuant to paragraph (1), it may calculate the sales based on the gross sales of the personal information controller if the personal information controller refuses to submit sales calculation data or submits false data without good case: Provided, That it may presume sales based on the scale of personal information retained, accounting data such as financial statements, prices of products and services, and other data regarding the business state of a personal information controller with a size similar to that of the relevant personal information controller.
(4) The Protection Commission shall, where it imposes a penalty surcharge under paragraph (1), take into account the following matters to ensure that the penalty surcharge shall be proportional to the violation and be effective in preventing breach:
1. The details and degree of a violation;
2. The duration and frequency of violations;
3. Scale of profits derived from a violation;
4. Efforts to take measures to ensure safety, such as encryption;
5. Where the personal information is lost, stolen, divulged, forged, altered, or damaged, the relation to the violation and the scale of loss, theft, divulgence, forgery, alteration, or damage;
6. Whether measures for recovering from damage and preventing the spread of damage have been taken;
7. The type and volume of work of the personal information controller;
8. Types of personal information processed by a personal information controller and the impact on data subjects;
9. The amount of damage caused by the violation;
10. Efforts for the protection of personal information, including the certification of personal information protection and autonomous protection activities;
11. Whether measures have been taken to rectify violations, including cooperation with the Protection Commission.
(5) The Protection Commission need not impose a penalty surcharge in any of the following cases:
1. Where the person subject to the penalty surcharge is objectively deemed unable to pay the penalty surcharge due to insolvency, suspension of payment, capital impairment, etc.;
2. Where there is good cause for the person subject to the penalty surcharge to mistakenly believe that his or her conduct is not illegal;
3. Where the details and degree of the violation are minor or where the assessed penalty surcharge is small;
4. Where any ground prescribed by Presidential Decree exists, on which the data subject has suffered no or minor damage.
(6) Penalty surcharges under paragraph (1) shall be calculated in consideration of paragraphs (2) through (5), but the detailed calculation criteria and procedures shall be prescribed by Presidential Decree.
(7) If the person subject to the penalty surcharge under paragraph (1) fails to pay it by the payment deadline, the Protection Commission shall collect the additional charge equivalent to 6/100 per annum of the unpaid penalty surcharge from the date following the payment deadline. In such cases, the period for collecting of the additional charge shall not exceed 60 months.
(8) Where a person liable to pay a penalty surcharge under paragraph (1) fails to pay it by the payment deadline, the Protection Commission shall demand payment thereof within a specified period; and where the penalty surcharges and additional charges under paragraph (7) are not paid within the specified period, the Protection Commission shall collect such penalty surcharges in the same manner as national taxes are compulsorily collected.
(9) When the penalty surcharges imposed according to paragraph (1) are refunded for such reasons as a court’s decision, the Protection Commission shall make an additional refund in an amount calculated based on the interest rate prescribed by Presidential Decree in consideration of the deposit interest rates of financial companies, etc., for the period beginning on the date of payment of penalty surcharges and ending on the date of the refund.
(10) Notwithstanding paragraph (9), when a disposition to impose penalty surcharges is revoked due to a court’s decision and new penalty surcharges are imposed based on the reasoning of the decision, additional refunds shall be calculated and paid only with respect to the amount that remains after the newly imposed penalty surcharges are deducted from the penalty surcharges already paid.
[This Article Newly Inserted on Mar. 14, 2023]
제64조의2(과징금의 부과)
① 보호위원회는 다음 각 호의 어느 하나에 해당하는 경우에는 해당 개인정보처리자에게 전체 매출액의 100분의 3을 초과하지 아니하는 범위에서 과징금을 부과할 수 있다. 다만, 매출액이 없거나 매출액의 산정이 곤란한 경우로서 대통령령으로 정하는 경우에는 20억원을 초과하지 아니하는 범위에서 과징금을 부과할 수 있다.
1. 제15조제1항, 제17조제1항, 제18조제1항ㆍ제2항(제26조제8항에 따라 준용되는 경우를 포함한다) 또는 제19조를 위반하여 개인정보를 처리한 경우
2. 제22조의2제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 법정대리인의 동의를 받지 아니하고 만 14세 미만인 아동의 개인정보를 처리한 경우
3. 제23조제1항제1호(제26조제8항에 따라 준용되는 경우를 포함한다)를 위반하여 정보주체의 동의를 받지 아니하고 민감정보를 처리한 경우
4. 제24조제1항ㆍ제24조의2제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 고유식별정보 또는 주민등록번호를 처리한 경우
5. 제26조제4항에 따른 관리ㆍ감독 또는 교육을 소홀히 하여 수탁자가 이 법의 규정을 위반한 경우
6. 제28조의5제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 특정 개인을 알아보기 위한 목적으로 정보를 처리한 경우
7. 제28조의8제1항(제26조제8항 및 제28조의11에 따라 준용되는 경우를 포함한다)을 위반하여 개인정보를 국외로 이전한 경우
8. 제28조의9제1항(제26조제8항 및 제28조의11에 따라 준용되는 경우를 포함한다)을 위반하여 국외 이전 중지 명령을 따르지 아니한 경우
9. 개인정보처리자가 처리하는 개인정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조ㆍ훼손된 경우. 다만, 개인정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조ㆍ훼손되지 아니하도록 개인정보처리자가 제29조(제26조제8항에 따라 준용되는 경우를 포함한다)에 따른 안전성 확보에 필요한 조치를 다한 경우에는 그러하지 아니하다.
② 보호위원회는 제1항에 따른 과징금을 부과하려는 경우 전체 매출액에서 위반행위와 관련이 없는 매출액을 제외한 매출액을 기준으로 과징금을 산정한다.
③ 보호위원회는 제1항에 따른 과징금을 부과하려는 경우 개인정보처리자가 정당한 사유 없이 매출액 산정자료의 제출을 거부하거나 거짓의 자료를 제출한 경우에는 해당 개인정보처리자의 전체 매출액을 기준으로 산정하되 해당 개인정보처리자 및 비슷한 규모의 개인정보처리자의 개인정보 보유 규모, 재무제표 등 회계자료, 상품ㆍ용역의 가격 등 영업현황 자료에 근거하여 매출액을 추정할 수 있다.
④ 보호위원회는 제1항에 따른 과징금을 부과하는 경우에는 위반행위에 상응하는 비례성과 침해 예방에 대한 효과성이 확보될 수 있도록 다음 각 호의 사항을 고려하여야 한다.
1. 위반행위의 내용 및 정도
2. 위반행위의 기간 및 횟수
3. 위반행위로 인하여 취득한 이익의 규모
4. 암호화 등 안전성 확보 조치 이행 노력
5. 개인정보가 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조ㆍ훼손된 경우 위반행위와의 관련성 및 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조ㆍ훼손의 규모
6. 위반행위로 인한 피해의 회복 및 피해 확산 방지 조치의 이행 여부
7. 개인정보처리자의 업무 형태 및 규모
8. 개인정보처리자가 처리하는 개인정보의 유형과 정보주체에게 미치는 영향
9. 위반행위로 인한 정보주체의 피해 규모
10. 개인정보 보호 인증, 자율적인 보호 활동 등 개인정보 보호를 위한 노력
11. 보호위원회와의 협조 등 위반행위를 시정하기 위한 조치 여부
⑤ 보호위원회는 다음 각 호의 어느 하나에 해당하는 사유가 있는 경우에는 과징금을 부과하지 아니할 수 있다.
1. 지급불능ㆍ지급정지 또는 자본잠식 등의 사유로 객관적으로 과징금을 낼 능력이 없다고 인정되는 경우
2. 본인의 행위가 위법하지 아니한 것으로 잘못 인식할 만한 정당한 사유가 있는 경우
3. 위반행위의 내용ㆍ정도가 경미하거나 산정된 과징금이 소액인 경우
4. 그 밖에 정보주체에게 피해가 발생하지 아니하였거나 경미한 경우로서 대통령령으로 정하는 사유가 있는 경우
⑥ 제1항에 따른 과징금은 제2항부터 제5항까지를 고려하여 산정하되, 구체적인 산정기준과 산정절차는 대통령령으로 정한다.
⑦ 보호위원회는 제1항에 따른 과징금을 내야 할 자가 납부기한까지 이를 내지 아니하면 납부기한의 다음 날부터 내지 아니한 과징금의 연 100분의 6에 해당하는 가산금을 징수한다. 이 경우 가산금을 징수하는 기간은 60개월을 초과하지 못한다.
⑧ 보호위원회는 제1항에 따른 과징금을 내야 할 자가 납부기한까지 내지 아니한 경우에는 기간을 정하여 독촉하고, 독촉으로 지정한 기간 내에 과징금과 제7항에 따른 가산금을 내지 아니하면 국세강제징수의 예에 따라 징수한다.
⑨ 보호위원회는 법원의 판결 등의 사유로 제1항에 따라 부과된 과징금을 환급하는 경우에는 과징금을 낸 날부터 환급하는 날까지의 기간에 대하여 금융회사 등의 예금이자율 등을 고려하여 대통령령으로 정하는 이자율을 적용하여 계산한 환급가산금을 지급하여야 한다.
⑩ 보호위원회는 제9항에도 불구하고 법원의 판결에 따라 과징금 부과처분이 취소되어 그 판결이유에 따라 새로운 과징금을 부과하는 경우에는 당초 납부한 과징금에서 새로 부과하기로 결정한 과징금을 공제한 나머지 금액에 대해서만 환급가산금을 계산하여 지급한다.
[본조신설 2023. 3. 14.]
Article 64-2 (Imposition of Penalty Surcharges)
(1) The Protection Commission may impose a penalty surcharge on the relevant personal information controller within the scope not exceeding 3/100 of the total sales, in any of the following cases: Provided, That a penalty surcharge not exceeding two billion won may be imposed in cases prescribed by Presidential Decree where no sales have been made or where it is impracticable to calculate the sales:
1. Where the personal information controller processes personal information, in violation of Article 15 (1), 17 (1), 18 (1) and (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), or 19;
2. Where the personal information controller processes personal information of a child under 14 years of age without his or her legal representative’s consent, in violation of Article 22-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
3. Where the personal information controller processes sensitive information without the data subject’s consent, in violation of Article 23 (1) 1 (including where it is applied mutatis mutandis pursuant to Article 26 (8));
4. Where the personal information controller processes personally identifiable information or resident registration numbers, in violation of Articles 24 (1) and 24-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
5. Where the personal information controller neglects its management, supervision, or education under Article 26 (4), thereby causing the person entrusted to violate this Act;
6. Where the personal information controller processes information to uniquely identify an individual (including where it is applied mutatis mutandis pursuant to Article 26 (8)) in violation of Article 28-5 (1);
7. Where the personal information controller makes cross-border transfers of personal information, in violation of Article 28-8 (1) (including where it is applied mutatis mutandis pursuant to Articles 26 (8) and 28-11);
8. Failing to comply with an order to suspend a cross-border transfer, in violation of Article 28-9 (1) (including where it is applied mutatis mutandis pursuant to Articles 26 (8) and 28-11);
9. Where the personal information processed by the personal information controller is lost, stolen, divulged, forged, altered, or damaged; Provided, That this shall not apply where a personal information controller has taken all measures necessary to ensure safety under Article 29 (including where it is applied mutatis mutandis pursuant to Article 26 (8)) to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged.
(2) Where the Protection Commission intends to impose a penalty surcharge under paragraph (1), it shall calculate the penalty surcharge based on the gross sales net of the sales unrelated to the violation.
(3) Where the Protection Committee intends to impose a penalty surcharge pursuant to paragraph (1), it may calculate the sales based on the gross sales of the personal information controller if the personal information controller refuses to submit sales calculation data or submits false data without good case: Provided, That it may presume sales based on the scale of personal information retained, accounting data such as financial statements, prices of products and services, and other data regarding the business state of a personal information controller with a size similar to that of the relevant personal information controller.
(4) The Protection Commission shall, where it imposes a penalty surcharge under paragraph (1), take into account the following matters to ensure that the penalty surcharge shall be proportional to the violation and be effective in preventing breach:
1. The details and degree of a violation;
2. The duration and frequency of violations;
3. Scale of profits derived from a violation;
4. Efforts to take measures to ensure safety, such as encryption;
5. Where the personal information is lost, stolen, divulged, forged, altered, or damaged, the relation to the violation and the scale of loss, theft, divulgence, forgery, alteration, or damage;
6. Whether measures for recovering from damage and preventing the spread of damage have been taken;
7. The type and volume of work of the personal information controller;
8. Types of personal information processed by a personal information controller and the impact on data subjects;
9. The amount of damage caused by the violation;
10. Efforts for the protection of personal information, including the certification of personal information protection and autonomous protection activities;
11. Whether measures have been taken to rectify violations, including cooperation with the Protection Commission.
(5) The Protection Commission need not impose a penalty surcharge in any of the following cases:
1. Where the person subject to the penalty surcharge is objectively deemed unable to pay the penalty surcharge due to insolvency, suspension of payment, capital impairment, etc.;
2. Where there is good cause for the person subject to the penalty surcharge to mistakenly believe that his or her conduct is not illegal;
3. Where the details and degree of the violation are minor or where the assessed penalty surcharge is small;
4. Where any ground prescribed by Presidential Decree exists, on which the data subject has suffered no or minor damage.
(6) Penalty surcharges under paragraph (1) shall be calculated in consideration of paragraphs (2) through (5), but the detailed calculation criteria and procedures shall be prescribed by Presidential Decree.
(7) If the person subject to the penalty surcharge under paragraph (1) fails to pay it by the payment deadline, the Protection Commission shall collect the additional charge equivalent to 6/100 per annum of the unpaid penalty surcharge from the date following the payment deadline. In such cases, the period for collecting of the additional charge shall not exceed 60 months.
(8) Where a person liable to pay a penalty surcharge under paragraph (1) fails to pay it by the payment deadline, the Protection Commission shall demand payment thereof within a specified period; and where the penalty surcharges and additional charges under paragraph (7) are not paid within the specified period, the Protection Commission shall collect such penalty surcharges in the same manner as national taxes are compulsorily collected.
(9) When the penalty surcharges imposed according to paragraph (1) are refunded for such reasons as a court’s decision, the Protection Commission shall make an additional refund in an amount calculated based on the interest rate prescribed by Presidential Decree in consideration of the deposit interest rates of financial companies, etc., for the period beginning on the date of payment of penalty surcharges and ending on the date of the refund.
(10) Notwithstanding paragraph (9), when a disposition to impose penalty surcharges is revoked due to a court’s decision and new penalty surcharges are imposed based on the reasoning of the decision, additional refunds shall be calculated and paid only with respect to the amount that remains after the newly imposed penalty surcharges are deducted from the penalty surcharges already paid.
[This Article Newly Inserted on Mar. 14, 2023]
Article 65 (Accusation and Recommendation for Disciplinary Action)
(1) When there is deemed substantial ground for suspecting a criminal violation of this Act or other data protection-related statutes, the Protection Commission may make an accusation to the competent investigative agency. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) When there is deemed substantial ground for deeming that there has been a violation of this Act or other data protection-related statutes, the Protection Commission may recommend the relevant personal information controller to take disciplinary action against the person responsible for such violation (including the representative and the executive officer in charge). In such cases, upon receiving the recommendation, the relevant personal information controller shall comply therewith, and notify the Protection Commission of the results. <Amended on Mar. 23, 2013; Aug. 6, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) The head of a related central administrative agency may file a criminal complaint against a personal information controller pursuant to paragraph (1), or recommend that the head of an affiliated agency, organization, etc. take disciplinary action pursuant to paragraph (2), in accordance with the statutes under the central administrative agency’s jurisdiction. In such cases, upon receiving the recommendation under paragraph (2), the head of an affiliated agency, organization, etc. shall comply therewith, and notify the head of the related central administrative agency of the results.
제65조(고발 및 징계권고)
① 보호위원회는 개인정보처리자에게 이 법 등 개인정보 보호와 관련된 법규의 위반에 따른 범죄혐의가 있다고 인정될 만한 상당한 이유가 있을 때에는 관할 수사기관에 그 내용을 고발할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
② 보호위원회는 이 법 등 개인정보 보호와 관련된 법규의 위반행위가 있다고 인정될 만한 상당한 이유가 있을 때에는 책임이 있는 자(대표자 및 책임있는 임원을 포함한다)를 징계할 것을 해당 개인정보처리자에게 권고할 수 있다. 이 경우 권고를 받은 사람은 이를 존중하여야 하며 그 결과를 보호위원회에 통보하여야 한다. <개정 2013. 3. 23., 2013. 8. 6., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
③ 관계 중앙행정기관의 장은 소관 법률에 따라 개인정보처리자에 대하여 제1항에 따른 고발을 하거나 소속 기관ㆍ단체 등의 장에게 제2항에 따른 징계권고를 할 수 있다. 이 경우 제2항에 따른 권고를 받은 사람은 이를 존중하여야 하며 그 결과를 관계 중앙행정기관의 장에게 통보하여야 한다.
Article 65 (Accusation and Recommendation for Disciplinary Action)
(1) When there is deemed substantial ground for suspecting a criminal violation of this Act or other data protection-related statutes, the Protection Commission may make an accusation to the competent investigative agency. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) When there is deemed substantial ground for deeming that there has been a violation of this Act or other data protection-related statutes, the Protection Commission may recommend the relevant personal information controller to take disciplinary action against the person responsible for such violation (including the representative and the executive officer in charge). In such cases, upon receiving the recommendation, the relevant personal information controller shall comply therewith, and notify the Protection Commission of the results. <Amended on Mar. 23, 2013; Aug. 6, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) The head of a related central administrative agency may file a criminal complaint against a personal information controller pursuant to paragraph (1), or recommend that the head of an affiliated agency, organization, etc. take disciplinary action pursuant to paragraph (2), in accordance with the statutes under the central administrative agency’s jurisdiction. In such cases, upon receiving the recommendation under paragraph (2), the head of an affiliated agency, organization, etc. shall comply therewith, and notify the head of the related central administrative agency of the results.
Article 66 (Publication of Results)
(1) The Protection Commission may publish the recommendation for improvement under Article 61; the order to take corrective measures under Article 64; the imposition of penalty surcharges under Article 64-2; the accusation or recommendation for a disciplinary action under Article 65; and the imposition of administrative fines under Article 75 and the results thereof. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(2) Where the Protection Commission makes dispositions such as a recommendation for improvement under Article 61, an order to take corrective measures under Article 64, the imposition of a penalty surcharge under Article 64-2, an accusation or recommendation for a disciplinary action under Article 65, or a disposition to impose an administrative fine under Article 75, it may order the person who has received such disposition to publish the fact of receiving such disposition. <Amended on Mar. 14, 2023>
(3) The method, criteria, procedure, etc. for publishing the fact of receiving a recommendation for improvement, etc. and issuing orders for publication under paragraphs (1) and (2) shall be prescribed by Presidential Decree. <Amended on Mar. 14, 2023>
제66조(결과의 공표)
① 보호위원회는 제61조에 따른 개선권고, 제64조에 따른 시정조치 명령, 제64조의2에 따른 과징금의 부과, 제65조에 따른 고발 또는 징계권고 및 제75조에 따른 과태료 부과의 내용 및 결과에 대하여 공표할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4., 2023. 3. 14.>
② 보호위원회는 제61조에 따른 개선권고, 제64조에 따른 시정조치 명령, 제64조의2에 따른 과징금의 부과, 제65조에 따른 고발 또는 징계권고 및 제75조에 따른 과태료 부과처분 등을 한 경우에는 처분 등을 받은 자에게 해당 처분 등을 받았다는 사실을 공표할 것을 명할 수 있다. <개정 2023. 3. 14.>
③ 제1항 및 제2항에 따른 개선권고 사실 등의 공표 및 공표명령의 방법, 기준 및 절차 등은 대통령령으로 정한다. <개정 2023. 3. 14.>
Article 66 (Publication of Results)
(1) The Protection Commission may publish the recommendation for improvement under Article 61; the order to take corrective measures under Article 64; the imposition of penalty surcharges under Article 64-2; the accusation or recommendation for a disciplinary action under Article 65; and the imposition of administrative fines under Article 75 and the results thereof. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020; Mar. 14, 2023>
(2) Where the Protection Commission makes dispositions such as a recommendation for improvement under Article 61, an order to take corrective measures under Article 64, the imposition of a penalty surcharge under Article 64-2, an accusation or recommendation for a disciplinary action under Article 65, or a disposition to impose an administrative fine under Article 75, it may order the person who has received such disposition to publish the fact of receiving such disposition. <Amended on Mar. 14, 2023>
(3) The method, criteria, procedure, etc. for publishing the fact of receiving a recommendation for improvement, etc. and issuing orders for publication under paragraphs (1) and (2) shall be prescribed by Presidential Decree. <Amended on Mar. 14, 2023>
Article 67 (Annual Reports)
(1) The Protection Commission shall prepare a report each year, based on necessary materials furnished by related agencies, etc., in relation to the establishment and implementation of personal information protection policy measures, and submit (including transmission via an information and communications networks) it to the National Assembly before the opening of the regular session.
(2) The annual report referred to in paragraph (1) shall contain the following matters: <Amended on Mar. 29, 2016; Mar. 14, 2023>
1. Infringement on the rights of data subjects and the status of remedies thereof;
2. Results of fact-finding surveys on personal information processing and the assessments of the level of personal information protection;
3. Status of implementation of the personal information protection policy measures and achievements;
4. Global legislative and policy trends regarding personal information;
5. Status of the enactment and amendment of statutes, Presidential Decrees, the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, the National Election Commission Regulations, and the Board of Audit and Inspection Regulations, in relation to processing of resident registration numbers;
6. Other matters to be disclosed or reported in relation to the personal information protection policy measures.
제67조(연차보고)
① 보호위원회는 관계 기관 등으로부터 필요한 자료를 제출받아 매년 개인정보 보호시책의 수립 및 시행에 관한 보고서를 작성하여 정기국회 개회 전까지 국회에 제출(정보통신망에 의한 제출을 포함한다)하여야 한다.
② 제1항에 따른 보고서에는 다음 각 호의 내용이 포함되어야 한다. <개정 2016. 3. 29., 2023. 3. 14.>
1. 정보주체의 권리침해 및 그 구제현황
2. 개인정보 처리에 관한 실태조사 및 개인정보 보호수준 평가 등의 결과
3. 개인정보 보호시책의 추진현황 및 실적
4. 개인정보 관련 해외의 입법 및 정책 동향
5. 주민등록번호 처리와 관련된 법률ㆍ대통령령ㆍ국회규칙ㆍ대법원규칙ㆍ헌법재판소규칙ㆍ중앙선거관리위원회규칙 및 감사원규칙의 제정ㆍ개정 현황
6. 그 밖에 개인정보 보호시책에 관하여 공개 또는 보고하여야 할 사항
Article 67 (Annual Reports)
(1) The Protection Commission shall prepare a report each year, based on necessary materials furnished by related agencies, etc., in relation to the establishment and implementation of personal information protection policy measures, and submit (including transmission via an information and communications networks) it to the National Assembly before the opening of the regular session.
(2) The annual report referred to in paragraph (1) shall contain the following matters: <Amended on Mar. 29, 2016; Mar. 14, 2023>
1. Infringement on the rights of data subjects and the status of remedies thereof;
2. Results of fact-finding surveys on personal information processing and the assessments of the level of personal information protection;
3. Status of implementation of the personal information protection policy measures and achievements;
4. Global legislative and policy trends regarding personal information;
5. Status of the enactment and amendment of statutes, Presidential Decrees, the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, the National Election Commission Regulations, and the Board of Audit and Inspection Regulations, in relation to processing of resident registration numbers;
6. Other matters to be disclosed or reported in relation to the personal information protection policy measures.
Article 68 (Delegation and Entrustment of Authority)
(1) The authority of the Protection Commission or the head of a related central administrative agency under this Act may in part be delegated or entrusted, as prescribed by Presidential Decree, to the Special Metropolitan City Mayor, Metropolitan City Mayors, Do Governors, Special Self-Governing Province Governors, or the specialized institutions prescribed by Presidential Decree. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) The agencies to which the authority of the Protection Commission or the head of a related central administrative agency has been partially delegated or entrusted pursuant to paragraph (1) shall notify the Protection Commission or the head of the related central administrative agency of the results of performing the work delegated or entrusted. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) Where delegating or entrusting a part of the authority to a specialized institution pursuant to paragraph (1), the Protection Commission may provide a contribution to the special institution to cover expenses incurred in performing the work. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
제68조(권한의 위임ㆍ위탁)
① 이 법에 따른 보호위원회 또는 관계 중앙행정기관의 장의 권한은 그 일부를 대통령령으로 정하는 바에 따라 특별시장, 광역시장, 도지사, 특별자치도지사 또는 대통령령으로 정하는 전문기관에 위임하거나 위탁할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
② 제1항에 따라 보호위원회 또는 관계 중앙행정기관의 장의 권한을 위임 또는 위탁받은 기관은 위임 또는 위탁받은 업무의 처리 결과를 보호위원회 또는 관계 중앙행정기관의 장에게 통보하여야 한다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
③ 보호위원회는 제1항에 따른 전문기관에 권한의 일부를 위임하거나 위탁하는 경우 해당 전문기관의 업무 수행을 위하여 필요한 경비를 출연할 수 있다. <개정 2013. 3. 23., 2014. 11. 19., 2017. 7. 26., 2020. 2. 4.>
Article 68 (Delegation and Entrustment of Authority)
(1) The authority of the Protection Commission or the head of a related central administrative agency under this Act may in part be delegated or entrusted, as prescribed by Presidential Decree, to the Special Metropolitan City Mayor, Metropolitan City Mayors, Do Governors, Special Self-Governing Province Governors, or the specialized institutions prescribed by Presidential Decree. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(2) The agencies to which the authority of the Protection Commission or the head of a related central administrative agency has been partially delegated or entrusted pursuant to paragraph (1) shall notify the Protection Commission or the head of the related central administrative agency of the results of performing the work delegated or entrusted. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
(3) Where delegating or entrusting a part of the authority to a specialized institution pursuant to paragraph (1), the Protection Commission may provide a contribution to the special institution to cover expenses incurred in performing the work. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Feb. 4, 2020>
Article 69 (Persons Deemed to be Public Officials for Purposes of Applying Penalty Provisions)
(1) Among the Commissioners of the Protection Commission, Commissioners other than public officials and employees other than public officials shall be deemed a public official for the purposes of applying penalty under the Criminal Act or other statutes. <Newly Inserted on Feb. 4, 2020>
(2) Any executive or employee of a relevant agency that performs the works entrusted by the Protection Commission or the head of a related central administrative agency shall be deemed a public official for the purposes of applying Articles 129 through 132 of the Criminal Act. <Newly Inserted on Feb. 4, 2020>
제69조(벌칙 적용 시의 공무원 의제)
① 보호위원회의 위원 중 공무원이 아닌 위원 및 공무원이 아닌 직원은 「형법」이나 그 밖의 법률에 따른 벌칙을 적용할 때에는 공무원으로 본다. <신설 2020. 2. 4.>
② 보호위원회 또는 관계 중앙행정기관의 장의 권한을 위탁한 업무에 종사하는 관계 기관의 임직원은 「형법」 제129조부터 제132조까지의 규정을 적용할 때에는 공무원으로 본다. <신설 2020. 2. 4.>
Article 69 (Persons Deemed to be Public Officials for Purposes of Applying Penalty Provisions)
(1) Among the Commissioners of the Protection Commission, Commissioners other than public officials and employees other than public officials shall be deemed a public official for the purposes of applying penalty under the Criminal Act or other statutes. <Newly Inserted on Feb. 4, 2020>
(2) Any executive or employee of a relevant agency that performs the works entrusted by the Protection Commission or the head of a related central administrative agency shall be deemed a public official for the purposes of applying Articles 129 through 132 of the Criminal Act. <Newly Inserted on Feb. 4, 2020>
CHAPTER X PENALTY PROVISIONS
제10장 벌칙
CHAPTER X PENALTY PROVISIONS
Article 70 (Penalty Provisions)
Any of the following persons shall be punished by imprisonment with labor for not more than 10 years, or by a fine not exceeding 100 million won: <Amended on Jul. 24, 2015>
1. A person who causes the suspension, paralysis or other severe hardship of work of a public institution by altering or erasing the personal information processed by the public institution for the purpose of disturbing the personal information processing of such public institution;
2. A person who obtains any personal information processed by third parties by fraud or other improper means or methods and provides it to a third party for a profit-making or unjust purpose, and a person who abets or arranges such conduct.
제70조(벌칙)
다음 각 호의 어느 하나에 해당하는 자는 10년 이하의 징역 또는 1억원 이하의 벌금에 처한다. <개정 2015. 7. 24.>
1. 공공기관의 개인정보 처리업무를 방해할 목적으로 공공기관에서 처리하고 있는 개인정보를 변경하거나 말소하여 공공기관의 업무 수행의 중단ㆍ마비 등 심각한 지장을 초래한 자
2. 거짓이나 그 밖의 부정한 수단이나 방법으로 다른 사람이 처리하고 있는 개인정보를 취득한 후 이를 영리 또는 부정한 목적으로 제3자에게 제공한 자와 이를 교사ㆍ알선한 자
Article 70 (Penalty Provisions)
Any of the following persons shall be punished by imprisonment with labor for not more than 10 years, or by a fine not exceeding 100 million won: <Amended on Jul. 24, 2015>
1. A person who causes the suspension, paralysis or other severe hardship of work of a public institution by altering or erasing the personal information processed by the public institution for the purpose of disturbing the personal information processing of such public institution;
2. A person who obtains any personal information processed by third parties by fraud or other improper means or methods and provides it to a third party for a profit-making or unjust purpose, and a person who abets or arranges such conduct.
Article 71 (Penalty Provisions)
Any of the following persons shall be punished by imprisonment with labor for not more than five years, or by a fine not exceeding 50 million won:<Amended on Mar. 29, 2016; Feb. 4, 2020; Mar. 14, 2023>
1. A person who provides personal information to a third party without the consent of a data subject, in violation of Article 17 (1) 1 (including where it is applied mutatis mutandis pursuant to Article 26 (8)) even through Article 17 (1) 2 is not applicable, and a person who knowingly receives such personal information;
2. A person who uses personal information or provides personal information to a third party in violation of Article 18 (1) and (2), 27 (3), 28-2 (including where it is applied mutatis mutandis pursuant to Article 26 (8)), 19, or 26 (5) and a person who knowingly receives such personal information for a profit-making or improper purposes;
3. A person who collects personal information of a child under 14 years of age without his or her legal representative’s consent, in violation of Article 22-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
4. A person who processes sensitive information, in violation of Article 23 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
5. A person who processes personally identifiable information, in violation of Article 24 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
6. A person who consolidates pseudonymized information without having been designated as a specialized institution by the Protection Commission or the head of a relevant central administrative agency, in violation of Article 28-3 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
7. A person who transfers combined information to outside the institution that has performed the combination without obtaining approval therefor from the head of the specialized institution, or provides a third party with such information, in violation of Article 28-3 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), or a person who knowingly receives such combined information for profit-making or improper purposes;
8. A person who processes pseudonymized information for the purpose of uniquely identifying an individual, in violation of Article 28-5 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
9. A person who divulges personal information acquired in the course of performing his or her work or provides it for any other person's use without authority in violation of subparagraph 2 of Article 59, and a person who knowingly receives such personal information for a profit-making or improper purposes;
10. A person who uses, damages, destroys, alters, forges, or divulges any other person's personal information, in violation of subparagraph 3 of Article 59.
제71조(벌칙)
다음 각 호의 어느 하나에 해당하는 자는 5년 이하의 징역 또는 5천만원 이하의 벌금에 처한다. <개정 2016. 3. 29., 2020. 2. 4., 2023. 3. 14.>
1. 제17조제1항제2호에 해당하지 아니함에도 같은 항 제1호(제26조제8항에 따라 준용되는 경우를 포함한다)를 위반하여 정보주체의 동의를 받지 아니하고 개인정보를 제3자에게 제공한 자 및 그 사정을 알면서도 개인정보를 제공받은 자
2. 제18조제1항ㆍ제2항, 제27조제3항 또는 제28조의2(제26조제8항에 따라 준용되는 경우를 포함한다), 제19조 또는 제26조제5항을 위반하여 개인정보를 이용하거나 제3자에게 제공한 자 및 그 사정을 알면서도 영리 또는 부정한 목적으로 개인정보를 제공받은 자
3. 제22조의2제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 법정대리인의 동의를 받지 아니하고 만 14세 미만인 아동의 개인정보를 처리한 자
4. 제23조제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 민감정보를 처리한 자
5. 제24조제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 고유식별정보를 처리한 자
6. 제28조의3제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 보호위원회 또는 관계 중앙행정기관의 장으로부터 전문기관으로 지정받지 아니하고 가명정보를 결합한 자
7. 제28조의3제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 전문기관의 장의 승인을 받지 아니하고 결합을 수행한 기관 외부로 결합된 정보를 반출하거나 이를 제3자에게 제공한 자 및 그 사정을 알면서도 영리 또는 부정한 목적으로 결합된 정보를 제공받은 자
8. 제28조의5제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 특정 개인을 알아보기 위한 목적으로 가명정보를 처리한 자
9. 제59조제2호를 위반하여 업무상 알게 된 개인정보를 누설하거나 권한 없이 다른 사람이 이용하도록 제공한 자 및 그 사정을 알면서도 영리 또는 부정한 목적으로 개인정보를 제공받은 자
10. 제59조제3호를 위반하여 다른 사람의 개인정보를 이용, 훼손, 멸실, 변경, 위조 또는 유출한 자
Article 71 (Penalty Provisions)
Any of the following persons shall be punished by imprisonment with labor for not more than five years, or by a fine not exceeding 50 million won:<Amended on Mar. 29, 2016; Feb. 4, 2020; Mar. 14, 2023>
1. A person who provides personal information to a third party without the consent of a data subject, in violation of Article 17 (1) 1 (including where it is applied mutatis mutandis pursuant to Article 26 (8)) even through Article 17 (1) 2 is not applicable, and a person who knowingly receives such personal information;
2. A person who uses personal information or provides personal information to a third party in violation of Article 18 (1) and (2), 27 (3), 28-2 (including where it is applied mutatis mutandis pursuant to Article 26 (8)), 19, or 26 (5) and a person who knowingly receives such personal information for a profit-making or improper purposes;
3. A person who collects personal information of a child under 14 years of age without his or her legal representative’s consent, in violation of Article 22-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
4. A person who processes sensitive information, in violation of Article 23 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
5. A person who processes personally identifiable information, in violation of Article 24 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
6. A person who consolidates pseudonymized information without having been designated as a specialized institution by the Protection Commission or the head of a relevant central administrative agency, in violation of Article 28-3 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
7. A person who transfers combined information to outside the institution that has performed the combination without obtaining approval therefor from the head of the specialized institution, or provides a third party with such information, in violation of Article 28-3 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), or a person who knowingly receives such combined information for profit-making or improper purposes;
8. A person who processes pseudonymized information for the purpose of uniquely identifying an individual, in violation of Article 28-5 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
9. A person who divulges personal information acquired in the course of performing his or her work or provides it for any other person's use without authority in violation of subparagraph 2 of Article 59, and a person who knowingly receives such personal information for a profit-making or improper purposes;
10. A person who uses, damages, destroys, alters, forges, or divulges any other person's personal information, in violation of subparagraph 3 of Article 59.
Article 72 (Penalty Provisions)
Any of the following persons shall be punished by imprisonment with labor for not more than three years, or by a fine not exceeding 30 million won: <Amended on Mar. 14, 2023>
1. A person who arbitrarily manipulates a fixed visual data processing device for purposes other than those for which the device was installed, directs such device toward different spots, or uses sound recording functions, in violation of Article 25 (5) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
2. A person who acquires personal information or obtains consent to personal information processing by fraud or other improper means in violation of subparagraph 1 of Article 59, and a person who knowingly receives such personal information for a profit-making or improper purpose;
3. A person who divulges confidential information acquired while performing his or her duties, or uses such information for purposes other than for the purpose of discharging his or her duties in violation of Article 60.
제72조(벌칙)
다음 각 호의 어느 하나에 해당하는 자는 3년 이하의 징역 또는 3천만원 이하의 벌금에 처한다. <개정 2023. 3. 14.>
1. 제25조제5항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 고정형 영상정보처리기기의 설치 목적과 다른 목적으로 고정형 영상정보처리기기를 임의로 조작하거나 다른 곳을 비추는 자 또는 녹음기능을 사용한 자
2. 제59조제1호를 위반하여 거짓이나 그 밖의 부정한 수단이나 방법으로 개인정보를 취득하거나 개인정보 처리에 관한 동의를 받는 행위를 한 자 및 그 사정을 알면서도 영리 또는 부정한 목적으로 개인정보를 제공받은 자
3. 제60조를 위반하여 직무상 알게 된 비밀을 누설하거나 직무상 목적 외에 이용한 자
Article 72 (Penalty Provisions)
Any of the following persons shall be punished by imprisonment with labor for not more than three years, or by a fine not exceeding 30 million won: <Amended on Mar. 14, 2023>
1. A person who arbitrarily manipulates a fixed visual data processing device for purposes other than those for which the device was installed, directs such device toward different spots, or uses sound recording functions, in violation of Article 25 (5) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
2. A person who acquires personal information or obtains consent to personal information processing by fraud or other improper means in violation of subparagraph 1 of Article 59, and a person who knowingly receives such personal information for a profit-making or improper purpose;
3. A person who divulges confidential information acquired while performing his or her duties, or uses such information for purposes other than for the purpose of discharging his or her duties in violation of Article 60.
Article 73 (Penalty Provisions)
(1) Any of the following persons shall be punished by imprisonment with labor for not more than two years or by a fine not exceeding 20 million won:
1. A person who fails to take necessary measures, such as correction and erasure, in violation of Article 36 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), and keeps on using the personal information or provides it to a third party;
2. A person who fails to suspend the processing of personal information, in violation of Article 37 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), and keeps on using the personal information or provides it to a third party;
3. Any person who fails to comply with a confidentiality order under Article 39-4 in or outside Korea without good cause;
4. A person who refuses to submit materials or submits false materials in response to a request for the submission of materials under Article 63 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8)) for the purpose of concealing or understating violations of the Act;
5. A person who refuses, obstructs, or evades an investigation by concealing, discarding, or refusing access to, materials, or by forging or falsifying, etc. materials during an entry and inspection conducted pursuant to Article 63 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)).
(2) No prosecution against a crime under paragraph (1) 3 shall be instituted without a criminal complaint is filed by a person who has requested a confidentiality order.
[This Article Wholly Amended on Mar. 14, 2023]
제73조(벌칙)
① 다음 각 호의 어느 하나에 해당하는 자는 2년 이하의 징역 또는 2천만원 이하의 벌금에 처한다.
1. 제36조제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 정정ㆍ삭제 등 필요한 조치를 하지 아니하고 개인정보를 계속 이용하거나 이를 제3자에게 제공한 자
2. 제37조제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 개인정보의 처리를 정지하지 아니하고 개인정보를 계속 이용하거나 제3자에게 제공한 자
3. 국내외에서 정당한 이유 없이 제39조의4에 따른 비밀유지명령을 위반한 자
4. 제63조제1항(제26조제8항에 따라 준용되는 경우를 포함한다)에 따른 자료제출 요구에 대하여 법 위반사항을 은폐 또는 축소할 목적으로 자료제출을 거부하거나 거짓의 자료를 제출한 자
5. 제63조제2항(제26조제8항에 따라 준용되는 경우를 포함한다)에 따른 출입ㆍ검사 시 자료의 은닉ㆍ폐기, 접근 거부 또는 위조ㆍ변조 등을 통하여 조사를 거부ㆍ방해 또는 기피한 자
② 제1항제3호의 죄는 비밀유지명령을 신청한 자의 고소가 없으면 공소를 제기할 수 없다.
[전문개정 2023. 3. 14.]
Article 73 (Penalty Provisions)
(1) Any of the following persons shall be punished by imprisonment with labor for not more than two years or by a fine not exceeding 20 million won:
1. A person who fails to take necessary measures, such as correction and erasure, in violation of Article 36 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), and keeps on using the personal information or provides it to a third party;
2. A person who fails to suspend the processing of personal information, in violation of Article 37 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), and keeps on using the personal information or provides it to a third party;
3. Any person who fails to comply with a confidentiality order under Article 39-4 in or outside Korea without good cause;
4. A person who refuses to submit materials or submits false materials in response to a request for the submission of materials under Article 63 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8)) for the purpose of concealing or understating violations of the Act;
5. A person who refuses, obstructs, or evades an investigation by concealing, discarding, or refusing access to, materials, or by forging or falsifying, etc. materials during an entry and inspection conducted pursuant to Article 63 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)).
(2) No prosecution against a crime under paragraph (1) 3 shall be instituted without a criminal complaint is filed by a person who has requested a confidentiality order.
[This Article Wholly Amended on Mar. 14, 2023]
Article 74 (Joint Penalty Provisions)
(1) If the representative of a corporation, or an agent or employee of, or any other person employed by, a corporation or an individual commits any of the offenses provided for in Article 70 in connection with the business affairs of the corporation or individual, not only shall such offender be punished, but also the corporation or individual shall be punished by a fine not exceeding 70 million won: Provided, That this shall not apply where such corporation or individual has not been negligent in taking due care and supervisory activities concerning the relevant affairs to prevent such offense.
(2) If the representative of a corporation, or an agent or employee of, or any other person employed by, a corporation or an individual commits any of the offenses provided for in Articles 71 through 73 in connection with the business affairs of the corporation or individual, not only shall such offender be punished, but also the corporation or individual shall be punished by a fine prescribed in the relevant Article: Provided, That the same shall not apply where such corporation or individual has not been negligent in taking due care and supervisory activities concerning the relevant affairs to prevent such offense.
제74조(양벌규정)
① 법인의 대표자나 법인 또는 개인의 대리인, 사용인, 그 밖의 종업원이 그 법인 또는 개인의 업무에 관하여 제70조에 해당하는 위반행위를 하면 그 행위자를 벌하는 외에 그 법인 또는 개인을 7천만원 이하의 벌금에 처한다. 다만, 법인 또는 개인이 그 위반행위를 방지하기 위하여 해당 업무에 관하여 상당한 주의와 감독을 게을리하지 아니한 경우에는 그러하지 아니하다.
② 법인의 대표자나 법인 또는 개인의 대리인, 사용인, 그 밖의 종업원이 그 법인 또는 개인의 업무에 관하여 제71조부터 제73조까지의 어느 하나에 해당하는 위반행위를 하면 그 행위자를 벌하는 외에 그 법인 또는 개인에게도 해당 조문의 벌금형을 과(科)한다. 다만, 법인 또는 개인이 그 위반행위를 방지하기 위하여 해당 업무에 관하여 상당한 주의와 감독을 게을리하지 아니한 경우에는 그러하지 아니하다.
Article 74 (Joint Penalty Provisions)
(1) If the representative of a corporation, or an agent or employee of, or any other person employed by, a corporation or an individual commits any of the offenses provided for in Article 70 in connection with the business affairs of the corporation or individual, not only shall such offender be punished, but also the corporation or individual shall be punished by a fine not exceeding 70 million won: Provided, That this shall not apply where such corporation or individual has not been negligent in taking due care and supervisory activities concerning the relevant affairs to prevent such offense.
(2) If the representative of a corporation, or an agent or employee of, or any other person employed by, a corporation or an individual commits any of the offenses provided for in Articles 71 through 73 in connection with the business affairs of the corporation or individual, not only shall such offender be punished, but also the corporation or individual shall be punished by a fine prescribed in the relevant Article: Provided, That the same shall not apply where such corporation or individual has not been negligent in taking due care and supervisory activities concerning the relevant affairs to prevent such offense.
Article 74-2 (Confiscation and Collection)
Any money or goods or other profits acquired by a person who has violated Articles 70 through 73 in relation to such violation may be confiscated, or, if confiscation is impossible, the value thereof may be collected. In such cases, such confiscation or collection may be levied in addition to other penalty provisions.
[This Article Newly Inserted on Jul. 24, 2015]
제74조의2(몰수ㆍ추징 등)
제70조부터 제73조까지의 어느 하나에 해당하는 죄를 지은 자가 해당 위반행위와 관련하여 취득한 금품이나 그 밖의 이익은 몰수할 수 있으며, 이를 몰수할 수 없을 때에는 그 가액을 추징할 수 있다. 이 경우 몰수 또는 추징은 다른 벌칙에 부가하여 과할 수 있다.
[본조신설 2015. 7. 24.]
Article 74-2 (Confiscation and Collection)
Any money or goods or other profits acquired by a person who has violated Articles 70 through 73 in relation to such violation may be confiscated, or, if confiscation is impossible, the value thereof may be collected. In such cases, such confiscation or collection may be levied in addition to other penalty provisions.
[This Article Newly Inserted on Jul. 24, 2015]
Article 75 (Administrative Fines)
(1) Any of the following persons shall be subject to an administrative fine not exceeding 50 million won:
1. A person who installs and operates a fixed visual data processing device, in violation of Article 25 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
2. A person who takes photographs of a person or thing related to such person with a mobile visual processing device, in violation of Article 25-2 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)).
(2) Any of the following persons shall be subject to an administrative fine not exceeding 30 million won:
1. A person who refuses to provide goods or services, in violation of Article 16 (3) or 22 (5) (including where it is applied mutatis mutandis pursuant to 26 (8));
2. A person who fails to notify a data subject of the facts provided in the subparagraphs of Article 20 (1), in violation of paragraphs (1) or (2) of that Article;
3. A person who fails to notify a data subject of the details of the use and provision of personal information or the method of accessing the information system through which such details can be confirmed, in violation of Article 20-2 (1);
4. A person who fails to take necessary measures, such as destroying personal information, in violation of Article 21 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
5. A person who fails to take measures necessary to ensure safety, in violation of Article 23 (2), 24 (3), or 25 (6) (including where it is applied mutatis mutandis pursuant to Article 25-2 (4)), or Article 28-4 (1), or 29 (including where it is applied mutatis mutandis pursuant to Article 26 (8));
6. A person who fails to communicate to the data subject the possibility of disclosure of sensitive information and the method of selecting non-disclosure, in violation of Article 23 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
7. A person who processes resident registration numbers, in violation of Article 24-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
8. A person who fails to take encryption measures, in violation of Article 24-2 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
9. A person who fails to provide data subjects with an alternative sign-up tool without using their resident registration numbers, in violation of Article 24-2 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
10. A person who installs and operates a fixed visual data processing device, in violation of Article 25 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
11. A person who takes photographs of a person or a thing related to such person, in violation of Article 25-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
12. A person who fails to notify a data subject of the matters he or she is required to notify, in violation of Article 26 (3);
13. A person who fails to cease the use of, to retrieve or to destroy, information even if information that can uniquely identify an individual has been generated, in violation of Article 28-5 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
14. A person who fails to take protective measures, in violation of Article 28-8 (4) (including where it is applied mutatis mutandis pursuant to Articles 26 (8) and 28-11);
15. A person who indicates or promotes the details of certification despite a failure to obtain such certification, in violation of Article 32-2 (6);
16. A person who fails to conduct a privacy impact assessment or to submit the results thereof to the Protection Commission, in violation of Article 33 (1);
17. A person who fails to notify a data subject of the facts provided in the subparagraphs of Article 34 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), in violation of that paragraph;
18. A person who fails to file a report with the Protection Commission or a specialized institution prescribed by Presidential Decree, in violation of Article 34 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
19. A person who limits or denies access, in violation of Article 35 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
20. A person who performs work under Article 35-3 (1) 2 without obtaining designation under that paragraph;
21. A person who violates Article 35-3 (3);
22. A person who fails to take necessary measures, such as correction or erasure, in violation of Article 36 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
23. A person who fails to take necessary measures, such as destruction, in violation of Article 37 (3) or (5) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
24. A person who fails to comply with a request by a data subject without good cause, in violation of Article 37-2 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
25. Any person who fails to submit or falsely submits materials, including articles and documents related thereto under Article 63 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
26. A person who refuses, obstructs, or evades an entry and inspection, in violation of Article 63 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
27. A person who fails to comply with an order to take corrective measures under Article 64 (1).
(3) Any of the following persons shall be subject to an administrative fine not exceeding 20 million won:
1. A person who re-entrusts a third party with entrusted work without consent of the person entrusting, in violation of Article 26 (6);
2. A person who fails to designate a domestic agent, in violation of Article 31-2 (1).
(4) Any of the following persons shall be subject to an administrative fine not exceeding 10 million won:
1. A person who fails to submit materials without good cause or who submits false materials, in violation of Article 11-2 (2);
2. A person who fails to separately store and manage personal information, in violation of Article 21 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
3. A person who obtains consent, in violation of Article 22 (1) through (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
4. A person who, when entrusting work, fails to do so in a document stating the matters provided in Article 26 (1), in violation of that paragraph;
5. A person who fails to disclose the entrusted work and the person entrusted in violation of Article 26 (2);
6. A person who fails to notify the data subject of the fact of transfer of personal information, in violation of Article 27 (1) or (2) (including where it is applied mutatis mutandis pursuant to 26 (8));
7. A person who fails to prepare and retain relevant records, in violation of Article 28-4 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
8. A person who fails to establish or disclose, the Privacy Policy, in violation of Article 30 (1) or (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
9. A person who fails to designate a privacy officer, in violation of Article 31 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
10. A person who fails to notify a data subject of the matters he or she is required to notify, in violation of Article 35 (3) and (4), 36 (2) and (4), or 37 (4) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
11. A person who fails to submit materials provided in Article 45 (1) without good cause or who submits false materials;
12. A person who refuses, obstructs, or evades an entry, inspection, or access under Article 45 (2), without good cause.
(5) The Protection Commission shall impose and collect administrative fines under paragraphs (1) through (4), as prescribed by Presidential Decree. In such cases, the Protection Commission may reduce or exempt administrative fines based on the degree of, motives for, and consequences of the violation, the size of the personal information controller, etc.
[This Article Wholly Amended on Mar. 14, 2023]
[Enforcement Date: Mar. 15, 2024] Article 75 (2) 16, 20, 21, and 24, and Article 75 (4) 1 and 9
제75조(과태료)
① 다음 각 호의 어느 하나에 해당하는 자에게는 5천만원 이하의 과태료를 부과한다.
1. 제25조제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 고정형 영상정보처리기기를 설치ㆍ운영한 자
2. 제25조의2제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 이동형 영상정보처리기기로 사람 또는 그 사람과 관련된 사물의 영상을 촬영한 자
② 다음 각 호의 어느 하나에 해당하는 자에게는 3천만원 이하의 과태료를 부과한다.
1. 제16조제3항ㆍ제22조제5항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 재화 또는 서비스의 제공을 거부한 자
2. 제20조제1항ㆍ제2항을 위반하여 정보주체에게 같은 조 제1항 각 호의 사실을 알리지 아니한 자
3. 제20조의2제1항을 위반하여 개인정보의 이용ㆍ제공 내역이나 이용ㆍ제공 내역을 확인할 수 있는 정보시스템에 접속하는 방법을 통지하지 아니한 자
4. 제21조제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 개인정보의 파기 등 필요한 조치를 하지 아니한 자
5. 제23조제2항ㆍ제24조제3항ㆍ제25조제6항(제25조의2제4항에 따라 준용되는 경우를 포함한다)ㆍ제28조의4제1항ㆍ제29조(제26조제8항에 따라 준용되는 경우를 포함한다)를 위반하여 안전성 확보에 필요한 조치를 하지 아니한 자
6. 제23조제3항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 민감정보의 공개 가능성 및 비공개를 선택하는 방법을 알리지 아니한 자
7. 제24조의2제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 주민등록번호를 처리한 자
8. 제24조의2제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 암호화 조치를 하지 아니한 자
9. 제24조의2제3항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 정보주체가 주민등록번호를 사용하지 아니할 수 있는 방법을 제공하지 아니한 자
10. 제25조제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 고정형 영상정보처리기기를 설치ㆍ운영한 자
11. 제25조의2제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 사람 또는 그 사람과 관련된 사물의 영상을 촬영한 자
12. 제26조제3항을 위반하여 정보주체에게 알려야 할 사항을 알리지 아니한 자
13. 제28조의5제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 개인을 알아볼 수 있는 정보가 생성되었음에도 이용을 중지하지 아니하거나 이를 회수ㆍ파기하지 아니한 자
14. 제28조의8제4항(제26조제8항 및 제28조의11에 따라 준용되는 경우를 포함한다)을 위반하여 보호조치를 하지 아니한 자
15. 제32조의2제6항을 위반하여 인증을 받지 아니하였음에도 거짓으로 인증의 내용을 표시하거나 홍보한 자
16. 제33조제1항을 위반하여 영향평가를 하지 아니하거나 그 결과를 보호위원회에 제출하지 아니한 자
17. 제34조제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 정보주체에게 같은 항 각 호의 사실을 알리지 아니한 자
18. 제34조제3항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 보호위원회 또는 대통령령으로 정하는 전문기관에 신고하지 아니한 자
19. 제35조제3항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 열람을 제한하거나 거절한 자
20. 제35조의3제1항에 따른 지정을 받지 아니하고 같은 항 제2호의 업무를 수행한 자
21. 제35조의3제3항을 위반한 자
22. 제36조제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 정정ㆍ삭제 등 필요한 조치를 하지 아니한 자
23. 제37조제3항 또는 제5항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 파기 등 필요한 조치를 하지 아니한 자
24. 제37조의2제3항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 정당한 사유 없이 정보주체의 요구에 따르지 아니한 자
25. 제63조제1항(제26조제8항에 따라 준용되는 경우를 포함한다)에 따른 관계 물품ㆍ서류 등 자료를 제출하지 아니하거나 거짓으로 제출한 자
26. 제63조제2항(제26조제8항에 따라 준용되는 경우를 포함한다)에 따른 출입ㆍ검사를 거부ㆍ방해 또는 기피한 자
27. 제64조제1항에 따른 시정조치 명령에 따르지 아니한 자
③ 다음 각 호의 어느 하나에 해당하는 자에게는 2천만원 이하의 과태료를 부과한다.
1. 제26조제6항을 위반하여 위탁자의 동의를 받지 아니하고 제3자에게 다시 위탁한 자
2. 제31조의2제1항을 위반하여 국내대리인을 지정하지 아니한 자
④ 다음 각 호의 어느 하나에 해당하는 자에게는 1천만원 이하의 과태료를 부과한다.
1. 제11조의2제2항을 위반하여 정당한 사유 없이 자료를 제출하지 아니하거나 거짓으로 제출한 자
2. 제21조제3항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 개인정보를 분리하여 저장ㆍ관리하지 아니한 자
3. 제22조제1항부터 제3항까지(제26조제8항에 따라 준용되는 경우를 포함한다)를 위반하여 동의를 받은 자
4. 제26조제1항을 위반하여 업무 위탁 시 같은 항 각 호의 내용이 포함된 문서로 하지 아니한 자
5. 제26조제2항을 위반하여 위탁하는 업무의 내용과 수탁자를 공개하지 아니한 자
6. 제27조제1항ㆍ제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 정보주체에게 개인정보의 이전 사실을 알리지 아니한 자
7. 제28조의4제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 관련 기록을 작성하여 보관하지 아니한 자
8. 제30조제1항 또는 제2항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 개인정보 처리방침을 정하지 아니하거나 이를 공개하지 아니한 자
9. 제31조제1항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 개인정보 보호책임자를 지정하지 아니한 자
10. 제35조제3항ㆍ제4항, 제36조제2항ㆍ제4항 또는 제37조제4항(제26조제8항에 따라 준용되는 경우를 포함한다)을 위반하여 정보주체에게 알려야 할 사항을 알리지 아니한 자
11. 제45조제1항에 따른 자료를 정당한 사유 없이 제출하지 아니하거나 거짓으로 제출한 자
12. 제45조제2항에 따른 출입ㆍ조사ㆍ열람을 정당한 사유 없이 거부ㆍ방해 또는 기피한 자
⑤ 제1항부터 제4항까지에 따른 과태료는 대통령령으로 정하는 바에 따라 보호위원회가 부과ㆍ징수한다. 이 경우 보호위원회는 위반행위의 정도ㆍ동기ㆍ결과, 개인정보처리자의 규모 등을 고려하여 과태료를 감경하거나 면제할 수 있다.
[전문개정 2023. 3. 14.]
[시행일: 2024. 3. 15.] 제75조제2항제16호, 제75조제2항제20호, 제75조제2항제21호, 제75조제2항제24호, 제75조제4항제1호, 제75조제4항제9호
Article 75 (Administrative Fines)
(1) Any of the following persons shall be subject to an administrative fine not exceeding 50 million won:
1. A person who installs and operates a fixed visual data processing device, in violation of Article 25 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
2. A person who takes photographs of a person or thing related to such person with a mobile visual processing device, in violation of Article 25-2 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)).
(2) Any of the following persons shall be subject to an administrative fine not exceeding 30 million won:
1. A person who refuses to provide goods or services, in violation of Article 16 (3) or 22 (5) (including where it is applied mutatis mutandis pursuant to 26 (8));
2. A person who fails to notify a data subject of the facts provided in the subparagraphs of Article 20 (1), in violation of paragraphs (1) or (2) of that Article;
3. A person who fails to notify a data subject of the details of the use and provision of personal information or the method of accessing the information system through which such details can be confirmed, in violation of Article 20-2 (1);
4. A person who fails to take necessary measures, such as destroying personal information, in violation of Article 21 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
5. A person who fails to take measures necessary to ensure safety, in violation of Article 23 (2), 24 (3), or 25 (6) (including where it is applied mutatis mutandis pursuant to Article 25-2 (4)), or Article 28-4 (1), or 29 (including where it is applied mutatis mutandis pursuant to Article 26 (8));
6. A person who fails to communicate to the data subject the possibility of disclosure of sensitive information and the method of selecting non-disclosure, in violation of Article 23 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
7. A person who processes resident registration numbers, in violation of Article 24-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
8. A person who fails to take encryption measures, in violation of Article 24-2 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
9. A person who fails to provide data subjects with an alternative sign-up tool without using their resident registration numbers, in violation of Article 24-2 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
10. A person who installs and operates a fixed visual data processing device, in violation of Article 25 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
11. A person who takes photographs of a person or a thing related to such person, in violation of Article 25-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
12. A person who fails to notify a data subject of the matters he or she is required to notify, in violation of Article 26 (3);
13. A person who fails to cease the use of, to retrieve or to destroy, information even if information that can uniquely identify an individual has been generated, in violation of Article 28-5 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
14. A person who fails to take protective measures, in violation of Article 28-8 (4) (including where it is applied mutatis mutandis pursuant to Articles 26 (8) and 28-11);
15. A person who indicates or promotes the details of certification despite a failure to obtain such certification, in violation of Article 32-2 (6);
16. A person who fails to conduct a privacy impact assessment or to submit the results thereof to the Protection Commission, in violation of Article 33 (1);
17. A person who fails to notify a data subject of the facts provided in the subparagraphs of Article 34 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), in violation of that paragraph;
18. A person who fails to file a report with the Protection Commission or a specialized institution prescribed by Presidential Decree, in violation of Article 34 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
19. A person who limits or denies access, in violation of Article 35 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
20. A person who performs work under Article 35-3 (1) 2 without obtaining designation under that paragraph;
21. A person who violates Article 35-3 (3);
22. A person who fails to take necessary measures, such as correction or erasure, in violation of Article 36 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
23. A person who fails to take necessary measures, such as destruction, in violation of Article 37 (3) or (5) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
24. A person who fails to comply with a request by a data subject without good cause, in violation of Article 37-2 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
25. Any person who fails to submit or falsely submits materials, including articles and documents related thereto under Article 63 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
26. A person who refuses, obstructs, or evades an entry and inspection, in violation of Article 63 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
27. A person who fails to comply with an order to take corrective measures under Article 64 (1).
(3) Any of the following persons shall be subject to an administrative fine not exceeding 20 million won:
1. A person who re-entrusts a third party with entrusted work without consent of the person entrusting, in violation of Article 26 (6);
2. A person who fails to designate a domestic agent, in violation of Article 31-2 (1).
(4) Any of the following persons shall be subject to an administrative fine not exceeding 10 million won:
1. A person who fails to submit materials without good cause or who submits false materials, in violation of Article 11-2 (2);
2. A person who fails to separately store and manage personal information, in violation of Article 21 (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
3. A person who obtains consent, in violation of Article 22 (1) through (3) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
4. A person who, when entrusting work, fails to do so in a document stating the matters provided in Article 26 (1), in violation of that paragraph;
5. A person who fails to disclose the entrusted work and the person entrusted in violation of Article 26 (2);
6. A person who fails to notify the data subject of the fact of transfer of personal information, in violation of Article 27 (1) or (2) (including where it is applied mutatis mutandis pursuant to 26 (8));
7. A person who fails to prepare and retain relevant records, in violation of Article 28-4 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
8. A person who fails to establish or disclose, the Privacy Policy, in violation of Article 30 (1) or (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
9. A person who fails to designate a privacy officer, in violation of Article 31 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
10. A person who fails to notify a data subject of the matters he or she is required to notify, in violation of Article 35 (3) and (4), 36 (2) and (4), or 37 (4) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
11. A person who fails to submit materials provided in Article 45 (1) without good cause or who submits false materials;
12. A person who refuses, obstructs, or evades an entry, inspection, or access under Article 45 (2), without good cause.
(5) The Protection Commission shall impose and collect administrative fines under paragraphs (1) through (4), as prescribed by Presidential Decree. In such cases, the Protection Commission may reduce or exempt administrative fines based on the degree of, motives for, and consequences of the violation, the size of the personal information controller, etc.
[This Article Wholly Amended on Mar. 14, 2023]
[Enforcement Date: Mar. 15, 2024] Article 75 (2) 16, 20, 21, and 24, and Article 75 (4) 1 and 9
Article 76 (Special Exemption to Application of Provisions on Administrative Fines)
For the purposes of applying the provisions governing administrative fines provided in Article 75, no additional administrative fine shall be imposed for any act subject to penalty surcharges pursuant to Article 64-2. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Aug. 6, 2013]
제76조(과태료에 관한 규정 적용의 특례)
제75조의 과태료에 관한 규정을 적용할 때 제64조의2에 따라 과징금을 부과한 행위에 대하여는 과태료를 부과할 수 없다. <개정 2023. 3. 14.>
[본조신설 2013. 8. 6.]
Article 76 (Special Exemption to Application of Provisions on Administrative Fines)
For the purposes of applying the provisions governing administrative fines provided in Article 75, no additional administrative fine shall be imposed for any act subject to penalty surcharges pursuant to Article 64-2. <Amended on Mar. 14, 2023>
[This Article Newly Inserted on Aug. 6, 2013]
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation: Provided, That Articles 24 (2) and 75 (2) 5 shall enter into force one year after the date of its promulgation.
Article 2 (Repeal of other Acts)
The Act on the Protection of Personal Information Maintained by Public Institutions is hereby repealed.
Article 3 (Transitional Measures concerning Personal Information Dispute Mediation Committee)
An act performed by or against the Personal Information Dispute Mediation Committee under the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. as at the time this Act enters into force shall be deemed an act performed by or against the Personal Information Dispute Mediation Committee corresponding thereto under this Act.
Article 4 (Transitional Measures concerning Personal Information being Processed)
Any personal information legitimately processed under other statutes or regulations before this Act enters into force shall be deemed to have been processed under this Act.
Article 5 (Transitional Measures concerning Application of Penalty Provisions)
(1) The application of the penalty provisions to a violation of the previous Act on the Protection of Personal Information Maintained by Public Institutions before this Act enters into force shall be governed by the previous Act on the Protection of Personal Information Maintained by Public Institutions.
(2) The application of the penalty provisions to a violation of the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. before this Act enters into force shall be governed by the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.
Article 6 Omitted.
Article 7 (Relationship to other Acts)
Where the previous Act on the Protection of Personal Information Maintained by Public Institutions or the provisions thereof are cited in other statutes or regulations as at the time this Act enters into force, and any provision corresponding thereto exists in this Act, this Act or the corresponding provision of this Act shall be deemed cited in lieu of the previous provision.
부칙 <제10465호, 2011. 3. 29.>
제1조(시행일)
이 법은 공포 후 6개월이 경과한 날부터 시행한다. 다만, 제24조제2항 및 제75조제2항제5호는 공포 후 1년이 경과한 날부터 시행한다.
제2조(다른 법률의 폐지)
공공기관의 개인정보보호에 관한 법률은 폐지한다.
제3조(개인정보분쟁조정위원회에 관한 경과조치)
이 법 시행 당시 종전의 「정보통신망 이용촉진 및 정보보호 등에 관한 법률」에 따른 개인정보분쟁조정위원회의 행위나 개인정보분쟁조정위원회에 대한 행위는 그에 해당하는 이 법에 따른 개인정보 분쟁조정위원회의 행위나 개인정보 분쟁조정위원회에 대한 행위로 본다.
제4조(처리 중인 개인정보에 관한 경과조치)
이 법 시행 전에 다른 법령에 따라 적법하게 처리된 개인정보는 이 법에 따라 처리된 것으로 본다.
제5조(벌칙의 적용에 관한 경과조치)
① 이 법 시행 전에 종전의 「공공기관의 개인정보보호에 관한 법률」을 위반한 행위에 대하여 벌칙을 적용할 때에는 종전의 「공공기관의 개인정보보호에 관한 법률」에 따른다.
② 이 법 시행 전에 종전의 「정보통신망 이용촉진 및 정보보호 등에 관한 법률」을 위반한 행위에 대하여 벌칙을 적용할 때에는 종전의 「정보통신망 이용촉진 및 정보보호 등에 관한 법률」에 따른다.
제6조 생략
제7조(다른 법령과의 관계)
이 법 시행 당시 다른 법령에서 종전의 「공공기관의 개인정보보호에 관한 법률」 또는 그 규정을 인용하고 있는 경우 이 법 중 그에 해당하는 규정이 있을 때에는 종전의 규정을 갈음하여 이 법 또는 이 법의 해당 규정을 인용한 것으로 본다.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation: Provided, That Articles 24 (2) and 75 (2) 5 shall enter into force one year after the date of its promulgation.
Article 2 (Repeal of other Acts)
The Act on the Protection of Personal Information Maintained by Public Institutions is hereby repealed.
Article 3 (Transitional Measures concerning Personal Information Dispute Mediation Committee)
An act performed by or against the Personal Information Dispute Mediation Committee under the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. as at the time this Act enters into force shall be deemed an act performed by or against the Personal Information Dispute Mediation Committee corresponding thereto under this Act.
Article 4 (Transitional Measures concerning Personal Information being Processed)
Any personal information legitimately processed under other statutes or regulations before this Act enters into force shall be deemed to have been processed under this Act.
Article 5 (Transitional Measures concerning Application of Penalty Provisions)
(1) The application of the penalty provisions to a violation of the previous Act on the Protection of Personal Information Maintained by Public Institutions before this Act enters into force shall be governed by the previous Act on the Protection of Personal Information Maintained by Public Institutions.
(2) The application of the penalty provisions to a violation of the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. before this Act enters into force shall be governed by the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.
Article 6 Omitted.
Article 7 (Relationship to other Acts)
Where the previous Act on the Protection of Personal Information Maintained by Public Institutions or the provisions thereof are cited in other statutes or regulations as at the time this Act enters into force, and any provision corresponding thereto exists in this Act, this Act or the corresponding provision of this Act shall be deemed cited in lieu of the previous provision.
ADDENDA
Article 1 (Enforcement Date)
(1) This Act shall enter into force on the date of its promulgation.
(2) Omitted.
Articles 2 through 7 Omitted.
부칙 <제11690호, 2013. 3. 23.>
제1조(시행일)
① 이 법은 공포한 날부터 시행한다.
② 생략
제2조부터 제7조까지 생략
ADDENDA
Article 1 (Enforcement Date)
(1) This Act shall enter into force on the date of its promulgation.
(2) Omitted.
Articles 2 through 7 Omitted.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force one year after the date of its promulgation.
Article 2 (Transitional Measures concerning Restriction on Processing of Resident Registration Numbers)
(1) A person who processes resident registration numbers as at the time this Act enters into force shall destroy the resident registration numbers possessed, within two years after this Act enters into force: Provided, That any of the cases falling under the amended subparagraphs of Article 24-2 (1) shall be excluded from the destruction.
(2) Where resident registration numbers are not destroyed within the period referred to in paragraph (1), the amended provisions of Article 24-2 (1) shall be deemed to have been violated.
부칙 <제11990호, 2013. 8. 6.>
제1조(시행일)
이 법은 공포 후 1년이 경과한 날부터 시행한다.
제2조(주민등록번호 처리 제한에 관한 경과조치)
① 이 법 시행 당시 주민등록번호를 처리하고 있는 개인정보처리자는 이 법 시행일부터 2년 이내에 보유하고 있는 주민등록번호를 파기하여야 한다. 다만, 제24조의2제1항 각 호의 개정규정의 어느 하나에 해당하는 경우는 제외한다.
② 제1항에 따른 기간 이내에 보유하고 있는 주민등록번호를 파기하지 아니한 경우에는 제24조의2제1항의 개정규정을 위반한 것으로 본다.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force one year after the date of its promulgation.
Article 2 (Transitional Measures concerning Restriction on Processing of Resident Registration Numbers)
(1) A person who processes resident registration numbers as at the time this Act enters into force shall destroy the resident registration numbers possessed, within two years after this Act enters into force: Provided, That any of the cases falling under the amended subparagraphs of Article 24-2 (1) shall be excluded from the destruction.
(2) Where resident registration numbers are not destroyed within the period referred to in paragraph (1), the amended provisions of Article 24-2 (1) shall be deemed to have been violated.
ADDENDUM
This Act shall enter into force on the date of its promulgation: Provided, That the amended provisions of Articles 24-2 and 75 (2) 5 of the Personal Information Protection Act (Act No. 11990) shall enter into force on January 1, 2016.
부칙 <제12504호, 2014. 3. 24.>
이 법은 공포한 날부터 시행한다. 다만, 법률 제11990호 개인정보 보호법 일부개정법률 제24조의2 및 제75조제2항제5호의 개정규정은 2016년 1월 1일부터 시행한다.
ADDENDUM
This Act shall enter into force on the date of its promulgation: Provided, That the amended provisions of Articles 24-2 and 75 (2) 5 of the Personal Information Protection Act (Act No. 11990) shall enter into force on January 1, 2016.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 7 Omitted.
부칙 <제12844호, 2014. 11. 19.>
제1조(시행일)
이 법은 공포한 날부터 시행한다. 다만, 부칙 제6조에 따라 개정되는 법률 중 이 법 시행 전에 공포되었으나 시행일이 도래하지 아니한 법률을 개정한 부분은 각각 해당 법률의 시행일부터 시행한다.
제2조부터 제7조까지 생략
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 7 Omitted.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation: Provided, That the amended provisions of Articles 8 (1), 8-2, 9, 11 (1), 32-2, 39 (3) and (4), 39-2, 40, and 75 (2) 7-2 shall enter into force one year after the date of its promulgation, and the amended provisions of the former part of Article 24-2 (2) and Article 75 (2) 4-3 of the Personal Information Protection Act (Act No. 12504) shall enter into force on January 1, 2016, respectively.
Article 2 (Applicability to Compensation)
The amended provisions of Articles 39 (3) and (4) and 39-2 shall begin to apply to claims for compensation for personal information suffering loss, theft, divulgence, forgery, alteration, or damage after the date this Act enters into force.
Article 3 (Transitional Measures concerning Personal Information Protection Certification)
Any person who has obtained the personal information protection certification from the Minister of the Interior before this Act enters into force shall be deemed obtained the personal information protection certification under the amended provisions of Article 32-2.
Article 4 (Transitional Measures concerning Qualifications for Certification Examiners of Personal Information Protection)
Any person qualified as a certification examiner of personal information protection before this Act enters into force shall be deemed qualified under this Act.
Article 5 (Transitional Measures concerning Terms of Office of Members of Personal Information Dispute Mediation Committee)
Members of the Dispute Mediation Committee appointed or commissioned by the Minister of the Interior before this Act enters into force shall be deemed members of the Dispute Mediation Committee commissioned by the Protection Commission under the amended provisions of Article 40.
Article 6 (Transitional Measures concerning Penalty Provisions, etc.)
The former provisions shall apply to the application of penalty provisions or imposition of administrative fines for offenses committed before this Act enters into force.
부칙 <제13423호, 2015. 7. 24.>
제1조(시행일)
이 법은 공포한 날부터 시행한다. 다만, 제8조제1항, 제8조의2, 제9조, 제11조제1항, 제32조의2, 제39조제3항ㆍ제4항, 제39조의2, 제40조, 제75조제2항제7호의2의 개정규정은 공포 후 1년이 경과한 날부터, 법률 제12504호 개인정보 보호법 일부개정법률 제24조의2제2항 전단 및 제75조제2항제4호의3의 개정규정은 2016년 1월 1일부터 각각 시행한다.
제2조(손해배상에 관한 적용례)
제39조제3항ㆍ제4항 및 제39조의2의 개정규정은 이 법 시행 후에 분실ㆍ도난ㆍ유출ㆍ위조ㆍ변조 또는 훼손된 개인정보에 관한 손해배상 청구분부터 적용한다.
제3조(개인정보 보호 인증에 관한 경과조치)
이 법 시행 전에 행정자치부장관으로부터 개인정보 보호 인증을 받은 자는 제32조의2의 개정규정에 따른 개인정보 보호 인증을 받은 것으로 본다.
제4조(개인정보 인증 심사원 자격에 관한 경과조치)
이 법 시행 전에 개인정보 보호 인증 심사원의 자격을 취득한 자는 이 법에 따른 개인정보 보호 인증 심사원의 자격을 취득한 것으로 본다.
제5조(개인정보 분쟁조정위원회 위원의 임기에 관한 경과조치)
이 법 시행 전에 행정자치부장관이 임명하거나 위촉한 분쟁조정위원회 위원은 제40조의 개정규정에 따른 보호위원회가 위촉한 분쟁조정위원회 위원으로 본다.
제6조(벌칙 등에 관한 경과조치)
이 법 시행 전의 위반행위에 대하여 벌칙 또는 과태료를 적용할 때에는 종전의 규정에 따른다.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation: Provided, That the amended provisions of Articles 8 (1), 8-2, 9, 11 (1), 32-2, 39 (3) and (4), 39-2, 40, and 75 (2) 7-2 shall enter into force one year after the date of its promulgation, and the amended provisions of the former part of Article 24-2 (2) and Article 75 (2) 4-3 of the Personal Information Protection Act (Act No. 12504) shall enter into force on January 1, 2016, respectively.
Article 2 (Applicability to Compensation)
The amended provisions of Articles 39 (3) and (4) and 39-2 shall begin to apply to claims for compensation for personal information suffering loss, theft, divulgence, forgery, alteration, or damage after the date this Act enters into force.
Article 3 (Transitional Measures concerning Personal Information Protection Certification)
Any person who has obtained the personal information protection certification from the Minister of the Interior before this Act enters into force shall be deemed obtained the personal information protection certification under the amended provisions of Article 32-2.
Article 4 (Transitional Measures concerning Qualifications for Certification Examiners of Personal Information Protection)
Any person qualified as a certification examiner of personal information protection before this Act enters into force shall be deemed qualified under this Act.
Article 5 (Transitional Measures concerning Terms of Office of Members of Personal Information Dispute Mediation Committee)
Members of the Dispute Mediation Committee appointed or commissioned by the Minister of the Interior before this Act enters into force shall be deemed members of the Dispute Mediation Committee commissioned by the Protection Commission under the amended provisions of Article 40.
Article 6 (Transitional Measures concerning Penalty Provisions, etc.)
The former provisions shall apply to the application of penalty provisions or imposition of administrative fines for offenses committed before this Act enters into force.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions of Articles 24-2 (1) 1 and 67 (2) 5 shall enter into force one year after the date of its promulgation.
Article 2 (Applicability to Notification of Other Sources of Personal Information than Data Subjects)
The amended provisions of Article 20 (2) and (3) shall begin to apply to where any personal information is collected from a person other than the data subjects after the date this Act enters into force.
Article 3 (Transitional Measures concerning Privacy Policy)
(1) The Privacy Policy established under the former provisions as at the time this Act enters into force shall be deemed the Privacy Policy established under the amended provisions of Article 30 (1).
(2) Each personal information controller shall amend the Privacy Policy referred to in paragraph (1) to meet the purport of amending Article 30 (1) within six months after the date this Act enters into force.
부칙 <제14107호, 2016. 3. 29.>
제1조(시행일)
이 법은 공포 후 6개월이 경과한 날부터 시행한다. 다만, 제24조의2제1항제1호 및 제67조제2항제5호의 개정규정은 공포 후 1년이 경과한 날부터 시행한다.
제2조(정보주체 이외로부터 수집한 개인정보의 수집 출처 등 고지에 관한 적용례)
제20조제2항 및 제3항의 개정규정은 이 법 시행 후 최초로 정보주체 이외로부터 개인정보를 수집하는 경우부터 적용한다.
제3조(개인정보 처리방침에 관한 경과조치)
① 이 법 시행 당시 종전의 규정에 따른 개인정보 처리방침은 제30조제1항의 개정규정에 따른 개인정보 처리방침으로 본다.
② 개인정보처리자는 이 법 시행 후 6개월 이내에 제1항에 따른 개인정보 처리방침을 제30조제1항의 개정취지에 맞도록 개정하여야 한다.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions of Articles 24-2 (1) 1 and 67 (2) 5 shall enter into force one year after the date of its promulgation.
Article 2 (Applicability to Notification of Other Sources of Personal Information than Data Subjects)
The amended provisions of Article 20 (2) and (3) shall begin to apply to where any personal information is collected from a person other than the data subjects after the date this Act enters into force.
Article 3 (Transitional Measures concerning Privacy Policy)
(1) The Privacy Policy established under the former provisions as at the time this Act enters into force shall be deemed the Privacy Policy established under the amended provisions of Article 30 (1).
(2) Each personal information controller shall amend the Privacy Policy referred to in paragraph (1) to meet the purport of amending Article 30 (1) within six months after the date this Act enters into force.
ADDENDUM
This Act shall enter into force six months after the date of its promulgation.
부칙 <제14765호, 2017. 4. 18.>
이 법은 공포 후 6개월이 경과한 날부터 시행한다.
ADDENDUM
This Act shall enter into force six months after the date of its promulgation.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation: Provided, That any amendment to the Acts made pursuant to Article 5 of this Addenda, promulgated before this Act enters into force, which have not yet entered into force, shall enter into force on the date the corresponding Act takes effect.
Articles 2 through 6 Omitted.
부칙 <제14839호, 2017. 7. 26.>
제1조(시행일)
① 이 법은 공포한 날부터 시행한다. 다만, 부칙 제5조에 따라 개정되는 법률 중 이 법 시행 전에 공포되었으나 시행일이 도래하지 아니한 법률을 개정한 부분은 각각 해당 법률의 시행일부터 시행한다.
제2조부터 제6조까지 생략
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force on the date of its promulgation: Provided, That any amendment to the Acts made pursuant to Article 5 of this Addenda, promulgated before this Act enters into force, which have not yet entered into force, shall enter into force on the date the corresponding Act takes effect.
Articles 2 through 6 Omitted.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Article 2 (Transitional Measures concerning Terms of Office of Commissioners)
The term of office of the Commissioners of the Protection Commission appointed under the previous provisions as at the time this Act enters into force, shall be deemed expired on the date preceding the enforcement date of this Act.
Article 3 (Transitional Measures concerning Business Affairs Following Adjustment of Functions)
(1) Among the business affairs of the Korea Communications Commission under Article 11 (1) of the Act on the Establishment and Operation of Korea Communications Commission as at the time this Act enters into force, those relating to personal information protection shall be transferred to the Protection Commission.
(2) Among the business affairs of the Minister of the Interior and Safety as at the time this Act enters into force, those pursuant to the amended provisions in Article 7-8 shall be assumed by the Protection Commission.
(3) Among the notifications, administrative dispositions and other acts of the Minister of the Interior and Safety, and acts conducted with respect to the Minister of the Interior and Safety such as filing of an application or report before this Act enters into force, those relating to matters for which competent authority is transferred from the Minister of the Interior and Safety to the Protection Commission shall be deemed to be the acts of, or acts conducted with respect to, the Protection Commission.
(4) Among the notifications, administrative dispositions and other acts of the Korea Communications Commission, and acts conducted with respect to the Korea Communications Commission such as filing of a report before this Act enters into force, those relating to matters for which competent authority is transferred from the Korea Communications Commission to the Protection Commission shall be deemed to be the acts of, or acts conducted with respect to, the Protection Commission pursuant to this Act.
(5) Among the public officials of the Ministry of the Interior and Safety or the Korea Communications Commission as at the time this Act enters into force, those prescribed by Presidential Decree shall be deemed to be the public officials of the Protection Commission pursuant to this Act.
Article 4 (Transitional Measures concerning the Protection Commission)
(1) The acts of, or acts conducted with respect to, the Protection Commission pursuant to the previous provisions as at the time this Act enters into force shall be deemed to be the acts of, or acts conducted with respect to, the Protection Commission pursuant to this Act.
Article 5 (Transitional Measures concerning Certifying Organizations for Personal Information Protection Management System)
(1) Entities designated as a certifying or examining organization pursuant to Article 47-3 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (hereinafter referred to as the “Network Act”) as at the time this Act enters into force, shall be deemed to have been designated as a specialized organization in accordance with Article 32-2 of this Act.
(2) Entities certified for personal information protection management system or qualified as a certification examiner pursuant to Article 47-3 of the Network Act as of the effective date of this Act shall be deemed to have been certified for personal information protection management system or qualified as a certification examiner pursuant to Article 32-2 of this Act.
Article 6 (Transitional Measures concerning Delegation or Entrustment of Authority)
The Special Metropolitan City Mayor, a Metropolitan City Mayor, a Do Governor, the Special Self-Governing Province Governor, the Special Self-Governing City Mayor or specialized institutions who have been delegated or entrusted with part of the authority of the Minister of the Interior and Safety pursuant to the previous provisions as of the effective date of this Act shall be deemed to have been delegated or entrusted with part of the authority of the Protection Commission pursuant to this Act.
Article 7 (Transitional Measures concerning Penalty Provisions)
The previous provisions on penalty provisions and administrative fines shall apply to acts done before this Act enters into force.
Article 8 (Transitional Measures concerning Imposition of Charges for Compelling Compliance)
Imposition of penalty surcharges on acts that were committed before this Act enters into force shall be governed by the previous provisions.
Article 9 Omitted.
Article 10 (Relationship to Other Statutes or Regulations)
(1) When other statutes or regulations (including statutes or regulations that were promulgated before this Act enters into force but the enforcement date of which has not arrived yet) state the “Korea Communications Commission” or “Chairperson of the Korea Communications Commission” in relation to the business affairs of the Korea Communications Commission and the Ministry of the Interior and Safety that is transferred to the Protection Commission according to this Act as at the time this Act enters into force, such terms are regarded as the “Protection Commission” or “Chairperson of the Protection Commission” as applicable; “public officials of the Korea Communications Commission” as “public officials of the Protection Commission;” “Ministry of the Interior and Safety” or “Minister of the Interior and Safety” as “Protection Commission” or “Chairperson of the Protection Commission” as applicable; and “public officials of the Ministry of the Interior and Safety” as “public officials of the Protection Commission”.
(2) If other statutes or regulations quote the previous Network Act or provisions therein as at the time this Act enters into force, and if there is any corresponding provision in this Act, such statutes or the provisions therein are regarded as this Act or provisions of this Act.
부칙 <제16930호, 2020. 2. 4.>
제1조(시행일)
이 법은 공포 후 6개월이 경과한 날부터 시행한다.
제2조(위원 임기에 관한 경과조치)
이 법 시행 당시 종전의 규정에 따라 임명된 보호위원회의 위원의 임기는 이 법 시행 전날 만료된 것으로 본다.
제3조(기능조정에 따른 소관 사무 등에 관한 경과조치)
① 이 법 시행 당시 「방송통신위원회의 설치 및 운영에 관한 법률」 제11조제1항의 방송통신위원회의 소관사무 중 개인정보 보호에 해당하는 사무는 보호위원회가 승계한다.
② 이 법 시행 당시 행정안전부장관의 소관 사무 중 제7조의8의 개정규정에 따른 사무는 보호위원회가 승계한다.
③ 이 법 시행 전에 행정안전부장관이 행한 고시ㆍ행정처분, 그 밖에 행정안전부장관의 행위와 행정안전부장관에 대한 신청ㆍ신고, 그 밖의 행위 중 그 소관이 행정안전부장관으로부터 보호위원회로 이관되는 사항에 관한 행위는 보호위원회의 행위 또는 보호위원회에 대한 행위로 본다.
④ 이 법 시행 전에 방송통신위원회가 행한 고시ㆍ행정처분, 그 밖의 행위와 신고 등 방송통신위원회에 대한 행위 중 그 소관이 방송통신위원회에서 보호위원회로 이관되는 사항에 관한 행위는 이 법에 따른 보호위원회의 행위 또는 보호위원회에 대한 행위로 본다.
⑤ 이 법 시행 당시 행정안전부ㆍ방송통신위원회 소속 공무원 중 대통령령으로 정하는 공무원은 이 법에 따른 보호위원회 소속 공무원으로 본다.
제4조(보호위원회에 관한 경과조치)
① 이 법 시행 당시 종전의 규정에 따른 보호위원회의 행위나 보호위원회에 대한 행위는 이 법에 따른 보호위원회의 행위나 보호위원회에 대한 행위로 본다.
제5조(개인정보보호 관리체계 인증기관 등에 관한 경과조치)
① 이 법 시행 당시 「정보통신망 이용촉진 및 정보보호 등에 관한 법률」(이하 "「정보통신망법」"이라 한다) 제47조의3에 따라 인증기관 또는 심사기관으로 지정받은 자는 이 법 제32조의2에 따라 전문기관으로 지정받은 것으로 본다.
② 이 법 시행 당시 「정보통신망법」 제47조의3에 따라 개인정보보호 관리체계 인증을 받거나 인증심사원 자격을 부여받은 자는 이 법 제32조의2에 따라 개인정보보호 관리체계 인증을 받거나 인증심사원 자격을 부여받은 것으로 본다.
제6조(권한의 위임ㆍ위탁에 관한 경과조치)
이 법 시행 당시 종전의 규정에 따라 행정안전부장관의 권한 일부를 위임 또는 위탁받은 특별시장, 광역시장, 도지사, 특별자치도지사, 특별자치시장 또는 전문기관은 이 법에 따라 보호위원회의 권한 일부를 위임 또는 위탁받은 것으로 본다.
제7조(벌칙 및 과태료에 관한 경과조치)
이 법 시행 전의 행위에 대한 벌칙 및 과태료의 적용은 종전의 규정에 따른다.
제8조(과징금 부과에 관한 경과조치)
이 법 시행 전에 종료된 행위에 대한 과징금의 부과는 종전의 규정에 따른다.
제9조 생략
제10조(다른 법령과의 관계)
① 이 법 시행 당시 다른 법령(이 법 시행 전에 공포되었으나 시행일이 도래하지 아니한 법령을 포함한다)에서 이 법에 따라 보호위원회가 승계하는 방송통신위원회 및 행정안전부의 사무와 관련하여 "방송통신위원회" 또는 "방송통신위원회 위원장"을 인용한 경우에는 그 법령에서 규정한 내용에 따라 "보호위원회" 또는 "보호위원회 위원장"을 인용한 것으로, "방송통신위원회 소속 공무원"을 인용한 경우에는 "보호위원회 소속 공무원"을 인용한 것으로 보며, "행정안전부" 또는 "행정안전부장관"을 인용한 경우에는 그 법령에서 규정한 내용에 따라 "보호위원회" 또는 "보호위원회 위원장"을 인용한 것으로, "행정안전부 소속 공무원"을 인용한 경우에는 "보호위원회 소속 공무원"을 인용한 것으로 본다.
② 이 법 시행 당시 다른 법령에서 종전의 「정보통신망법」 또는 그 규정을 인용하고 있는 경우 이 법에 그에 해당하는 규정이 있는 때에는 이 법 또는 이 법의 해당 규정을 인용한 것으로 본다.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation.
Article 2 (Transitional Measures concerning Terms of Office of Commissioners)
The term of office of the Commissioners of the Protection Commission appointed under the previous provisions as at the time this Act enters into force, shall be deemed expired on the date preceding the enforcement date of this Act.
Article 3 (Transitional Measures concerning Business Affairs Following Adjustment of Functions)
(1) Among the business affairs of the Korea Communications Commission under Article 11 (1) of the Act on the Establishment and Operation of Korea Communications Commission as at the time this Act enters into force, those relating to personal information protection shall be transferred to the Protection Commission.
(2) Among the business affairs of the Minister of the Interior and Safety as at the time this Act enters into force, those pursuant to the amended provisions in Article 7-8 shall be assumed by the Protection Commission.
(3) Among the notifications, administrative dispositions and other acts of the Minister of the Interior and Safety, and acts conducted with respect to the Minister of the Interior and Safety such as filing of an application or report before this Act enters into force, those relating to matters for which competent authority is transferred from the Minister of the Interior and Safety to the Protection Commission shall be deemed to be the acts of, or acts conducted with respect to, the Protection Commission.
(4) Among the notifications, administrative dispositions and other acts of the Korea Communications Commission, and acts conducted with respect to the Korea Communications Commission such as filing of a report before this Act enters into force, those relating to matters for which competent authority is transferred from the Korea Communications Commission to the Protection Commission shall be deemed to be the acts of, or acts conducted with respect to, the Protection Commission pursuant to this Act.
(5) Among the public officials of the Ministry of the Interior and Safety or the Korea Communications Commission as at the time this Act enters into force, those prescribed by Presidential Decree shall be deemed to be the public officials of the Protection Commission pursuant to this Act.
Article 4 (Transitional Measures concerning the Protection Commission)
(1) The acts of, or acts conducted with respect to, the Protection Commission pursuant to the previous provisions as at the time this Act enters into force shall be deemed to be the acts of, or acts conducted with respect to, the Protection Commission pursuant to this Act.
Article 5 (Transitional Measures concerning Certifying Organizations for Personal Information Protection Management System)
(1) Entities designated as a certifying or examining organization pursuant to Article 47-3 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (hereinafter referred to as the “Network Act”) as at the time this Act enters into force, shall be deemed to have been designated as a specialized organization in accordance with Article 32-2 of this Act.
(2) Entities certified for personal information protection management system or qualified as a certification examiner pursuant to Article 47-3 of the Network Act as of the effective date of this Act shall be deemed to have been certified for personal information protection management system or qualified as a certification examiner pursuant to Article 32-2 of this Act.
Article 6 (Transitional Measures concerning Delegation or Entrustment of Authority)
The Special Metropolitan City Mayor, a Metropolitan City Mayor, a Do Governor, the Special Self-Governing Province Governor, the Special Self-Governing City Mayor or specialized institutions who have been delegated or entrusted with part of the authority of the Minister of the Interior and Safety pursuant to the previous provisions as of the effective date of this Act shall be deemed to have been delegated or entrusted with part of the authority of the Protection Commission pursuant to this Act.
Article 7 (Transitional Measures concerning Penalty Provisions)
The previous provisions on penalty provisions and administrative fines shall apply to acts done before this Act enters into force.
Article 8 (Transitional Measures concerning Imposition of Charges for Compelling Compliance)
Imposition of penalty surcharges on acts that were committed before this Act enters into force shall be governed by the previous provisions.
Article 9 Omitted.
Article 10 (Relationship to Other Statutes or Regulations)
(1) When other statutes or regulations (including statutes or regulations that were promulgated before this Act enters into force but the enforcement date of which has not arrived yet) state the “Korea Communications Commission” or “Chairperson of the Korea Communications Commission” in relation to the business affairs of the Korea Communications Commission and the Ministry of the Interior and Safety that is transferred to the Protection Commission according to this Act as at the time this Act enters into force, such terms are regarded as the “Protection Commission” or “Chairperson of the Protection Commission” as applicable; “public officials of the Korea Communications Commission” as “public officials of the Protection Commission;” “Ministry of the Interior and Safety” or “Minister of the Interior and Safety” as “Protection Commission” or “Chairperson of the Protection Commission” as applicable; and “public officials of the Ministry of the Interior and Safety” as “public officials of the Protection Commission”.
(2) If other statutes or regulations quote the previous Network Act or provisions therein as at the time this Act enters into force, and if there is any corresponding provision in this Act, such statutes or the provisions therein are regarded as this Act or provisions of this Act.
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions below shall enter into force on the dates classified as follows:
1. The amended provisions of Articles 11-2, 31, 35-3, 37-2, 39-7, subparagraph 5 of Article 60, Article 75 (2) 16, 20, 21, and 24, and Article 75 (4) 1 and 9: The date one year elapses after the date of promulgation of this Act;
2. The amended provisions of Article 35-2: The date prescribed by Presidential Decree within two years from the date on which one year elapses after the date of promulgation of this Act.
Article 2 (Special Cases concerning Data Divulgence Notification and Report)
The amended provisions of Article 34 shall begin to apply where a personal information controller becomes aware that personal information has been divulged after the date this Act enters into force.
Article 3 (Applicability to Submission of Materials and Confidentiality Order in Action for Damages)
The amended provisions of Article 39-3 through 39-6 shall begin to apply where a personal information controller files a lawsuit seeking damages after the date this Act enters into force.
Article 4 (Applicability to Dispute Mediation)
The amended provisions of Articles 43 (3), 45 (2) through (4), 45-2, and 47 (3) and (4) shall begin to apply where an application or request for dispute mediation or collective dispute mediation is filed after the date this Act enters into force.
Article 5 (Applicability to Partial Exemption to Application)
The amended provisions of Article 58 shall begin to apply where personal information is processed after the date this Act enters into force.
Article 6 (Applicability to Publication of Results)
The amended provisions of Article 66 (2) shall begin to apply where a person commits an act subject to a recommendation for improvement under Article 61, an order to take corrective measures under Article 64, an accusation or recommendation to take disciplinary actions under Article 65, or the imposition of administrative fines under Article 75 after the date this Act enters into force.
Article 7 (Applicability to Annual Reporting)
The amended provisions of Article 67 shall begin to apply to reports prepared in the year following the year in which this Act enters into force.
Article 8 (Transitional Measures concerning Imposition of Penalty Surcharges)
(1) Notwithstanding the amended provisions of Article 64-2, the amended provisions of Articles 28-6, 34-2, and 39-15 shall apply to the imposition of penalty surcharges for violations which have been completed before this Act enters into force.
(2) The imposition of a penalty surcharge against an act of violation which has not been completed as at the time this Act enters into force shall be governed by the amended provisions of Article 64-2.
Article 9 (Transitional Measures concerning Registration of Personal Information Files)
The head of a public institution that operates personal information files that contain the personal information referred to in the previous Article 58 (1) 1 at the time this Act enters into force shall register the relevant personal information files with the Protection Commission in accordance with the amended provisions of Article 32 within 60 days from the date this Act enters into force.
Article 10 (Transitional Measures concerning Privacy Impact Assessment)
The head of a public institution that operates personal information files that contain personal information under the previous Article 58 (1) 1 as at the time this Act enters into force (limited to personal information files subject to the privacy impact assessment under Article 33 (1)) shall conduct a privacy impact assessment within two years after the enforcement date of this Act and submit the result thereof to the Protection Commission.
Article 11 Omitted.
부칙 <제19234호, 2023. 3. 14.>
제1조(시행일)
이 법은 공포 후 6개월이 경과한 날부터 시행한다. 다만, 다음 각 호의 개정규정은 각 호의 구분에 따른 날부터 시행한다.
1. 제11조의2, 제31조, 제35조의3, 제37조의2, 제39조의7, 제60조제5호, 제75조제2항제16호ㆍ제20호ㆍ제21호ㆍ제24호 및 같은 조 제4항제1호ㆍ제9호의 개정규정: 공포 후 1년이 경과한 날
2. 제35조의2의 개정규정: 공포 후 1년이 경과한 날부터 공포 후 2년이 넘지 아니하는 범위에서 대통령령으로 정하는 날
제2조(개인정보 유출 등의 통지ㆍ신고에 관한 적용례)
제34조의 개정규정은 이 법 시행 이후 개인정보가 분실ㆍ도난ㆍ유출되었음을 알게 된 경우부터 적용한다.
제3조(손해배상청구소송에서 자료의 제출 및 비밀유지 명령 등에 관한 적용례)
제39조의3부터 제39조의6까지의 개정규정은 이 법 시행 이후 손해배상청구의 소를 제기하는 경우부터 적용한다.
제4조(분쟁조정에 관한 적용례)
제43조제3항, 제45조제2항부터 제4항까지, 제45조의2 및 제47조제3항ㆍ제4항의 개정규정은 이 법 시행 이후 분쟁조정 또는 집단분쟁조정이 신청되거나 의뢰되는 경우부터 적용한다.
제5조(적용의 일부 제외에 관한 적용례)
제58조의 개정규정은 이 법 시행 이후 개인정보를 처리하는 경우부터 적용한다.
제6조(결과의 공표에 관한 적용례)
제66조제2항의 개정규정은 이 법 시행 이후 제61조에 따른 개선권고, 제64조에 따른 시정조치 명령, 제64조의2에 따른 과징금의 부과, 제65조에 따른 고발 또는 징계권고 및 제75조에 따른 과태료 부과 처분의 대상이 되는 행위를 한 경우부터 적용한다.
제7조(연차보고에 관한 적용례)
제67조의 개정규정은 이 법 시행 이후 그 다음 연도에 작성하는 보고서부터 적용한다.
제8조(과징금 부과에 관한 경과조치 등)
① 이 법 시행 전에 종료된 위반행위에 대한 과징금의 부과는 제64조의2의 개정규정에도 불구하고 종전의 제28조의6, 제34조의2 및 제39조의15에 따른다.
② 이 법 시행 당시 종료되지 아니한 위반행위에 대한 과징금의 부과는 제64조의2의 개정규정에 따른다.
제9조(개인정보파일의 등록에 관한 경과조치)
이 법 시행 당시 종전의 제58조제1항제1호에 따른 개인정보가 포함된 개인정보파일을 운용하고 있는 공공기관의 장은 이 법 시행일부터 60일 이내에 해당 개인정보파일을 제32조의 개정규정에 따라 보호위원회에 등록을 하여야 한다.
제10조(개인정보 영향평가에 관한 경과조치)
이 법 시행 당시 종전의 제58조제1항제1호에 따른 개인정보가 포함된 개인정보파일(제33조제1항에 따른 영향평가의 대상이 되는 개인정보파일에 한정한다)을 운용하고 있는 공공기관의 장은 이 법 시행일부터 2년 이내에 영향평가를 실시하고 그 결과를 보호위원회에 제출하여야 한다.
제11조 생략
ADDENDA
Article 1 (Enforcement Date)
This Act shall enter into force six months after the date of its promulgation: Provided, That the amended provisions below shall enter into force on the dates classified as follows:
1. The amended provisions of Articles 11-2, 31, 35-3, 37-2, 39-7, subparagraph 5 of Article 60, Article 75 (2) 16, 20, 21, and 24, and Article 75 (4) 1 and 9: The date one year elapses after the date of promulgation of this Act;
2. The amended provisions of Article 35-2: The date prescribed by Presidential Decree within two years from the date on which one year elapses after the date of promulgation of this Act.
Article 2 (Special Cases concerning Data Divulgence Notification and Report)
The amended provisions of Article 34 shall begin to apply where a personal information controller becomes aware that personal information has been divulged after the date this Act enters into force.
Article 3 (Applicability to Submission of Materials and Confidentiality Order in Action for Damages)
The amended provisions of Article 39-3 through 39-6 shall begin to apply where a personal information controller files a lawsuit seeking damages after the date this Act enters into force.
Article 4 (Applicability to Dispute Mediation)
The amended provisions of Articles 43 (3), 45 (2) through (4), 45-2, and 47 (3) and (4) shall begin to apply where an application or request for dispute mediation or collective dispute mediation is filed after the date this Act enters into force.
Article 5 (Applicability to Partial Exemption to Application)
The amended provisions of Article 58 shall begin to apply where personal information is processed after the date this Act enters into force.
Article 6 (Applicability to Publication of Results)
The amended provisions of Article 66 (2) shall begin to apply where a person commits an act subject to a recommendation for improvement under Article 61, an order to take corrective measures under Article 64, an accusation or recommendation to take disciplinary actions under Article 65, or the imposition of administrative fines under Article 75 after the date this Act enters into force.
Article 7 (Applicability to Annual Reporting)
The amended provisions of Article 67 shall begin to apply to reports prepared in the year following the year in which this Act enters into force.
Article 8 (Transitional Measures concerning Imposition of Penalty Surcharges)
(1) Notwithstanding the amended provisions of Article 64-2, the amended provisions of Articles 28-6, 34-2, and 39-15 shall apply to the imposition of penalty surcharges for violations which have been completed before this Act enters into force.
(2) The imposition of a penalty surcharge against an act of violation which has not been completed as at the time this Act enters into force shall be governed by the amended provisions of Article 64-2.
Article 9 (Transitional Measures concerning Registration of Personal Information Files)
The head of a public institution that operates personal information files that contain the personal information referred to in the previous Article 58 (1) 1 at the time this Act enters into force shall register the relevant personal information files with the Protection Commission in accordance with the amended provisions of Article 32 within 60 days from the date this Act enters into force.
Article 10 (Transitional Measures concerning Privacy Impact Assessment)
The head of a public institution that operates personal information files that contain personal information under the previous Article 58 (1) 1 as at the time this Act enters into force (limited to personal information files subject to the privacy impact assessment under Article 33 (1)) shall conduct a privacy impact assessment within two years after the enforcement date of this Act and submit the result thereof to the Protection Commission.
Article 11 Omitted.
Last updated : 2023-10-25