ENFORCEMENT DECREE OF THE DIGITAL SIGNATURE ACT
Presidential Decree No. 16457, jun. 30, 1999
Amended by Presidential Decree No. 17625, jun. 10, 2002
Presidential Decree No. 18312, Mar. 17, 2004
Presidential Decree No. 19507, jun. 12, 2006
Presidential Decree No. 19570, jun. 29, 2006
Presidential Decree No. 20741, Feb. 29, 2008
Presidential Decree No. 20917, Jul. 17, 2008
Presidential Decree No. 22016, Feb. 4, 2010
Presidential Decree No. 22151, May 4, 2010
Presidential Decree No. 22846, Apr. 5, 2011
Presidential Decree No. 23898, jun. 29, 2012
Presidential Decree No. 24425, Mar. 23, 2013
Presidential Decree No. 25050, Dec. 30, 2013
Presidential Decree No. 25406, jun. 30, 2014
Presidential Decree No. 25532, Aug. 6, 2014
Presidential Decree No. 25840, Dec. 9, 2014
Presidential Decree No. 26166, Mar. 30, 2015
Presidential Decree No. 26980, Feb. 12, 2016
Presidential Decree No. 27751, Dec. 30, 2016
Presidential Decree No. 27960, Mar. 27, 2017
Presidential Decree No. 28210, Jul. 26, 2017
The purpose of this Decree is to provide for the matters delegated by the Digital Signature Act and other matters necessary for enforcing the said Act. <Amended by Presidential Decree No. 22016, Feb. 4, 2010>
| Article 2 (Standards for Designation of Licensed Certification Authorities) |
| (1) | The technical and financial capabilities, facilities, equipment, and other necessary matters that must be satisfied by an entity seeking designation as a licensed certification authority under Article 4 (3) of the Digital Signature Act (hereinafter referred to as the "Act") shall be as follows: Provided, That in cases of designation of a State agency or local government as a licensed certification authority, the financial capability referred to in subparagraph 2 shall not apply: <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 22016, Feb. 4, 2010; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 25406, Jun. 30, 2014; Presidential Decree No. 26166, Mar. 30, 2015; Presidential Decree No. 28210, Jul. 26, 2017> |
| 1. | Technical capability: At least 12 staff members in charge of operating facilities and equipment necessary to conduct certification work (hereinafter referred to as "certification work") who satisfy the following requirements: |
| (a) | Holding national technical qualifications as an information and communications technician, information processing technician, computer operations technician or higher, or holding other equivalent qualifications recognized by the Minister of Science and ICT; |
| (b) | Having served for at least two years in the field of information protection or the operation and management of information and communications determined and publicly notified by the Minister of Science and ICT; |
| 2. | Financial capability: Capital amount of at least five billion won; |
| 3. | Facilities and equipment: The following systems: |
| (a) | System for managing subscriber registration information; |
| (b) | System for creating and managing digital-signature-creating keys and digital-signature-verifying keys; |
| (c) | System for creating, issuing, and managing authorized certificates; |
| (d) | System for stamping the time electronic messages are presented to the licensed certification authority; |
| (e) | Protection system for ensuring the safe operation of facilities and equipment for certification work; |
| (f) | System made available to subscribers by the licensed certification authority as regards its authorized certification services; |
| 4. | Bylaws that provide the procedures and methods for managing and operating the systems referred to in subparagraph 3 (a) through (e); |
| 5. | Having digital signature technology which satisfies all of the requirements under the items of subparagraph 3 of Article 2 of the Act. |
| (2) | Detailed matters regarding the facilities and equipment and bylaws under paragraph (1) 3 and 4 shall be determined and publicly notified by the Minister of Science and ICT. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
[This Article Wholly Amended by Presidential Decree No. 17625, Jun. 10, 2002]
| Article 2-2 (Preliminary Examination of Designation of Licensed Certification Authorities) |
| (1) | Any person who intends to obtain designation as a licensed certification authority under Article 4 of the Act shall file with the Minister of Science and ICT an application for preliminary examination of whether his/her digital signature technology meets all of the requirements under the items of subparagraph 3 of Article 2 of the Act pursuant to Article 30 (1) of the Civil Petitions Treatment Act (hereinafter referred to as "preliminary examination"), before filing an application for designation under Article 3 (1). <Amended by Presidential Decree No. 26980, Feb. 12, 2016; Presidential Decree No. 28210, Jul. 26, 2017> |
| (2) | Any person who intends to file an application for preliminary examination shall submit documents proving that the requirements under the items of subparagraph 3 of Article 2 of the Act are satisfied. |
| (3) | Upon receipt of an application for preliminary examination, the Minister of Science and ICT shall examine such application and notify the applicant of the results in writing. <Amended by Presidential Decree No. 28210, Jul. 26, 2017> |
| (4) | The Minister of Science and ICT may, if deemed necessary to conduct preliminary examination, hear the opinions of the applicant, related experts, etc. <Amended by Presidential Decree No. 28210, Jul. 26, 2017> |
[This Article Newly Inserted by Presidential Decree No. 25406, Jun. 30, 2014]
| Article 3 (Procedures for Designation of Licensed Certification Authorities) |
| (1) | Any entity that seeks designation as a licensed certification authority under Article 4 of the Act shall file an application for designation as a licensed certification authority (including an application prepared in electronic form) with the Minister of Science and ICT, along with the following documents (including electronic messages): <Amended by Presidential Decree No. 18312, Mar. 17, 2004; Presidential Decree No. 19507, Jun. 12, 2006; Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 22016, Feb. 4, 2010; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| 1. | A basic certificate of registration for the representative and executive officers of the corporation; |
| 2. | The articles of incorporation; |
| 3. | Documentary evidence verifying that the technical and financial capabilities, facilities and equipment, and other required matters under Article 2 (1) are met; |
| (2) | Upon receipt of an application for designation under paragraph (1), the Minister of Science and ICT shall examine the following. In such cases, if a preliminary examination is conducted under Article 2-2, he/she shall consider the results thereof: <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 25406, Jun. 30, 2014; Presidential Decree No. 28210, Jul. 26, 2017> |
| 1. | Whether the technical and financial capabilities, facilities and equipment, and other necessary matters under Article 2 (1) are satisfied; |
| 2. | If the applicant is a corporation, whether it falls under any ground for disqualification under Article 5 of the Act. |
| (3) | When deemed necessary to conduct examination under paragraph (2), the Minister of Science and ICT may either require the applicant to submit materials or seek the applicant’s opinion. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| (4) | When, as a result of an examination under paragraph (1), the application is found consistent with the provisions of each subparagraph of the said paragraph, the Minister of Science and ICT shall issue to the applicant a certificate of designation as a licensed certification authority. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| (5) | If the Minister of Science and ICT designates a State agency or local government as a licensed certification authority, he/she shall pre-consult with the heads of competent agencies thereabout. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| (6) | If the Minister of Science and ICT has designated an entity as a licensed certification authority, he/she shall publicly notify such fact, as prescribed by Ordinance of the Ministry of Science and ICT. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| (7) | Upon receipt of an application for designation under paragraph (1), the Minister of Science and ICT shall check a certified copy of the corporate registry by accessing joint administrative information under Article 36 (1) of the Electronic Government Act: <Newly Inserted by Presidential Decree No. 19507, Jun. 12, 2006; Presidential Decree No. 20917, Jul. 17, 2008; Presidential Decree No. 22016, Feb. 4, 2010; Presidential Decree No. 22151, May 4, 2010; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
1 and 2. Deleted. <by Presidential Decree No. 22016, Feb. 4, 2010>
[This Article Wholly Amended by Presidential Decree No. 17625, Jun. 10, 2002]
| Article 3-2 (Period of Validity of Designation) |
The designation of a licensed certification authority shall be valid for three years from the date of designation. <Amended by Presidential Decree No. 20917, Jul. 17, 2008>
[This Article Wholly Amended by Presidential Decree No. 17625, Jun. 10, 2002]
| Article 3-3 (Renewal of Designation) |
| (1) | If an entity designated as a licensed certification authority seeks to have its designation renewed, it shall file an application for designation as a licensed certification authority (including an application prepared in electronic form) with the Minister of Science and ICT, along with the documents (including electronic documents) specified in Article 3 (1) 2, by not later than 30 days before the date the valid period of its designation expires. <Amended by Presidential Decree No. 18312, Mar. 17, 2004; Presidential Decree No. 19507, Jun. 12, 2006; Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 27751, Dec. 30, 2016; Presidential Decree No. 28210, Jul. 26, 2017> |
| (2) | The Minister of Science and ICT shall give notice to an entity designated as a licensed certification authority of both the procedures for renewing its designation and the fact that the period of validity of its designation will expire in the absence of an application for such renewal within the period fixed under paragraph (1), by not later than 60 days before the date the period of validity expires. <Newly Inserted by Presidential Decree No. 23898, Jun. 29, 2012; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| (3) | Upon receipt of an application for renewal of designation under paragraph (1), the Minister of Science and ICT shall examine the following: <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 23898, Jun. 29, 2012; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| 1. | Whether the entity has faithfully made a report on its rules of authorized certification work under Article 6 of the Act or on the modification thereof; |
| 3. | Whether the entity has faithfully complied with the provisions of the Act and this Decree. |
| (4) | If, as a result of the examination under paragraph (3), an application for renewed designation is deemed to conform to the provisions of each subparagraph of the said paragraph, the Minister of Science and ICT shall issue a certificate of designation. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 23898, Jun. 29, 2012; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 27751, Dec. 30, 2016; Presidential Decree No. 28210, Jul. 26, 2017> |
| (5) | Upon renewal of the designation of a licensed certification authority, the Minister of Science and ICT shall publicly announce such fact, as prescribed by Ordinance of the Ministry of Science and ICT. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 23898, Jun. 29, 2012; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| (6) | Article 3 (7) shall apply mutatis mutandis to the procedures for applying for renewal of designation under paragraph (1). <Newly Inserted by Presidential Decree No. 19507, Jun. 12, 2006; Presidential Decree No. 23898, Jun. 29, 2012> |
[This Article Newly Inserted by Presidential Decree No. 17625, Jun. 10, 2002]
| Article 3-4 (Public Notice of Suspension of Certification Work and Revocation of Designation) |
If the Minister of Science and ICT suspends the certification work of a licensed certification authority or revokes the designation thereof under Article 12 (1) of the Act, he/she shall publicly notify such fact, as prescribed by Ordinance of the Ministry of Science and ICT. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> [This Article Newly Inserted by Presidential Decree No. 17625, Jun. 10, 2002]
| Article 4 (Independence of Certification Work) |
Each licensed certification authority shall maintain independence from its subscribers who use authorized certificates issued by the authority, so as to ensure that its certification work is preformed in a sound and reliable manner. <Amended by Presidential Decree No. 17625, Jun. 10, 2002>
| Article 4-2 (Offenses Subject to Imposition of Penalty Surcharges) |
| (1) | The types of offenses subject to the imposition of penalty surcharges and the amounts of such penalty surcharges according to the types of offenses under Article 13 (2) of the Act shall be as set forth in attached Table 1. <Amended by Presidential Decree No. 22846, Apr. 5, 2011> |
| (2) | The Minister of Science and ICT may raise or reduce an amount of a penalty surcharge under paragraph (1) by up to 1/2 thereof in consideration of the nature, frequency, etc. of offenses. In such cases, even in the event the amount of a penalty surcharge is raised, the total amount of the penalty surcharge may not exceed 20 million won. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
| (3) | Necessary matters regarding the imposition, payment, etc. of penalty surcharges under paragraphs (1) and (2) shall be prescribed by Ordinance of the Ministry of Science and ICT. <Amended by Presidential Decree No. 20741, Feb. 29, 2008; Presidential Decree No. 24425, Mar. 23, 2013; Presidential Decree No. 28210, Jul. 26, 2017> |
[This Article Newly Inserted by Presidential Decree No. 19570, Jun. 29, 2006]
| Article 4-3 (Processing of Personally Identifiable Information) |
[This Article Newly Inserted by Presidential Decree No. 25532, Aug. 6, 2014]
[Previous Article 4-3 moved to Article 4-4]
| Article 4-4 (Re-Examination of Regulation) |
| (1) | The Minister of Science and ICT shall examine the appropriateness of the standards for designation of a licensed certification authority under Article 2 every three years, counting from January 1, 2014 (referring to the period that ends on the day before January 1 of every third year) and take measures, such as making improvement. <Amended by Presidential Decree No. 25840, Dec. 9, 2014; Presidential Decree No. 28210, Jul. 26, 2017> |
| (2) | The Minister of Science and ICT shall examine the appropriateness of the following matters every three years, counting from each of the following base dates (referring to the period that ends on the day before each base date of every third year) and take measures, such as making improvement: <Newly Inserted by Presidential Decree No. 25840, Dec. 9, 2014; Presidential Decree No. 27751, Dec. 30, 2016; Presidential Decree No. 28210, Jul. 26, 2017> |
| 1. | Procedures for designation of a licensed certification authority under Article 3: January 1, 2017; |
| 2. | Valid period of designation as a licensed certification authority under Article 3-2: January 1, 2017; |
| 3. | Renewal of designation as a licensed certification authority under Article 3-3: January 1, 2017. |
[This Article Newly Inserted by Presidential Decree No. 25050, Dec. 30, 2013]
[Moved from Article 4-3]
| Articles 4-5 through 4-7 Deleted. <by Presidential Decree No. 22016, Feb. 4, 2010> |
| Article 5 (Standards for Imposition of Administrative Fines) |
The standards for imposition of administrative fines under Article 34 (1) of the Act shall be as set forth in attached Table 2. [This Article Newly Inserted by Presidential Decree No. 22846, Apr. 5, 2011]
| Article 6 Deleted. <by Presidential Decree No. 20917, Jul. 17, 2008> |
ADDENDUM
This Decree shall enter into force on July 1, 1999.
ADDENDA <Presidential Decree No. 17625, Jun. 10, 2002>
| (1) | (Enforcement Date) This Decree shall enter into force on the date of its promulgation. |
ADDENDUM <Presidential Decree No. 18312, Mar. 17, 2004>
This Decree shall enter into force on the date of its promulgation.
ADDENDUM <Presidential Decree No. 19507, Jun. 12, 2006>
This Decree shall enter into force on the date of its promulgation.
ADDENDUM <Presidential Decree No. 19570, Jun. 29, 2006>
This Decree shall enter into force on July 1, 2006.
ADDENDA <Presidential Decree No. 20741, Feb. 29, 2008>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation. (Proviso Omitted.)
Articles 2 through 6 Omitted.
ADDENDA <Presidential Decree No. 20917, Jul. 17, 2008>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Article 2 (Applicability to Period of Validity of Designation for Licensed Certification Authorities)
The amended provisions of Article 3-2 shall apply to any entities designated or re-designated as licensed certification authorities on and after the enforcement date of this Decree.
ADDENDA <Presidential Decree No. 22016, Feb. 4, 2010>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Article 2 Omitted.
ADDENDA <Presidential Decree No. 22151, May 4, 2010>
Article 1 (Enforcement Date)
This Decree shall enter into force on May 5, 2010.
Articles 2 through 4 Omitted.
ADDENDA <Presidential Decree No. 22846, Apr. 5, 2011>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Article 2 (Transitional Measures concerning Administrative Fines)
| (1) | In applying the standards for imposition of administrative fines for any offenses committed prior to the enforcement of this Decree, the previous provisions shall prevail, notwithstanding the amended provisions of attached Table 2. |
| (2) | The administrative fine imposed for any offense committed prior to the enforcement of this Decree shall not be included in the calculation of the number of offenses under the amended provisions of attached Table 2. |
ADDENDUM <Presidential Decree No. 23898, Jun. 29, 2012>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 24425, Mar. 23, 2013>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation: Provided, That the amendments to the Presidential Decrees to be amended pursuant to Article 6 of the Addenda, which were promulgated before this Decree enters into force but the enforcement dates of which have yet to arrive, shall enter into force on the date the relevant Presidential Decree enters into force.
Articles 2 through 6 Omitted.
ADDENDUM <Presidential Decree No. 25050, Dec. 30, 2013>
This Decree shall enter into force on January 1, 2014. (Proviso Omitted.)
ADDENDUM <Presidential Decree No. 25406, Jun. 30, 2014>
This Decree shall enter into force on the date of its promulgation.
ADDENDUM <Presidential Decree No. 25532, Aug. 6, 2014>
This Decree shall enter into force on August 7, 2014.
ADDENDA <Presidential Decree No. 25840, Dec. 9, 2014>
Article 1 (Enforcement Date)
This Decree shall enter into force on January 1, 2015.
Articles 2 through 16 Omitted.
ADDENDUM <Presidential Decree No. 26166, Mar. 30, 2015>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 26980, Feb. 12, 2016>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Articles 2 through 5 Omitted.
ADDENDA <Presidential Decree No. 27751, Dec. 30, 2016>
Article 1 (Enforcement Date)
This Decree shall enter into force on January 1, 2017. (Proviso Omitted.)
Articles 2 through 12 Omitted.
ADDENDUM <Presidential Decree No. 27960, Mar. 27, 2017>
This Decree shall enter into force on March 30, 2017. (Proviso Omitted.)
ADDENDA <Presidential Decree No. 28210, Jul. 26, 2017>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Articles 2 through 6 Omitted.