E-book보기 | 대한민국영문법령

이북보기
검색 검색	페이지이동 Article		프린트 목차 연혁

STATUTES

THE REPUBLIC OF KOREA

Volume

PERSONAL INFORMATION PROTECTION ACT

Act No. 10465, Mar. 29, 2011

Amended by Act No. 11690, Mar. 23, 2013

Act No. 11990, Aug. 6, 2013

Act No. 12504, Mar. 24, 2014

Act No. 12844, Nov. 19, 2014

Act No. 13423, Jul. 24, 2015

CHAPTER I GENERAL PROVISIONS

Article 1 (Purpose)

The purpose of this Act is to protect the freedom and rights of each individual and further realize the dignity and value of each individual, by prescribing matters related to the management and protection of personal information. <Amended by Act No. 12504, Mar. 24, 2014>

Article 2 (Definitions)

The terms used in this Act shall be defined as follows: <Amended by Act No. 12504, Mar. 24, 2014>

1. The term "personal information" means information that pertains to

Article 1 ~ 2

a living person, including the full name, resident registration number, images, etc., by which the individual in question can be identified, (including information by which the individual in question cannot be identified but can be identified through simple combination with other information);

2. The term "management" means to collect, create, link, interwork, record, save, hold, process, edit, search, output, correct, recover, use, provide, disclose, destroy personal information, and other acts similar thereto;

3. The term "owner of information" means a person who can be identified by the managed information and therefore is the owner of the given piece of information;

4. The term "personal information file" means an aggregate of personal information systematically arranged or organized according to a specific rule in order for the personal information to be readily retrievable;

5. The term "personal information manager" means a public institution, corporate body, organization, individual, etc. who manages personal information directly or via another person to administer personal information files as part of his/her duties;

6. The term "public institution" means any of the following institutions:

(a) The

Article 2

National Assembly, courts, institutions that perform administrative affairs of the National Election Commission, central administrative agencies (including agencies respectively under the direct jurisdiction of the President and the Prime Minister) and its affiliated agencies, and local governments;

(b) Other national agencies and public associations prescribed by Presidential Decree;

7. The term "image data processing equipment" means equipment prescribed by Presidential Decree that is permanently installed in a certain space to photograph the images, etc. of a person or object, or to transmit such images via a wired or wireless network.

Article 3 (Principles for Protecting Personal Information)

(1) Each personal information manager shall make the purpose of managing personal information clear, collect only the minimum personal information lawfully and legitimately, necessary for such purpose.

(2) Each personal information manager shall manage personal information within the appropriate extent necessary for achieving the purpose of managing the personal information, and not use it for the purposes other than intended ones.

(3) Each personal information manager shall endeavor to ensure the accuracy, completeness, and currency of personal information to the extent necessary for the purpose of managing the personal information.

Article 3

(4) Each personal information manager shall manage personal information safely, in consideration of the risk that the rights of an owner of information may be infringed on and the level of accompanying risks depending on the management methods, kinds, etc. of personal information.

(5) Each personal information manager shall disclose to the general public matters concerning the management of personal information, including, but not limited to, personal information management policies, and guarantee the rights of an owner of information, such as the right to request perusal.

(6) Each personal information manager shall manage personal information by means that minimize any infringement of the privacy of an owner of information.

(7) Each personal information manager shall ensure that personal information is managed anonymously whenever possible.

(8) Each personal information manager shall endeavor to gain the trust of an owner of information by fulfilling his/her responsibilities and obligations conferred or imposed by or under this Act, relevant statutes.

Article 4 (Rights of Owners of Information)

An owner of information has the following rights in connection with the management of his/her personal information:

1. A right to

Article 4

receive information concerning the management of personal information;

2. A right to choose and decide whether he/she consents to the management of his/her personal information, the scope of consent, and related matters;

3. A right to verify whether personal information is managed and to request access to personal information (including issuance of a certified copy; hereinafter the same shall apply);

4. A right to request the suspension, correction, deletion and destruction of personal information;

5. A right to receive relief from loss caused by the management of personal information according to prompt and fair procedures.

Article 5 (Responsibilities of State, etc.)

(1) The State and a local government shall devise policy measures to prevent any harmful effect caused by the collection of personal information for other than the intended purpose, the misuse, abuse, or thoughtless monitoring and tracking, etc. of personal information, thereby protecting human dignity and personal privacy.

(2) The State and a local government shall establish necessary policy measures, including but not limited to the improvement of statutes, in order to protect the rights of an owner of information under

Article 5

Article 4.

(3) The State and a local government shall respect, facilitate and support personal information protection activities that are voluntarily performed by personal information managers in order to improve irrational social practices in the management of personal information.

(4) Where the State and a local government enacts or amends statutes or municipal ordinances, it shall do so in compliance with the purpose of this Act.

Article 6 (Relationship to other Acts)

Unless otherwise provided in other Acts, the protection of personal information shall be governed by this Act. <Amended by Act No. 12504, Mar. 24, 2014>

CHAPTER II FORMULATION, ETC. OF PERSONAL INFORMATION PROTECTION POLICIES

Article 7 (Personal Information Protection Commission)

(1) A Personal Information Protection Commission (hereinafter referred to as the "Protection Commission") shall be established under the direct jurisdiction of the President to deliberate, and pass a resolution, on issues relating to the protection of personal information. The Protection Commission shall independently perform affairs under its authority.

Article 6 ~ 7

(2) The Protection Commission shall be comprised of not more than 15 members, including one Chairperson and one standing member, and the standing member shall be appointed as a public official in political service.

(3) The Chairperson shall be commissioned by the President from among non-public official members.

(4) Members shall be either appointed or commissioned by the President from among the following persons. In such cases, five members elected at the National Assembly and five members designated by the Chief Justice of the Supreme Court shall be respectively appointed or commissioned:

1. A person recommended by a civil society organization or consumer organization related to the protection of personal information;

2. A person recommended by an organization of business entities, the members of which are personal information managers;

3. Other persons who have knowledge about, and experience in, personal information.

(5) The term of office of the Chairperson or the members shall be three years, renewable for only one further term.

(6) Meetings of the Protection Commission shall be held at the call of the

Article 7

Chairperson, or at the call of at least 1/4 of all incumbent members.

(7) A majority of all incumbent members of the Protection Commission shall constitute a quorum at all its meetings, and resolutions shall be passed with the concurrent vote of a majority of the members present.

(8) A secretariat shall be established under the Protection Commission to support the business affairs of the Protection Commission.

(9) Except as otherwise expressly provided for in paragraphs (1) through (8), necessary matters concerning the organization and operation of the Protection Commission shall be prescribed by Presidential Decree.

Article 8 (Functions, etc. of Protection Commission)

(1) The Protection Commission shall deliberate, and pass a resolution, on the following matters: <Amended by Act No. 13423, Jul. 24, 2015>

1. Matters concerning the assessment of factors affecting the infringement of personal information under Article 8-2;

1-2. Matters concerning the formulation of master plans referred to in Article 9 and implementation plans referred to in Article 10;

2. Matters concerning

Article 8

the improvement of policies, systems and statutes related to the protection of personal information;

3. Matters concerning the coordination of opinions among public institutions with regard to the handling of personal information;

4. Matters concerning the interpretation and application of statutes concerning the protection of personal information;

5. Matters concerning the use and provision of personal information under Article 18 (2) 5;

6. Matters concerning the findings of impact assessment under Article 33 (3);

7. Matters concerning the presentation of opinions under Article 61 (1);

8. Matters concerning the recommendation on measures under Article 64 (4);

9. Matters concerning the publication of outcomes of processing under Article 66;

10. Matters concerning the preparation and submission of annual reports under Article 67 (1);

11. Matters referred

Article 8

to a meeting by the President, the Chairperson, or at least two members of the Protection Commission with regard to the protection of personal information;

12. Other matters on which the Protection Commission deliberates or passes a resolution pursuant to this Act or other statutes.

(2) The Protection Commission may take the following measures if necessary to deliberate, and pass a resolution, on the matters referred to in each subparagraph of paragraph (1): <Amended by Act No. 13423, Jul. 24, 2015>

1. Hearing opinions of relevant public officials or persons, civil society organizations, or relevant business entities that have professional knowledge about the protection of personal information;

2. Requesting a relevant agency, etc. to submit data or inquiring of a relevant agency, etc. about the facts.

(3) Upon receipt of a request made under paragraph (2) 2, a relevant agency, etc. shall comply with the request except in extenuating circumstances. <Newly Inserted by Act No. 13423, Jul. 24, 2015>

(4) Where the Protection Commission deliberates, and passes a resolution, on the matters referred to in paragraph (1) 2, it may recommend a relevant agency to improve such matters. <Newly Inserted

Article 8

by Act No. 13423, Jul. 24, 2015>

(5) The Protection Commission may inspect whether a relevant agency complies with recommendation under paragraph (4). <Newly Inserted by Act No. 13423, Jul. 24, 2015>

Article 8-2 (Assessment of Factors Affecting Infringement of Personal Information)

(1) Where the head of a central administrative agency introduces or revises any policy or system that accompanies the handling of personal information through the enactment of, or amendment to, any statute under his/her jurisdiction, he/she shall request the Protection Commission to assess factors affecting the infringement of personal information.

(2) Upon receipt of a request under paragraph (1), the Protection Commission may analyze and examine factors in the relevant statute that affect the infringement of personal information, and make necessary recommendations for improvement to the head of the agency having jurisdiction over such statute.

(3) Necessary matters concerning the procedures for, and methods of, the assessment of factors affecting the infringement of personal information under paragraph (1), shall be prescribed by Presidential Decree.

[This Article Newly Inserted by Act No. 13423, Jul. 24, 2015]

Article 9 (Master Plans)

Article 8-2 ~ 9

(1) In order to protect personal information and guarantee the rights and interests of owners of information, the Protection Commission shall formulate a master plan for the protection of personal information (hereinafter referred to as “master plan”) every three years through consultation with the heads of relevant central administrative agencies. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014; Act No. 13423, Jul. 24, 2015>

(2) A master plan shall contain:

1. Basic objectives and direction-setting for the protection of personal information;

2. Improving systems and statutes related to the protection of personal information;

3. Preventing the infringement of personal information;

4. Vitalizing self-regulation for the protection of personal information;

5. Vitalizing education and public relations concerning the protection of personal information;

6. Training experts in the protection of personal information;

7. Other necessary matters for the protection of personal information.

Article 9

(3) The National Assembly, a court, the Constitutional Court, and the National Election Commission (including its affiliated agencies) may formulate and implement a master plan to protect personal information handled by them.

Article 10 (Implementation Plans)

(1) The head of a central administrative agency shall formulate an annual implementation plan to protect personal information pursuant to the relevant master plan; submit the annual implementation plan to the Protection Commission; and implement the annual implementation plan following deliberation and resolution thereon by the Protection Commission.

(2) Matters necessary for formulating and implementing implementation plans shall be prescribed by Presidential Decree.

Article 11 (Requests for Submission of Data, etc.)

(1) In order to efficiently formulate master plans, the Protection Commission may request a personal information manager, the head of a related central administrative agency, the head of a related local government, a related institution or organization, etc. to submit data or state his/her opinion about the current status of compliance by personal information managers with statutes and regulations and the actual status of management of personal information. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014; Act No. 13423, Jul. 24, 2015>

Article 10 ~ 11

(2) The Minister of the Interior may inspect the head of a related central administrative agency, the head of a local government, a related institution or organization, etc. to ascertain the level and actual status of management of personal information, where necessary for the promotion of personal information protection policies, performance evaluations, etc. <Newly Inserted by Act No. 13423, Jul. 24, 2015>

(3) The head of a central administrative agency may request personal information managers under his/her jurisdiction to submit data, etc. referred to in paragraph (1) in order to efficiently formulate and promote implementation plans.

(4) Each person in receipt of a request to submit data, etc. under paragraphs (1) through (3) shall comply with such request, except in extenuating circumstances. <Amended by Act No. 13423, Jul. 24, 2015>

(5) Necessary matters, including, but not limited to, the scope and method of submitting data, etc. under paragraphs (1) through (3) shall be prescribed by Presidential Decree. <Amended by Act No. 13423, Jul. 24, 2015>

Article 12 (Personal Information Protection Guidelines)

(1) The Minister of the Interior may formulate standard guidelines for protection of personal information (hereinafter referred to as "standard guidelines"), including standards for managing personal information, types of, and preventive measures against, infringements on personal information, and other matters, and

Article 12

encourage personal information managers to comply therewith. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(2) The head of a central administrative agency may formulate the guidelines for protection of personal information to apply to the management of personal information under his/her jurisdiction based on the standard guidelines, and encourage personal information managers to comply therewith.

(3) The National Assembly, a court, the Constitutional Court, and the National Election Commission (including its affiliated agencies) may formulate and implement the guidelines for protection of personal information held by them.

Article 13 (Facilitation and Support of Self-Regulation)

The Minister of the Interior shall establish policies necessary for the following matters to facilitate and support self-regulating activities of personal information managers to protect personal information: <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

1. Education and public relations concerning the protection of personal information;

2. Fostering and supporting agencies and organizations related to the protection of personal information;

3. Supporting the introduction and implementation of a certification mark system regarding the protection of personal information;

Article 13

4. Supporting personal information managers in formulating and implementing self-regulations;

5. Other matters necessary for supporting self-regulating activities of personal information managers to protect personal information.

Article 14 (International Cooperation)

(1) The Government shall establish necessary policy measures for improving the protection level of personal information in an international environment.

(2) The Government shall establish relevant policy measures to ensure that the trans-border transfer of personal information does not infringe on the rights of an owner of information.

CHAPTER III MANAGEMENT OF PERSONAL INFORMATION

SECTION 1 Collection, Use, Provision, etc. of Personal Information

Article 15 (Collection and Use of Personal Information)

(1) A personal information manager may collect and use personal information for

Article 14 ~ 15

the intended purposes of the collection, in any of the following cases:

1. Where he/she obtains the consent of an owner of information;

2. Where there exist special provisions in any Act or it is inevitable to fulfill an obligation imposed by or under any statute;

3. Where it is inevitable for a public institution to perform its duties provided for in any statute, etc.;

4. Where it is inevitably necessary to enter into and perform a contract with an owner of information;

5. Where it is deemed urgently needed to protect the life, body and property of an owner of information or a third person when the owner of information or his/her legal representative cannot give prior consent due to his/her disability to express an intention, his/her unknown whereabouts, etc.;

6. Where it is necessary for a personal information manager to realize his/her legitimate interests and this obviously takes precedence over the rights of an owner of information. In such cases, this shall be limited to cases where the collection of such information is substantially related to a personal information manager's legitimate interests and is conducted within a reasonable scope.

Article 15

(2) Where a personal information manager obtains consent referred to in paragraph (1) 1, he/she shall notify an owner of information of the following matters. Where the personal information manager changes any of the following matters, he/she shall notify the owner of information of such change, and obtain his/her consent:

1. Purposes for which personal information is collected and used;

2. Items of personal information to be collected;

3. Period for which personal information is held and used;

4. The fact that an owner of information has a right to reject to give his/her consent and details of a disadvantage, if any, due to his/her rejection to give consent.

Article 16 (Restrictions on Collection of Personal Information)

(1) Where a personal information manager collects personal information in any case referred to in any subparagraph of Article 15 (1), he/she shall collect minimum information necessary for achieving the purpose thereof. In such cases, the personal information manager is responsible for proving that he/she collects the minimum personal information.

(2) Where a personal information manager collects personal information with the consent of an owner of information, he/she shall collect it after making a specific notification of the fact that the

Article 16

latter may choose not to consent to t collection of personal information other than the minimum information required. <Newly Inserted by Act No. 11990, Aug. 6, 2013>

(3) A personal information manager shall not reject providing an owner of information with goods or services on the ground that the owner of information does not give consent to collect his/her personal information other than the minimum necessary information. <Amended by Act No. 11990, Aug. 6, 2013>

Article 17 (Provision of Personal Information)

(1) A personal information manager may provide (including sharing; hereinafter the same shall apply) a third person with the personal information of an owner of information in any of the following cases:

1. Where he/she has obtained the consent of an owner of information;

2. Where he/she provides personal information under a purpose for which the personal information was collected pursuant to Article 15 (1) 2, 3 and 5.

(2) When a personal information manager obtains consent referred to in paragraph (1) 1, he/she shall notify an owner of information of the following matters. When the personal information manager changes any of the following matters, he/she shall inform the same and obtain consent thereto:

Article 17

1. A recipient of personal information;

2. Purposes for which a recipient of personal information uses such information;

3. Items of personal information to provide;

4. Period for which a recipient of personal information holds and uses such information;

5. The fact that an owner of information has a right to reject to give his/her consent and details of a disadvantage, if any, due to his/her rejection to give consent.

(3) When a personal information manager provides a third person at any overseas location with personal information, he/she shall notify an owner of information of the matters referred to in each subparagraph of paragraph (2) and obtain the consent thereto, and shall not enter into a contract concerning the trans-border transfer of personal information stipulating any details contravening this Act.

Article 18 (Restrictions on Use and Provision of Personal Information for other than Intended Purpose)

(1) No personal information manager shall use personal information beyond the scope provided for in Article 15 (1), or provide any third person with personal information beyond the scope provided for in Article 17 (1) and (3).

Article 18

(2) Notwithstanding paragraph (1), a personal information manager may use personal information or provide a third person with such information for other than the intended purpose in any of the following cases, unless the interests of the owner of information or the third person are likely to be unduly infringed on: Provided, That in cases falling under subparagraphs 5 through 9, this shall be limited to a public institution:

1. Where he/she obtains separate consent of an owner of information;

2. Where there exist special provisions in any other Act;

3. Where it is deemed obviously necessary for the physical safety and property interests of an owner of information or a third person when the owner of information or his/her legal representative cannot give prior consent because he/she is unable to express his/her intention or because his/her whereabouts is unknown, etc.;

4. Where personal information required for statistics, scientific research, etc., is provided in a form by which specific individuals cannot be identified;

5. Where it is indispensable to perform duties provided for in any other Act, and the Protection Commission deliberates, and passes a resolution, thereon;

6. Where it is necessary

Article 18

to provide a foreign government or international organization with personal information to implement a treaty or any other international agreement;

7. Where it is necessary to investigate a crime, and institutes and sustains a public prosecution;

8. Where it is necessary for a court to perform its judicial affairs;

9. Where it is necessary to execute a punishment, care and custody, or protective disposition.

(3) Each personal information manager shall notify an owner of information of the following matters to obtain consent referred to in paragraph (2) 1. Where the personal information manager changes any of the following matters, he/she shall notify the owner of information of such change, and obtain his/her consent:

1. A recipient of personal information;

2. Purposes for which personal information is used (referring to the purposes for which a recipient of personal information uses such information in cases of provision);

3. Items of personal information to be used or provided;

4. A period for which personal information is held and used (referring to

Article 18

a period for which a recipient of personal information holds and uses it in cases of provision);

5. The fact that an owner of information has a right to reject to give his/her consent and details of a disadvantage, if any, due to his/her rejection to give consent

(4) Where a public institution uses personal information or provides a third person with such information for other than the intended purpose pursuant to paragraph (2) 2 through 6, 8 and 9, it shall publish necessary matters concerning the legal basis, purpose, scope, etc. of such use or provision in its official gazette, website, etc., as prescribed by Ordinance of the Ministry of the Interior. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(5) Where a personal information manager provides a third person with personal information for other than the intended purpose in any case referred to in paragraph (2), he/she shall restrict the purpose and method of use by a recipient of the personal information and other necessary measures, or request the recipient to prepare measures necessary for ensuring the safety of personal information. In such cases, a person in receipt of such request shall take measures necessary for ensuring the safety of personal information.

Article 19 (Restrictions on Use and Provision of Personal Information by Recipients of Such Information)

No person who receives personal information from a personal information manager

Article 19

shall use such personal information for any purpose other than the intended purpose of provision or provide a third person with such information, except for any of the following cases:

1. Where he/she has obtained separate consent from an owner of information;

2. Where special provisions exist in any other Act.

Article 20 (Notification on Sources, etc. of Personal Information Collected from Those other than Owners of Information)

(1) When a personal information manager manages personal information collected from a person other than an owner of information, he/she shall immediately notify the owner of information of the following matters, if so requested by the owner of information:

1. Collection source of personal information;

2. Purpose for which personal information is managed;

3. The fact that the owner of information has the right to request the suspension of managing the information.

(2) Paragraph (1) shall not apply to any of the following cases: Provided, That this shall be limited to cases having obvious priority over the rights of an owner of information by or under this Act:

Article 20

1. Where the personal information which is a subject matter of notification is included in a personal information file applicable under any subparagraph of Article 32 (2);

2. Where providing notification could harm any third person's life or physical safety, or unreasonably infringe on any third person's property and other interests.

Article 21 (Destruction of Personal Information)

(1) When personal information becomes unnecessary as its holding period expires, its management purpose is achieved and by any other ground, a personal information manager shall destroy the personal information without delay: Provided, That this shall not apply where the personal information must be preserved pursuant to any other statute.

(2) When a personal information manager destroys personal information pursuant to paragraph (1), he/she shall take a measure to prevent the personal information from being recovered and recycled.

(3) Where a personal information manager does not destroy personal information, pursuant to the proviso to paragraph, and is required to preserve personal information, he/she shall save and administer the personal information or personal information file in question separately from any other personal information.

(4) Necessary matters concerning the methods and procedures of destroying personal

Article 21

information and other related matters shall be prescribed by Presidential Decree.

Article 22 (Methods of Obtaining Consent)

(1) When a personal information manager obtains the consent of an owner of information (including his/her legal representative under paragraph (5): hereinafter the same shall apply in this Article) about the management of personal information, he/she shall classify respective matters requiring consent and notify the owner of information of such matters to clearly understand them, and obtain consent respectively to such matters.

(2) When a personal information manager obtains the consent of an owner of information about the management of personal information pursuant to Articles 15 (1) 1, Article 17 (1) 1, subparagraph 1 of Article 23 and Article 24 (1) 1, he/she shall classify the personal information that can be managed without obtaining the consent of the owner of information and the personal information requiring the consent of the owner of information for the purpose of entering into a contract with the owner of information. In such cases, a personal information manager is responsible for proving that the subject personal information is the one that can be managed without obtaining consent.

(3) When a personal information manager intends to obtain the consent of an owner of information on the management of his/her personal information in order to publicize or solicit the sale of goods or services to him/her, the personal information manager

Article 22

shall notify the owner of information thereof to clearly understand this and obtain his/her consent thereto.

(4) No personal information manager shall refuse to provide an owner of information with goods or services on the ground that the owner of information fails to give his/her consent to matters he/she is entitled to give selective consent pursuant to paragraph (2) or fails to give his/her consent required under paragraph (3) and Article 18 (2)1.

(5) When a personal information manager needs to obtain consent required under this Act in order to manage personal information of a child under the age of 14 years, he/she shall obtain the consent of his/her legal guardian. In such cases, minimum information necessary for obtaining the consent of the legal guardian may be directly collected from the relevant child without consent of the legal guardian.

(6) Except as otherwise expressly provided for in paragraphs (1) through (5), detailed methods of obtaining the consent of an owner of information and necessary matters concerning the details of minimum information under paragraph (5) shall be prescribed by Presidential Decree, considering media, etc. of collecting personal information.

SECTION 2 Restrictions on Management of Personal Information

Article 23 (Restrictions on Management of Sensitive Information)

A personal information

Article 23

manager shall not manage any inf on thought, beliefs, joining or withdrawal from a labor union or political party, a political opinion, health, sexual life, etc., and other personal information prescribed by Presidential Decree which could substantially infringe on the privacy of an owner of information (hereinafter referred to as "sensitive information"): Provided, That this shall not apply in any of the following cases:

1. Where an owner of information is notified of the matters referred to in each subparagraph of Article 15 (2) or 17 (2) and his/her separate consent is obtained in addition to his/her consent to the management of general personal information;

2. Where any statute requires or permits the management of sensitive information.

Article 24 (Restrictions on Management of Personally Identifiable Information)

(1) No personal information manager shall manage information prescribed by Presidential Decree, and uniquely assigned to each individual to identify him/her pursuant to statutes (hereinafter referred to as "personally identifiable information"), except in any of the following cases:

1. Where an owner of information is notified of the matters referred to in each subparagraph of Article 15 (2) or 17 (2) and gives his/her consent, separately from the management of

Article 24

other personal information;

2. Where any statute specifically requires or permits the management of personally identifiable information.

(2) Deleted. <Act No. 11990, Aug. 6, 2013>

(3) Each personal information manager shall take measures, such as encryption, which are necessary for ensuring safety, as prescribed by Presidential Decree, in order to prevent personally identifiable information from loss, theft, divulgence, forgery, alteration or damage when managing the personally identifiable information pursuant to any subparagraph of paragraph (1). <Amended by Act No. 13423, Jul. 24, 2015>

(4) Deleted. <Act No. 11990, Aug. 6, 2013>

Article 24-2 (Restrictions on Management of Resident Registration Numbers)

(1) Notwithstanding Article 24 (1), no personal information manager shall manage resident registration numbers, except in any of the following cases:

1. Where any statute specifically requires or permits the management of resident registration numbers;

2. Where it is deemed urgently necessary to protect the life, body or property of an owner of information or a third party;

Article 24-2

3. Cases prescribed by Ordinance of the Ministry of the Interior, which correspond to subparagraph 1 or 2, where it is inevitable to manage resident registration numbers.

(2) Notwithstanding Article 24 (3), a personal information manager shall keep resident registration numbers in a secure manner by taking encryption measures to prevent the resident registration numbers from loss, theft, divulgence, forgery, alteration or damage. In such cases, persons who should encrypt resident registration numbers, the time for each personal information manager to apply encryption, and other necessary matters shall be prescribed by Presidential Decree, considering the scale of personal information to be managed, the effect to be caused at the time of divulgence, etc. <Newly Inserted by Act No. 12504, Mar. 24, 2014; Act No. 13423, Jul. 24, 2015>

(3) Even where a personal information manager manages resident registration numbers pursuant to paragraph (1), he/she shall notify the owners of information of the methods of registering as users without providing their resident registration numbers at the stage of registration as users of the website.

(4) In order for personal information mangers to provide the methods referred to in paragraph (3), the Minister of Security and Public Administration may prepare and provide assistance for all measures, such as amending related statutes, formulating plans, and establishing necessary facilities and systems. <Amended by Act No. 12504, Mar. 24, 2014>

Article 24-2

[This Article Newly Inserted by Act No. 11990, Aug. 6, 2013]

Article 25 (Restrictions on Installation and Operation of Image Data Processing Equipment)

(1) No one shall install and operate image data processing equipment in a public space, except in any of the following cases:

1. Where the installation and operation of image data processing equipment is specifically permitted by statutes;

2. Where the installation and operation of image data processing equipment is necessary to prevent and investigate crimes;

3. Where the installation and operation of image data processing equipment is necessary for facility safety and fire prevention;

4. Where the installation and operation of image data processing equipment is necessary for traffic control;

5. Where the installation and operation of image data processing equipment is necessary to collect, analyze, and provide traffic information.

(2) No one shall install and operate image data processing equipment that enables people to see the inside of a space where the privacy of

Article 25

an individual could be substantially infringed on, such as a public bath, restroom, sauna, and fitting room used by many and unspecified persons: Provided, That this shall not apply to facilities prescribed by Presidential Decree, such as a prison, and mental health facility, used to detain or protect persons pursuant to applicable statutes.

(3) The head of each public institution, who intends to install and operate image data processing equipment pursuant to each subparagraph of paragraph (1), and each person, who intends to install and operate image data processing equipment pursuant to the proviso to paragraph (2), shall gather consensus from relevant experts and interested persons by taking procedures prescribed by Presidential Decree, such as holding a hearing or consultation.

(4) Each person, who intends to install and operate image data processing equipment pursuant to each subparagraph of paragraph (1) (hereinafter referred to as "operator of image data processing equipment"), shall take necessary measures, including the installation, etc. of a signboard, as prescribed by Presidential Decree, so that an owner of information can readily recognize such equipment: Provided, That this shall not apply to facilities prescribed by Presidential Decree.

(5) No operator of image data processing equipment shall arbitrarily handle the image data processing equipment for purposes other than the intended purpose of installation, shoot other locations, and use a recording function.

(6) Each operator

Article 25

of image data processing equipment shall take measures necessary for ensuring safety pursuant to Article 29 in order to prevent personal information from loss, theft, divulgence, forgery, alteration or damage. <Amended by Act No. 13423, Jul. 24, 2015>

(7) Each operator of image data processing equipment shall formulate the policies to operate and manage image data processing equipment, as prescribed by Presidential Decree. In such cases, he/she need not formulate personal information management policies under Article 30.

(8) An operator of image data processing equipment may outsource business affairs concerning the installation and operation of image data processing equipment: Provided, That, where a public institution outsources business affairs concerning the installation and operation of image data processing equipment, it shall comply with the procedures and requirements prescribed by Presidential Decree.

Article 26 (Restrictions on Management of Personal Information Following Outsourcing of Affairs)

(1) When a personal information manager outsources the management of personal information to a third person, he/she shall do so in writing stating the following:

1. Matters concerning prohibiting a third person from managing personal information for any purpose other than for performance of outsourced affairs;

Article 26

2. Matters concerning technical and administrative protection measures for personal information;

3. Other matters prescribed by Presidential Decree for the safe administration of personal information.

(2) A personal information manager who outsources the management of personal information pursuant to paragraph (1) (hereinafter referred to as "contract giver") shall disclose the details of outsourced affairs and the identity of a person who performs the outsourced management of personal information (hereinafter referred to as "contract accepter"), as prescribed by Presidential Decree, so that an owner of information can readily use them at any time.

(3) Where a contract giver outsources the affairs of publicizing or soliciting the sales of goods or services, he/she shall inform the owner of information of the details of outsourced affairs and the contract accepter by the methods prescribed by Presidential Decree. The same shall also apply where the details of outsourced affairs or a contract accepter is changed.

(4) Each contract giver shall educate a contract accepter to prevent the personal information from loss, theft, divulgence, forgery, alteration or damage, due to the outsourcing of affairs, and supervise whether the contract accepter safely manages the personal information, by inspecting the current status of management, as prescribed by Presidential Decree. <Amended by

Article 26

Act No. 13423, Jul. 24, 2015>

(5) No contract accepter shall use personal information or provide any third person with personal information beyond the scope of relevant affairs outsourced by a personal information manager.

(6) Where liability to pay compensation arises as a contract accepter violates this Act in the course of managing personal information in connection with the outsourced affairs, the contract accepter shall be deemed an employee of a personal information manager.

(7) Articles 15 through 25, 27 through 31, 33 through 38, and 59 shall apply mutatis mutandis to a contract accepter.

Article 27 (Restrictions on Transfer of Personal Information Following Business Transfer, etc.)

(1) Where a personal information manager transfers personal information to a third person following the transfer, merger, etc. of all or part of his/her business, he/she shall, in advance, notify the owner of information in question, of the following matters, as prescribed by Presidential Decree:

1. The fact that personal information is to be transferred;

2. Name (referring to the name of a corporation, if the third person is a corporation), address, telephone number and other contacts of a recipient of personal information (hereinafter

Article 27

refred to as "business transfee, etc.");

3. Methods and procedures available when an owner of information does not want his/her personal information to be transferred.

(2) When a transferee, etc. has received personal information, he/she shall immediately notify an owner of information of the fact, in accordance with methods prescribed by Presidential Decree: Provided, That this shall not apply where the fact of transfer has been already notified pursuant to paragraph (1).

(3) When a transferee, etc. has received personal information following the transfer, merger, etc. of business, he/she may use the personal information or provide a third person with such information for the original purpose as at the transfer. In such cases, the transferee, etc. shall be deemed a personal information manager.

Article 28 (Supervision over Personal Information Handlers)

(1) A personal information manager shall appropriately control and supervise persons, such as executive officers, employees, temporary agency workers, part-time workers, etc. who manage personal information under his/her instructions and supervision (hereinafter referred to as "personal information handler") to ensure the safe administration of personal information in managing such information.

(2) A personal

Article 28

information manager shall provide personal information handlers with necessary education on a regular basis to ensure the appropriate processing of personal information.

CHAPTER IV SAFE ADMINISTRATION OF PERSONAL INFORMATION

Article 29 (Duty to Take Safety Measures)

Each personal information manager shall formulate an internal administration plan, keep access records, and take technical, administrative and physical measures necessary for ensuring safety, as prescribed by Presidential Decree, in order to prevent personal information from loss, theft, divulgence, forgery, alteration or damage. <Amended by Act No. 13423, Jul. 24, 2015>

Article 30 (Formulation and Disclosure of Personal Information Management Policies)

(1) Each personal information manager shall formulate personal information management policies containing the following matters (hereinafter referred to as "personal information management policies"). In such cases, each public institution shall formulate personal information management policies for personal information files to be registered pursuant to Article 32:

1. Purposes for which personal information is managed;

Article 29 ~ 30

2. A period for which personal information is held and used;

3. Matters concerning providing a third person with personal information (where applicable);

4. Matters concerning outsourcing the management of personal information (where applicable);

5. Matters concerning the rights and duties of an owner of information, and how to exercise them;

6. Other matters prescribed by Presidential Decree concerning the management of personal information.

(2) Where a personal information manager formulates or amends personal information management policies, he/she shall disclose them by the methods prescribed by Presidential Decree so that an owner of information can readily use them.

(3) Where the details of personal information management policies are inconsistent with those of a contract entered into between a personal information manager and an owner of information, whichever is more advantageous to the owner of information shall govern.

(4) The Minister of the Interior may establish a guideline for preparing personal information management policies and recommend a personal information manager to comply therewith. <Amended by Act

Article 30

No. 11690, Mar. 23, 2013; No. 12844, Nov. 19, 2014>

Article 31 (Designation of Personal Information Protection Managers)

(1) A personal information manager shall designate a personal information protection manager to take overall responsibility for the management of personal information.

(2) A personal information protection manager shall conduct the following affairs:

1. Formulating and implement a personal information protection plan;

2. Periodically investigating and improving personal information management status and practices;

3. Handling complaints concerning the management of personal information and remedying damage therefrom;

4. Establishing an internal control system to prevent the divulgence and misuse of personal information;

5. Formulating and implementing an education plan for the protection of personal information;

6. Protecting, administering and supervising personal information files;

Article 31

7. Other duties prescribed by Presidential Decree for the appropriate management of personal information.

(3) A personal information protection manager may frequently investigate the management status, system, etc. of personal information or require a related party to report thereon if necessary while performing the duties referred to in each subparagraph of paragraph (2).

(4) Where a personal information protection manager becomes aware of a violation of this Act, other relevant statutes in connection with the protection of personal information, he/she shall take a corrective measure immediately, and report the corrective measure to the agency or organization to which he/she belongs, where necessary.

(5) A personal information manager shall ensure that a personal information protection manager does not cause, or suffer from, any disadvantage without reasonable grounds in performing the duties referred to in each subparagraph of paragraph (2).

(6) Designation requirements, duties and qualifications of personal information protection managers, and other necessary matters shall be prescribed by Presidential Decree.

Article 32 (Registration and Disclosure of Personal Information Files)

(1) Where the head

Article 32

of a public institution administers personal information files, he/she shall register the following matters with the Minister of the Interior. The same shall also apply to any changes of the registered matters: <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

1. Name of a personal information file;

2. Basis and purposes of administering personal information files;

3. Items of personal information to be recorded in a personal information file;

4. Method of managing personal information;

5. A period for which personal information is held;

6. Recipients if personal information is provided on a regular basis or repeatedly;

7. Other matters prescribed by Presidential Decree.

(2) Paragraph (1) shall not apply to any of the following personal information files:

1. Personal information files recording national safety, diplomatic confidential information, and other matters concerning the State's critical interests;

Article 32

2. Personal information files recording criminal investigations, public prosecutions, execution of a punishment and protective custody, reformation disposition, protective disposition, security and observation disposition, and immigration control;

3. Personal information files recording investigations into offenses provided for in the Punishment of Tax Evaders Act and the Customs Act;

4. Personal information files used by public institutions for performing their internal affairs only;

5. Classified personal information files pursuant to other statutes.

(3) The Minister of the Interior may review the registered matters and details of personal information files referred to in paragraph (1), if necessary, and recommend the head of a relevant public institution to make the improvement thereof. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(4) The Minister of the Interior shall disclose the registration status of personal information files under paragraph (1) so that anyone can readily inspect them. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(5) Matters necessary for registration under paragraph (1) and the method and

Article 32

scope of, a the procedure for, disclosure uer paragraph (4) shall be prescribed by Presidential Decree.

(6) The registration and disclosure of personal information files by the National Assembly, courts, the Constitutional Court, and the National Election Commission (including its affiliated agencies) shall be stipulated by the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, and the National Election Commission Regulations.

Article 32-2 (Certification as to Protection of Personal Information)

(1) The Minister of the Interior may certify whether a series of measures taken by a personal information manager for the management and protection of personal information comply with this Act, etc.

(2) The term of validity of the certification under paragraph (1) shall be three years.

(3) In any of the following cases, the Minister of the Interior may revoke the certification issued under paragraph (1), as prescribed by Presidential Decree: Provided, That in cases falling under subparagraph 1, the Minister of the Interior shall revoke the certification:

1. Where a personal information manager obtains certification as to protection

Article 32-2

of personal information by fraud or other wrongful means;

2. Where a personal information manager who has obtained certification refuses or interferers with the follow-up management to be conducted under paragraph (4);

3. Where a personal information manager who has obtained certification fails to meet the criteria for certification prescribed under paragraph (8);

4. Where a personal information manager who has obtained certification violates any statutes related to protection of personal information and the ground for such violation is grave.

(4) The Minister of the Interior shall conduct follow-up management at least once a year in order to maintain the effectiveness of certification as to protection of personal information.

(5) The Minister of the Interior may entrust specialized institutions prescribed by Presidential Decree with the affairs related to certification under paragraph (1), revocation of certification under paragraph (3), follow-up management under paragraph (4), and the management of certification examiners under paragraph (7).

(6) A person, who has obtained certification under paragraph (1), may indicate or publicize the details of the certification, as prescribed

Article 32-2

by Presidential Decree.

(7) Qualifications for examiners to perform examinations necessary for certification under paragraph (1), grounds for the revocation of qualifications, etc. shall be prescribed by Presidential Decree, taking into account the expertise, experience and other necessary matters.

(8) Other matters necessary for the criteria, methods, procedures, etc. for certification under paragraph (1), including whether the management system of personal information, guarantee of information owners' rights, and measures for ensuring safety comply with this Act, shall be prescribed by Presidential Decree.

[This Article Newly Inserted by Act No. 13423, Jul. 24, 2015]

Article 33 (Personal Information Impact Assessment)

(1) Where the administration of personal information files pursuant to the standards prescribed by Presidential Decree is likely to infringe on personal information, the head of a public institution shall conduct an assessment to analyze risk factors and drive solutions (hereinafter referred to as "impact assessment"), and submit the findings thereof to the Minister of the Interior. In such cases, the head of the public institution shall request any agency designated by the Minister of the Interior (hereinafter referred to as "assessment agency") to conduct an impact assessment. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

Article 33

(2) The following matters shall be considered in conducting an impact assessment:

1. Number of personal information to be managed;

2. Whether personal information is provided to a third person;

3. Risk of infringing on the rights of an owner of information and the degree of such risk;

4. Other matters prescribed by Presidential Decree.

(3) The Minister of the Interior may present his/her opinion on the findings of an impact assessment submitted under paragraph (1), following deliberation and resolution thereon by the Protection Commission. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(4) When the head of a public institution submits registration for personal information files, an impact assessment under paragraph (1) of which is complete, pursuant to Article 32 (1), he/she shall attach the findings of the impact assessment thereto.

(5) To facilitate the impact assessment, the Minister of the Interior shall train relevant experts, formulate and disseminate standard impact assessment, and take necessary measures. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>▷

Article 33

(6) Requirements for designation of assessment agencies under paragraph (1), revocation of designation, criteria for assessment, the method and procedure for the impact assessment, and other necessary matters, shall be prescribed by Presidential Decree.

(7) Impact assessments by the National Assembly, the courts, the Constitutional Court or the National Election Commission (including its affiliated agencies) shall be stipulated by the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, or the National Election Commission Regulations.

(8) Each personal information manager, other than a public institution, shall actively endeavor to conduct an impact assessment, if he/she has concern over the infringement of personal information due to the administration of personal information files.

Article 34 (Notification, etc. on Divulgence of Personal Information)

(1) Where a personal information manager becomes aware of the divulgence of personal information, he/she shall notify the relevant owner of information of the following matters without delay:

1. Items of the personal information divulged;

Article 34

2. When and how personal information was divulged;

3. Information on methods, etc. available to the relevant owner of information to mitigate loss that could be caused by divulgence;

4. Countermeasures and procedures for relief from loss taken by a person information manager;

5. A department in charge of the receipt of reports, etc. and the contact information thereof, if the relevant owner of information suffers from loss.

(2) Where personal information is divulged, a personal information manager shall prepare measures to mitigate loss therefrom, and take necessary measures.

(3) Where personal information is divulged in excess of the scale prescribed by Presidential Decree, a personal information manager shall immediately report the notification under paragraph (1) and the results of measures taken under paragraph (2) to the Minister of the Interior or a specialized institution prescribed by Presidential Decree. In such cases, the Minister of the Interior or the specialized institution prescribed by Presidential Decree may provide technical support for preventing the spread of loss and recovering from loss. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(4) The timing

Article 34

and method of, and the procedure for, notification under paragraph (1), and other necessary matters, shall be prescribed by Presidential Decree.

Article 34-2 (Imposition, etc. of Penalty Surcharges)

(1) The Minister of the Interior may impose and collect a penalty surcharge not exceeding 500 million won, if resident registration numbers managed by a personal information manager are lost, stolen, divulged, forged, altered or damaged: Provided, That this shall not apply where the personal information manager has taken measures necessary for ensuring safety under Article 24 (3) to prevent the loss, theft, divulgence, forgery, alteration or damage of such resident registration numbers. <Amended by Act No. 12844, Nov. 19, 2014; Act No. 13423, Jul. 24, 2015>

(2) The Minister of the Interior shall consider the following when imposing a penalty surcharge pursuant to paragraph (1): <Amended by Act No. 12844, Nov. 19, 2014; Act No. 13423, Jul. 24, 2015>

1. Degree of efforts in taking measures necessary for ensuring safety under Article 24 (3);

2. Extent of the loss, theft, divulgence, forgery, alteration or damage of resident registration numbers;

3. Whether any follow-up measures are taken to prevent the spread of damage.

(3) Where a person

Article 34-2

liable to pay a penalty surcharge under paragraph (1) fails to pay it by the deadline for payment, the Minister of the Interior shall collect a late-payment penalty prescribed by Presidential Decree in an amount not exceeding 6/100 of the penalty surcharge per year for the period from the date following the date on which the payment of the penalty surcharge is due to the date immediately preceding the date on which the penalty surcharge is paid. In such cases, the period for which the late-payment penalty is collected shall not exceed 60 months. <Amended by Act No. 12844, Nov. 19, 2014>

(4) Where a person liable to pay a penalty surcharge under paragraph (1) fails to pay it by the deadline for payment, the Minister of the Interior shall demand the payment within a specified period; and where the person fails to pay the penalty surcharge or the late-payment penalty within the specified period, the Minister of the Interior shall collect such penalty surcharge and late-payment penalty in the same manner as delinquent national taxes are collected. <Amended by Act No. 12844, Nov. 19, 2014>

(5) Other matters necessary for the imposition and collection of penalty surcharges shall be prescribed by Presidential Decree.

[This Article Newly Inserted by Act No. 11990, Aug. 6, 2013]

CHAPTER V GUARANTEEING RIGHTS OF OWNERS OF INFORMATION

Article 34-2

Article 35 (Access to Personal Information)

(1) An owner of information may request a personal information manager to allow him/her to inspect his/her personal information managed by the personal information manager.

(2) Notwithstanding paragraph (1), where an owner of information intends to request access to information from a public institution, he/she may request such access directly to the public institution or via the Minister of the Interior, as prescribed by Presidential Decree. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(3) Upon receipt of a request for access made under paragraphs (1) and (2), a personal information manager shall ensure that an owner of information can access the relevant personal information within a period prescribed by Presidential Decree. In such cases, if it is impossible to access such information within the specified period upon reasonable grounds, the personal information manager may notify the owner of information of such grounds; postpone the access; and permit the access without delay once the grounds cease to exist.

(4) In any of the following cases, a personal information manager may notify an owner of information of the grounds therefor and restrict or reject access to information:

1. Where access to information is prohibited or restricted by Acts;

2. Where a third

Article 35

party's life or body is likely to be harmed, or a third party's property or other interests are likely to be unduly infringed on;

3. Where access to information substantially hinders a public institution performing any of the following affairs:

(a) Affairs concerning the imposition, collection or refund of taxes;

(b) Affairs concerning grade evaluation or the selection of newly enrolled students at schools of each level under the Elementary and Secondary Education Act and the Higher Education Act, lifelong education centers under the Lifelong Education Act, and other higher education institutions established under other Acts;

(d) Affairs concerning an assessment or decision in progress in connection with the calculation, etc. of compensation or benefits;

(e) Affairs concerning an audit and investigation being conducted under other Acts.

(5) The method of, and the procedure for, requesting and restricting access to

Article 35

information or providing notice pursuant paragraphs (1) through (4) and other necessary matters shall be prescribed by Presidential Decree.

Article 36 (Correction or Deletion of Personal Information)

(1) An owner of information who has inspected his/her personal information pursuant to Article 35 may request a personal information manager to correct or delete his/her personal information: Provided, That if other statutes stipulates the particular personal information be collected, the owner of information shall not request the deletion thereof.

(2) Upon receiving a request from an owner of information pursuant to paragraph (1), a personal information manager shall investigate the personal information in question without delay, take necessary measures, such as correction, deletion, etc. based on a request from the owner of information, and notify the owner of information of the result unless other statutes stipulate special procedures for the correction or deletion of the personal information.

(3) When a personal information manager deletes personal information pursuant to paragraph (2), he/she shall take measures to prevent the personal information from being recovered or recycled.

(4) Where a request from an owner of information falls under the proviso to paragraph (1), a personal information manager shall notify an owner of information of the details thereof without delay.

Article 36

(5) If it is necessary for conducting an investigation under paragraph (2), a personal information manager may require an owner of information in question to submit evidence necessary for verifying a request for correction or deletion.

(6) Necessary matters concerning the method, procedure, etc. of requesting correction or deletion, and providing notification shall be prescribed by Presidential Decree.

Article 37 (Suspension, etc. from Managing Personal Information)

(1) An owner of information may request a personal information manager to suspend managing his/her personal information. When the manager is a public institution, the owner of information may request the suspension on his/her personal information among the personal information files to be registered pursuant to Article 32.

(2) A personal information manager in receipt of a request under paragraph (1) shall immediately suspend the management of the personal information completely or partially at the request of an owner of information: Provided, That the personal information manager may reject a request from an owner of information to suspend management in any of the following cases:

1. Where there exists special provisions in any Act or it is inevitable to comply with statutory obligations;

2. Where it is apprehended that any third person's life and body may be

Article 37

harmd, or any third prson's proprty and othr intrests may be unduly infringed on;

3. Where a public institution is unable to conduct its affairs stipulated by or under other Acts unless it manages personal information;

4. Where it is impractical to perform a contract, such as a failure to provide an owner of information with stipulated services unless the personal information manager manages personal information, and the owner of information fails to clearly express his/her intention to terminate the contract.

(3) When a personal information manager has refused a request to suspend management pursuant to the proviso to paragraph (2), he/she shall immediately notify an owner of information of the reason therefor.

(4) A personal information manager shall immediately take necessary measures, such as the destruction, etc. of the relevant personal information, the management of which is suspended at the request of an owner of information.

(5) Necessary measures concerning the method and procedure of requesting or refusing the suspension of management, and providing notification pursuant to paragraphs (1) through (3) shall be prescribed by Presidential Decree.

Article 38 (Methods and Procedures of Exercising Rights)

(1) An owner of information

Article 38

may have his/her representative to make a request for access, etc. under Article 35, correction or deletion under Article 36, and the suspension, etc. of management under Article 37 (hereinafter referred to as "request for access, etc.") according to the method and procedure prescribed by Presidential Decree, such as in writing.

(2) A legal guardian of a child under the age of 14 years may request access to the child's personal information from a personal information manager.

(3) A personal information manager may charge fees and postage (limited to cases where a request is made to send a certified copy by mail) to a person who makes a request for access, etc., as prescribed by Presidential Decree.

(4) A personal information manager shall prepare detailed methods and procedures available for the owners of information to make a request for access, etc., and disclose them to the owners of information.

(5) A personal information manager shall prepare necessary procedures and provide a notice thereon to the owners of information so that they can raise an objection if dissatisfied with measures, such as refusal, etc. of a request for access, etc.

Article 39 (Liability for Damages)

(1) Where an owner of information suffers any loss due to a personal information manager’ violation of this Act, he/she may lodge a claim

Article 39

for damages to the personal information manager. In such cases, the personal information manager may be exempted from the liability for damages, proving that such incident has been caused neither intentionally nor by gross negligence.

(2) Deleted. <by Act No. 13423, Jul. 24, 2015>

(3) Where any personal information is lost, stolen, divulged, forged, altered or damaged by the intentional conduct or gross negligence of a personal information manager, causing any loss to the owner of such personal information, the court may determine the amount of damages not exceeding three times the amount of loss: Provided, That the same shall not apply where a personal information manager proves that such incident has not been caused by his/her intentional conduct or gross negligence. <Newly Inserted by Act No. 13423, Jul. 24, 2015>

(4) The court shall take the following into account when determining the amount of damages described in paragraph (3): <Newly Inserted by Act No. 13423, Jul. 24, 2015>

1. The degree of perception of intention or possibility of causing any loss;

2. The severity of any loss caused by the violation;

3. Economic benefits that the personal information manager has gained by the violation;

Article 39

4. The fines and penalty surcharges imposed for the violation;

5. The duration and frequency of the violation;

6. The personal information manager's financial standing;

7. The degree of the personal information manager's efforts to recover the personal information after such personal information has been lost, stolen or divulged;

8. The degree of the personal information manager's efforts to remedy the loss of the owner of information.

Article 39-2 (Claims for Statutory Damages)

(1) Notwithstanding Article 39 (1), personal information is lost, stolen, divulged, forged, altered or damaged due to the intentional conduct or gross negligence of a personal information manager, the owner of such personal information may lodge a claim for damages in a substantial amount not exceeding three million won. In such cases, the relevant personal information manager may be exempted from liability for damages, proving that such incident has been caused neither intentionally nor by gross negligence.

(2) If any claim is lodged under paragraph (1), the court may determine a substantial amount of damages not exceeding the amount described in paragraph (1), taking into account the purport of the overall argument and the result of examination of evidence.

Article 39-2

(3) An owner of information who has lodges a claim for damages under Article 39 may change the relevant claim into a claim prescribed in paragraph (1) before an argument in the fact-finding proceedings is closed.

[This Article Newly Inserted by Act No. 13423, Jul. 24, 2015]

CHAPTER VI PERSONAL INFORMATION DISPUTE MEDIATION COMMITTEE

Article 40 (Establishment and Composition)

(1) A committee for mediation of disputes over personal information (hereinafter referred to as the "Dispute Mediation Committee") shall be established to mediate disputes over personal information.

(2) The Dispute Mediation Committee shall be comprised of not more than 20 members, including one chairperson, who shall consist of ex officio members and commissioned members. <Amended by Act No. 13423, Jul. 24, 2015>

(3) Members shall be commissioned by the Chairperson of the Protection Commission from among the following persons, and public officials belonging to State agencies prescribed by Presidential Decree shall be ex officio members: <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014; Act No. 13423,

Article 40

Jul. 24, 2015>

1. A person who has served as a public official belonging to the Senior Civil Service of a central administrative agency taking charge of the protection of personal information, or a person who serves or has served in any equivalent position of any public sector or related organization and has experience in the protection of personal information;

2. A person who serves or has served as an associate professor or at a higher or equivalent position in a university or an accredited research institute;

3. A person who serves or has served as a judge, public prosecutor or attorney-at-law;

4. A person recommended by a civic and social organization or consumer organization related to the protection of personal information;

5. A person who serves or has served as an executive in an organization of business entities comprised of personal information managers.

(4) The chairperson shall be commissioned by the Chairperson of the Protection Commission from among non-public official members. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014; Act No. 13423, Jul. 24, 2015>

(5) The terms of

Article 40

oice o the chairperson and commissioned members shall be two years, renewable for only one further term. <Amended by Act No. 13423, Jul. 24, 2015>

(6) Where it is deemed necessary to efficiently meditate disputes, the Dispute Mediation Committee may establish a mediation division comprised of not more than five members in each sector of mediation cases, as prescribed by Presidential Decree. In such cases, a resolution passed by any mediation division upon entrustment of the Dispute Mediation Committee shall be deemed a resolution passed by the Dispute Mediation Committee.

(7) The resolution passed at a meeting of the Dispute Mediation Committee or a mediation division shall require the attendance of a majority of all incumbent members and the concurring vote of a majority of those present.

(8) The Protection Commission may perform administrative affairs necessary to mediate disputes, such as receiving applications for mediation of disputes and verifying facts. <Amended by Act No. 13423, Jul. 24, 2015>

(9) Except as otherwise expressly provided for in this Act, matters necessary for operating the Dispute Mediation Committee shall be prescribed by Presidential Decree.

Article 41 (Status Guarantee of Members)

No member may be dismissed or de-commissioned against his/her will unless he/she is sentenced to the suspension of any qualifications, or

Article 41

heavier punishment, unless he/she becomes unable to perform his/her duties due to a mental or physical disability.

Article 42 (Abstention, Recusal and Withdrawal of Members)

(1) A member of the Dispute Mediation Committee shall abstain from deliberation and decision-making on a case filed for mediation of a dispute (hereinafter referred to as "case" in this Article) pursuant to Article 43 (1) in any of the following cases:

1. If the member or his/her spouse or ex-spouse is a party to the case or is related to the case as a joint right holder or a joint obligor;

2. If the member is or was a relative of a party to the case;

3. If the member has testified or given an expert opinion or legal advice with respect to the case;

4. If the member is or was involved in the case as an agent of a party to the case.

(2) If a party to a case finds it impracticable to expect a fair deliberation or resolution from a Committee member, he/she may file a recusal with the chairperson against the Committee member. In such cases, the chairperson shall decide upon the recusal without any resolution of the Dispute Mediation Committee.

Article 42

(3) If a Committee member falls under any of the cases under paragraph (1) or (2), he/she may voluntarily withdraw from deliberation and resolution on a case.

Article 43 (Application, etc. for Mediation)

(1) Any person who wants a dispute over personal information to be mediated, may file an application with the Dispute Mediation Committee to conduct mediation.

(2) Upon receiving an application for mediation of a dispute from a party to a case, the Dispute Mediation Committee shall inform the other party of the details of such application.

(3) When a public institution is informed of mediation of a dispute under paragraph (2), it shall respond to mediation of the dispute unless extenuating circumstances exist.

Article 44 (Processing Period)

(1) The Dispute Mediation Committee shall examine a case and prepare a proposed mediation within 60 days from the date it has received an application for mediation of a dispute under Article 43 (1): Provided, That the processing period may be extended by the resolution of the Dispute Mediation Committee, if any unavoidable cause exists.

(2) When the Dispute Mediation Committee extends the processing period pursuant to the proviso to paragraph (2), it shall inform the applicant of the reasons for the extension of the period and other

Article 43 ~ 44

matters concerning the extension of the period.

Article 45 (Requests, etc. for Data)

(1) The Dispute Mediation Committee may request parties to a dispute to furnish it with data necessary for mediating the dispute. In such cases, the parties to the dispute shall comply with the request, unless any justifiable ground exists otherwise.

(2) The Dispute Mediation Committee may, if deemed necessary, require parties to a dispute and witnesses to make an appearance at the Dispute Mediation Committee to hear their opinions.

Article 46 (Recommendations on Agreement Prior to Mediation)

When the Dispute Mediation Committee receives an application for mediation of a dispute pursuant to Article 43 (1), it may present the details thereof to the parties to a case and recommend them to reach agreement prior to mediation.

Article 47 (Mediation of Disputes)

(1) The Dispute Mediation Committee may prepare a proposed mediation including any of the following matters:

1. Suspension of an infringement subject to investigation;

2. Reinstatement, compensation for loss, and other necessary remedies;

Article 45 ~ 47

3. Necessary measures to prevent the recurrence of the same or a similar infringement.

(2) Upon preparing a proposed mediation pursuant to paragraph (1), the Dispute Mediation shall present the proposed mediation to each party without delay.

(3) When each party to a dispute in receipt of a proposed mediation under paragraph (1) fails to inform the Dispute Mediation Committee of whether he/she accepts the proposed mediation within 15 days from the date on which he/she received such proposed mediation, he/she is deemed to reject mediation.

(4) If the parties to a dispute accept a proposed mediation, the Dispute Mediation Committee shall prepare a letter of mediation, and the chairperson of the Dispute Mediation Committee and parties to the dispute shall print their names and affix their seals on the letter of mediation.

(5) Details of mediation under paragraph (4) are as effective as judicial compromise.

Article 48 (Rejection and Suspension of Mediation)

(1) If the Dispute Mediation Committee deems that it is inappropriate to settle a dispute by mediation of the Dispute Mediation Committee in light of the nature of the dispute or an application for mediation has been filed for any unjust purpose, it may reject the application for mediation. In such cases, it shall notify

Article 48

the applicant of the grounds for rejection of the application for mediation and other related matters.

(2) If a party to a dispute files a lawsuit while proceedings of a case filed for mediation are in progress, the Dispute Mediation Committee shall suspend the mediation proceedings and notify the parties thereof.

Article 49 (Mediation of Collective Dispute)

(1) In connection with cases prescribed by Presidential Decree in which many owners of information suffer the same or similar types of loss or infringement of their rights, the State, a local government, a personal information protection organization or institution, an owner of information or a personal information manager may request or apply for mediation of a dispute collectively (hereinafter referred to as "mediation of a collective dispute") to the Dispute Mediation Committee.

(2) The Dispute Mediation Committee in receipt of a request or application for mediation of a collective dispute under paragraph (1) may start, by resolution, proceedings for mediation of the collective dispute pursuant to paragraphs (3) through (7). In such cases, the Dispute Mediation Committee shall announce that it started such proceedings for a period prescribed by Presidential Decree.

(3) The Dispute Mediation Committee may receive from an owner of information or a personal information manager that is not a party to mediation

Article 49

of a collective dispute an application requesting to be become an additional party to the mediation of the said dispute.

(4) The Dispute Mediation Committee may pass a resolution to appoint one person or several persons who are most appropriate for representing common interests as a representative party among parties to the mediation of a collective dispute under paragraphs (1) and (3).

(5) When a personal information manager accepts the mediation of a collective dispute done by the Dispute Mediation Committee, the Dispute Mediation Committee may recommend that the personal information manager prepare a compensation plan for an owner of information who is not a party to the mediation of the collective dispute and suffers loss and submit it to the Committee.

(6) Notwithstanding Article 48 (2), if some owners of information among many owners of information who are parties to the mediation of a collective dispute institute a suit in a court, the Dispute Mediation Committee shall exclude some owners of information who institute the suit from proceedings without suspending the proceedings.

(7) No period for the mediation of a collective dispute shall exceed 60 days from the date following that on which an announcement under paragraph (2) ends: Provided, That the period can be extended by the resolution of the Dispute Mediation Committee if any unavoidable reason exists.

Article 49

(8) Necessary matters concerning the proceedings for mediation of a collective dispute and other related matters shall be prescribed by Presidential Decree.

Article 50 (Mediation Procedures, etc.)

(1) Except as otherwise expressly provided for in Articles 43 through 49, necessary matters concerning the method and procedure for mediation of disputes, the handling of mediation affairs, and other related matters shall be prescribed by Presidential Decree.

(2) Except as otherwise expressly provided for in this Act, the Judicial Conciliation of Civil Disputes Act shall apply mutatis mutandis to matters concerning the operation of the Dispute Mediation Committee and the procedures for meditation of disputes.

CHAPTER VII CLASS ACTIONS ON PERSONAL INFORMATION

Article 51 (Those, etc. Eligible for Class Actions)

Any of the following organizations may institute an action requesting for the prohibition or suspension of an infringement on rights (hereinafter referred to as "class action") in a court if a personal information manager rejects the mediation of a collective dispute under Article 49 or does not accept the mediation

Article 50 ~ 51

results of the collective dispute:

1. Consumer organizations registered with the Fair Trade Commission pursuant to Article 29 of the Framework Act on Consumers that meet all of the following requirements:

(a) Their ordinary and primary objective shall be to promote the rights and interests of owners of information pursuant to articles of association;

(b) The number of their regular members shall be at least one thousand;

2. Non-profit, non-governmental organizations referred to in Article 2 of the Assistance for Non-Profit, Non-Governmental Organizations Act that meet all of the following requirements:

(a) They shall be requested to institute a class action from at least 100 owners of information which suffer a legal or factual same infringement;

(b) They shall have been working for the protection of personal information for the preceding three years or more after stipulating the protection of personal information as their objective in the articles of association;

Article 51

(d) They shall have to be registered with any central administrative agency.

Article 52 (Exclusive Jurisdiction)

(1) A class action shall be exclusively governed by the collegiate division of the district court having jurisdiction over the location in which a defendant's principal office or place of business is located, or the domicile of the person principally in charge of the defendant's business exists if such office or place of business does not exist.

(2) When applying paragraph (1) to a foreign enterpriser, the exclusive jurisdiction shall be determined based on the address of the principal office of place of business in the Republic of Korea or the address of the person principally in charge of his/her business.

Article 53 (Appointment of Litigation Representative)

The plaintiff of a class action shall appoint an attorney as a litigation representative.

Article 54 (Application for Permission to File Action)

(1) An organization instituting a class action shall file with the court a

Article 52 ~ 54

petition and an application for approval for such an action which states the following matters:

1. A plaintiff and his/her litigation representative;

2. A dependent;

3. Details of the infringed right.

(2) An application for action permission under paragraph (1) shall be accompanied by the following data:

1. Explanatory materials proving that an organization instituting an action meets any requirement referred in each subparagraph of Article 51;

2. Materials evidencing that a personal information manager rejects mediation or does not accept the result of mediation.

Article 55 (Requirements, etc. for Permission of Actions)

(1) The court shall rule to permit a class action only if all of the following requirements are met:

1. A personal information manager rejects mediation by the Dispute Mediation Committee or does not accept the result of mediation;

2. Information recorded in an application for permission of actions under Article 54 is incomplete.

Article 55

(2) An immediate appeal can be filed in connection with a decision to permit or not to permit a class action.

Article 56 (Validity of Final and Conclusive Rulings)

When a ruling dismissing a plaintiff's request becomes final and conclusive, other organizations under Article 51 may not institute a class action against the same case: Provided, That this shall not apply to any of the following cases:

1. When the State, a local government or an institution established by the State or a local government discovers new evidence of the case after the ruling becomes final and conclusive;

2. It is verified that a dismissal ruling is due to plaintiff's intention.

Article 57 (Application, etc. of the Civil Procedure Act)

(1) Unless otherwise provided in this Act, the Civil Procedure Act shall apply to class actions.

(2) When a decision to permit a class action is made under Article 55, preservative measures under PART IV of the Civil Execution Act can be taken.

(3) Necessary matters concerning class action procedures shall be determined by the Supreme Court Regulations.

CHAPTER VIII SUPPLEMENTARY PROVISIONS

Article 56 ~ 57

Article 58 (Partial Exemption from Application)

(1) Chapter III through VII shall not apply to any of the following personal information:

1. Personal information collected pursuant to the Statistics Act, among personal information managed by public institutions;

2. Personal information collected or requested to provide for the purpose of analyzing information related to national security;

3. Personal information managed temporarily as it is urgently necessary for ensuring the public safety and security, including public health, etc.;

4. Personal information collected or used by the press, a religious organization or a political party to achieve its intended purpose, such as collecting or reporting news, missionary work, recommendation of electoral candidates, etc.

(2) Articles 15, 22, 27 (1) and (2), 34 and 37 shall not apply to the personal information managed by installing and operating the image data processing equipment at a public space pursuant to each subparagraph of Article 25 (1).

(3) Articles 15, 30 and 31 shall not apply where a personal information manager manages personal information to operate a group for promoting

Article 58

friendship, such as an alumni association, club, etc.

(4) Although a personal information manager manages personal information pursuant to each subparagraph of paragraph (1), he/she shall manage personal information to the minimum extent necessary for achieving the purposes for a minimum period. The personal information manager shall prepare technical, administrative and physical protection measures necessary for safely administering personal information, and necessary measures for handling complaints concerning the management of personal information and appropriately managing personal information.

Article 59 (Prohibited Acts)

No person who has ever managed or manages personal information shall perform any of the following acts:

1. Acquiring personal information or obtaining consent to the management thereof by false or other unlawful means;

2. Revealing personal information that comes to his/her knowledge in the course of business or providing any third person with such information for his/her use without due authority;

3. Corrupting, destroying, altering, fabricating or divulging any third person's personal information without due authority or beyond granted authority.

Article 60 (Keeping Confidentiality, etc.)

Article 59 ~ 60

No person who performs or has performed the following affairs shall divulge any confidential information which he/she has become aware of in the course of performing his/her duties to any third person or use such information for any purpose other than for his/her duties: Provided, That, except as otherwise expressly provided for in other Acts, this shall not apply:

1. Affairs of the Protection Commission described in Article 8;

2. Impact assessment affairs described in Article 33;

3. Dispute mediation affairs of the Dispute Mediation Committee described in Article 40.

Article 61 (Presentation of Opinions and Recommendations on Improvements)

(1) The Minister of the Interior may present his/her opinion on statutes or municipal ordinances that contain provisions affecting the protection of personal information to any relevant agency, if deemed necessary, following deliberation and resolution thereon by the Protection Commission. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(2) If it is deemed necessary to protect personal information, the Minister of the Interior may recommend a personal information manager

Article 61

to impove the management of pesonal infomation. In such cases, the personal information manager in receipt of a recommendation shall endeavor to conscientiously implement the recommendation, and notify the Minister of the Interior of the result of measures taken. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(3) If it is deemed necessary to protect personal information, the head of a related central administrative agency may recommend a personal information manager to improve the management of personal information pursuant to the governing Acts. In such cases, the personal information manager in receipt of a recommendation shall endeavor to conscientiously implement the recommendation, and notify the head of the related central administrative agency of the result of measures taken.

(4) A central administrative agency, a local government, the National Assembly, the court, the Constitutional Court and the National Election Commission may present its opinion on the protection of personal information to, or instruct or inspect, agencies and public institutions under its jurisdiction.

Article 62 (Reporting, etc. Infringements)

(1) A person whose rights and interests are infringed when a personal information manager manages such person's personal information may report the infringement to the Minister of the Interior. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(2) The Minister of the Interior may designate a specialized institution, as

Article 62

precribed by Preidential Decree, in order to efficiently conduct the affairs concerning the receipt, processing, etc. of reporting under paragraph (1). In such cases, the specialized institution shall establish and operate a reporting center for infringements on personal information (hereinafter referred to as "reporting center"). <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(3) The reporting center shall conduct the following affairs:

1. Receipt of, and consultation on, reporting concerning the management of personal information;

2. Investigation and verification of infringements, and hearing of opinions from related persons;

3. Affairs incidental to those referred to in subparagraphs 1 and 2.

(4) The Minister of the Interior may assign a subordinate public official to the specialized institution designated under paragraph (2) pursuant to Article 32-4 of the State Public Officials Act, if necessary to efficiently conduct affairs, such as investigation, verification, etc. of infringements referred to in paragraph (3) 2. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

Article 63 (Requests for Submission of Data and Inspections)

(1) The Minister of the Interior may require a personal information manager to

Article 63

submit data, such as relevant articles and documents, in any of the following cases: <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

1. Where he/she discovers a violation of this Act or suspects a violation of this Act;

2. Where he/she receives reporting or a civil petition concerning a violation of this Act;

3. Other cases prescribed by Presidential Decree as necessary to protect personal information.

(2) Where a personal information manager fails to submit data pursuant to paragraph (1) or is deemed to have violated this Act, the Minister of the Interior may require a subordinate public official to access to the offices or places of business of the personal information manager and interested persons involved in the relevant violation of the Act, to inspect the business status, accounting books, documents, etc. In such cases, the public official who conducts an inspection shall carry a certificate indicating his/her authority and produce it to interested persons. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014; Act No. 13423, Jul. 24, 2015>

(3) The head of a related central administrative agency may require a personal information manager to submit data under paragraph (1) or may inspect the personal information manager and interested persons involved in the relevant violation of the Act under

Article 63

paagaph (2) pusuant to the govening Acts. <Amended by Act No. 13423, Jul. 24, 2015>

(4) Where the Protection Commission finds a violation of this Act or suspects a violation of this Act, it may demand the Minister of the Interior or the head of the relevant central administrative agency to take measures prescribed in paragraph (1) or (3). In such cases, the Minister of the Interior or the head of the central administrative agency in receipt of such demand shall comply therewith except in extenuating circumstances. <Newly Inserted by Act No. 13423, Jul. 24, 2015>

(5) The Minister of the Interior and the head of a related central administrative agency shall not provide any third party with documents, data, etc. received or collected under paragraphs (1) and (2) nor disclose the same to the general public, except as otherwise expressly provided for in this Act. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014; Act No. 13423, Jul. 24, 2015>

(6) Where the Minister of the Interior and the head of a related central administrative agency receives data via an information and communications network or computerizes the collected data, etc., he/she shall take institutional and technical measures to cure and prevent the divulgence of personal information, business proprietary information, etc. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(7) In order to prevent

Article 63

and effectively cope with infringements on personal information, the Minister of the Interior may inspect the protection of personal information jointly with the head of a related central administrative agency. <Newly Inserted by Act No. 13423, Jul. 24, 2015>

Article 64 (Corrective Measures, etc.)

(1) Where the Minister of the Interior finds reasonable grounds that personal information has been infringed on or negligence over such infringement is likely to cause unrecoverable damage, he/she may order a violator of this Act (excluding a central administrative agency, a local government, the National Assembly, the court, the Constitutional Court, and the National Election Commission) to take any of the following measures: <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

1. Suspending an infringement on personal information;

2. Temporary suspending the management of personal information;

3. Other measures necessary to protect personal information and to prevent infringements on personal information.

(2) Where the head of a related central administrative agency finds reasonable grounds that personal information has been infringed on or negligence over such infringement is likely to cause unrecoverable damage, he/she may order a personal information manager to take any of the measures referred to in paragraph (1)

Article 64

pursuant to the governing Acts.

(3) A local government, the National Assembly, the court, the Constitutional Court or the National Election Commission may order agencies and public institutions under its jurisdiction to take any of the measures referred to in paragraph (1) if they violate this Act.

(4) When a central administrative agency, a local government, the National Assembly, the court, the Constitutional Court or the National Election Commission violates this Act, the Protection Commission may recommend that the head of each relevant agency take any of the measures referred to in paragraph (1). In such cases, the agency in receipt of a recommendation shall comply therewith except in extenuating circumstances.

Article 65 (Complaints and Recommendations on Disciplinary Measures)

(1) If the Minister of the Interior finds reasonable grounds to suspect that a personal information manager has violated any statute related to the protection of personal information, including this Act, he/she may file a complaint with the competent investigation agency. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(2) If the Minister of the Interior finds reasonable grounds to believe that any statute related to the protection of personal information, including this Act, has been violated, he/she may recommend

Article 65

the relevant personal information manager to take disciplinary measures against the person responsible for it (including the representative and responsible executives). In such cases, the person in receipt of such recommendation shall comply therewith, and notify the Minister of the Interior of the result thereof. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 11990, Aug. 6, 2013; Act No. 12844, Nov. 19, 2014>

(3) The head of a related central administrative agency may file a complaint against a personal information manager pursuant to paragraph (1) or recommend the head of an agency, organization, etc. to which a responsible person belongs to take disciplinary measures pursuant to paragraph (2), as provided for in the governing Acts. In such cases, the person in receipt of recommendation under paragraph (2) shall comply therewith, and notify the head of the related central administrative agency of the result thereof.

Article 66 (Publication of Results)

(1) The Minister of the Interior may publish the details and the result of recommendations on improvements referred to in Article 61; corrective orders issued under Article 64; complaints and recommendations on disciplinary measures referred to in Article 65; and imposition of administrative fines referred to in Article 75, following deliberation and resolution thereon by the Protection Commission. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(2) The head of a related central administrative agency may publish matters referred

Article 66

to in paragraph (1) pursuant to the governing Acts.

(3) Methods, standards and procedures for publication described in paragraphs (1) and (2) and other related matters shall be prescribed by Presidential Decree.

Article 67 (Annual Reports)

(1) The Protection Commission shall annually prepare a report on the formulation and implementation of personal information protection policies after receiving necessary data from related agencies, etc., and shall submit (including submission via an information and communications network) it to the National Assembly before the regular session opens.

(2) The report referred to in paragraph (1) shall contain the following matters:

1. Infringements on the rights of owners of information and the status of remedy;

2. Findings from the investigation of the management of personal information;

3. Current status and performance of personal information protection policies;

4. Foreign legislation and policy trends on personal information;

5. Other matters

Article 67

to be disclosed or reported in relation to the peonal information protection policies.

Article 68 (Delegation and Entrustment of Authority)

(1) The Minister of the Interior or the head of a related central administrative agency may partially delegate or entrust his/her authority under this Act to the Special Metropolitan City Mayor, a Metropolitan City Mayor, a Do Governor, a Special Self-Governing Province Governor or a specialized institution determined by Presidential Decree, as prescribed by Presidential Decree. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(2) Agencies delegated or entrusted with the authority of the Minister of the Interior or the head of a related central administrative agency pursuant to paragraph (1) shall notify the Minister of the Interior or the head of the related central administrative agency of the results of performing the delegated or entrusted affairs. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

(3) Where the Minister of the Interior partially delegates or entrusts his/her authority to a specialized institution pursuant to paragraph (1), he/she may provide the specialized institution with contributions necessary for covering expenses incurred in performing the affairs. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

Article 69 (Deemed Public Official for Purposes of Penalty Provisions)

Article 68 ~ 69

For the purposes of Articles 129 through 132 of the Criminal Act, an executive or employee of a relevant agency performing the affairs entrusted by the Minister of the Interior or the head of a related central administrative agency shall be deemed a public official. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

CHAPTER IX PENALTY PROVISIONS

Article 70 (Penalty Provisions)

Any of the following persons shall be punished by imprisonment with labor for not more than ten years or by a fine not exceeding one hundred million won: <Amended by Act No. 13423, Jul. 24, 2015>

1. A person who seriously hinders, interrupts, or paralyzes the affairs of a public institution by altering or deleting personal information managed by the public institution with the intention of interfering with the management of personal information;

2. A person who obtains any personal information managed by a third party by fraudulent or other wrongful means or methods, and provides it to a third party for gain or an illegal purpose and a person who abets or arranges such conduct.

Article 71 (Penalty Provisions)

Any of the following

Article 70 ~ 71

persons shall be punished by imprisonment with labor for not more than five years or by a fine not exceeding fifty million won:

1. A person who provides a third party with personal information without obtaining the consent of an owner of information, in violation of Article 17 (1) 1 or 2, and a person who knowingly receives such personal information;

2. A person who uses personal information or provides a third party with personal information, in violation of Articles 18 (1) and (2), 19, 26 (5) or 27 (3), and a person who knowingly receives personal information for gain or an illegal purpose;

3. A person who manages sensitive information, in violation of Article 23;

4. A person who manages personally identifiable information, in violation of Article 24 (1);

5. A person who divulges personal information that he/she has become aware of in the course of performing his/her duties or provides any third party with such information without due authority, in violation of subparagraph 2 of Article 59, and a person who knowingly receives personal information for gain or an illegal purpose;

6. A person who damages, destroys, alters, forges or divulges any third party's personal information, in violation of subparagraph

Article 71

3 of Article 59.

Article 72 (Penalty Provisions)

Any of the following persons shall be punished by imprisonment with labor for not more than three years or by a fine not exceeding 30 million won:

1. A person who arbitrarily handles image data processing equipment for any purpose other than the intended purpose of installation, films other locations, or uses a recording function, in violation of Article 25 (5);

2. A person who acquires personal information or obtains consent to the management of personal information by false or other unlawful means, in violation of subparagraph 1 of Article 59, and a person who knowingly receives personal information for profit or an unjust purpose;

3. A person who reveals confidential information that comes to his/her knowledge in the course of his/her business or uses such information for any purpose other than for his/her duties, in violation of Article 60.

Article 73 (Penalty Provisions)

Any of the following persons shall be punished by imprisonment with labor for not more than two years or by a fine not exceeding twenty million won: <Amended by Act No. 13423, Jul. 24, 2015>

1. A person whose

Article 72 ~ 73

personal information is lost, stolen, divulged, forged, altered or damaged due to a failure to take necessary measures for ensuring safety, in violation of Article 24 (3), 25 (6) or 29;

2. A person who keeps using personal information without taking necessary measures, such as correction and deletion, in violation of Article 36 (2), or provides a third party with such information;

3. A person who keeps using personal information without suspending the management thereof, in violation of Article 37 (2), or provides a third party with such information.

Article 74 (Joint Penalty Provisions)

(1) If the representative of a corporation or an agent or employee of, or any other person employed by, a corporation or an individual commits an offense referred to in Article 70 in connection with the business affairs of the corporation or individual, not only shall such offender be punished, but also the corporation or individual shall be punished by a fine not exceeding 70 million won: Provided, That the same shall not apply where such corporation or individual has not been negligent in giving due attention and supervision concerning the relevant business affairs to prevent such offense.

(2) If the representative of a corporation or an agent or employee of, or any other person employed by, a corporation or an individual commits any offense referred to in Articles 71 through 73 in connection

Article 74

with the business affairs of the corporation or individual, not only shall such offender be punished, but also the corporation or individual shall be punished by a fine under the relevant provisions: Provided, That the same shall not apply where such corporation or individual has not been negligent in giving due attention and supervision concerning the relevant business affairs to prevent such offense.

Article 74-2 (Confiscation, Collection, etc.)

Money, goods or other gains acquired by a person who has committed any of the crimes prescribed in Articles 70through 73 in connection with the relevant crime may be confiscated, and where it is impracticable to confiscate them, the equivalent value may be collected. In such cases, the confiscation or collection may be conducted in addition to other penalties.

[This Article Newly Inserted by Act No. 13423, Jul. 24, 2015]

Article 75 (Administrative Fines)

(1) Any of the following persons shall be subject to an administrative fine not exceeding 50 million won:

1. A person who collects personal information, in violation of Article 15 (1);

2. A person who fails to obtain the consent of a legal representative, in violation of Article 22 (5);

3. A person who

Article 74-2 ~ 75

installs and perates the image data prcessing equipment, in violation of Article 25 (2).

(2) Any of the following persons shall be subject to an administrative fine not exceeding 30 million won: <Amended by Act No. 11990, Aug. 6, 2013; Act No. 12504, Mar. 24, 2014; Act No. 13423, Jul. 24, 2015>

1. A person who fails to notify an owner of information of the matters to be notified, in violation of Article 15 (2), 17 (2), 18 (3) or 26 (3);

2. A person who refuses to provide goods or services, in violation of Article 16 (3) or 22 (4);

3. A person who fails to notify an owner of information of the matters referred to in Article 20 (1), in violation of Article 20 (1);

4. A person who fails to destroy personal information, in violation of Article 21 (1);

4-2. A person who manages resident registration numbers, in violation of Article 24-2 (1);

4-3. A person who fails to take encryption measures, in violation of Article 24-2 (2);

5. A person who fails to provide an owner of information with a way to register as a member without providing his/her resident registration

Article 75

number, in violation of Article 24-2 (3);

6. A person who fails to take measures necessary for ensuring safety, in violation of Article 24 (3), 25 (6) or 29;

7. A person who installs and operates the image data processing equipment, in violation of Article 25 (1);

7-2. A person who falsely indicates or publicizes the details of certificates without obtaining certification, in violation of Article 32-2 (6);

8. A person who fails to notify an owner of information of the facts referred to in Article 34 (1), in violation of Article 34 (1);

9. A person who fails to report the results of measures taken, in violation of Article 34 (3);

10. A person who restricts or rejects access to information, in violation of Article 35 (3);

11. A person who fails to take necessary measures, such as correction and deletion, in violation of Article 36 (2);

12. A person who fails to take necessary measures, such as destruction, in connection with the personal information suspended from management, in violation of Article 37 (4);

Article 75

13. A person who fails to comply with a corrective order issued under Article 64 (1).

(3) Any of the following persons shall be subject to an administrative fine not exceeding ten million won:

1. A person who fails to separately save and administer personal information, in violation of Article 21 (3);

2. A person who obtains consent, in violation of Article 22 (1) through (3);

3. A person who fails to take necessary measures, such as installation of a signboard, in violation of Article 25 (4);

4. A person who fails to outsource his/her affairs in writing stating the matters referred to in Article 26 (1), in violation of Article 26 (1);

5. A person who fails to disclose the details of outsourced affairs and the identity of a contract accepter, in violation of Article 26 (2);

6. A person who fails to notify an owner of information of the fact that his/her personal information has been transferred, in violation of Article 27 (1) or (2);

7. A person who

Article 75

fails t frmulate r disclse persnal infrmatin management policies, in violation of Article 30 (1) or (2);

8. A person who fails to designate a personal information protection manager, in violation of Article 31 (1);

9. A person who fails to notify an owner of information of the matters to be notified, in violation of Article 35 (3) and (4), 36 (2) and (4), or 37 (3);

10. A person who fails to submit data, such as relevant articles, documents, etc. referred to in Article 63 (1) or submits false data;

11. A person who refuses, interferes with or evades the access and inspections referred to in Article 63 (2).

(4) Administrative fines described in paragraphs (1) through (3) shall be imposed and collected by the Minister of the Interior and the head of a related central administrative agency, as prescribed by Presidential Decree. In such cases, the head of a related central administrative agency shall impose and collect administrative fines on/from a personal information manager under his/her jurisdiction. <Amended by Act No. 11690, Mar. 23, 2013; Act No. 12844, Nov. 19, 2014>

Article 76 (Special Exceptions to Application of Provisions on Administrative Fines)

For the purposes

Article 76

of the provisions of administrative fin referred to in Article 75, no administrative fine shall be imposed on any violation on which penalty surcharges have been imposed pursuant to Article 34-2.

[This Article Newly Inserted by Act No. 11990, Aug. 6, 2013]

ADDENDA

Article 1 (Enforcement Date)

This Act shall enter into force six months after the date of its promulgation: Provided, That Articles 24 (2) and 75 (2) 5 shall enter into force one year after the date of its promulgation.

Article 2 (Repeal of other Acts)

The Act on the Protection of Personal Information Maintained by Public Institutions is hereby repealed.

Article 3 (Transitional Measures concerning Personal Information Dispute Mediation Committee)

An act performed by or against the Personal Information Dispute Mediation Committee under the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. as at the time this Act enters into force shall be deemed an act performed by or against the Personal Information Dispute Mediation Committee corresponding thereto under

Addenda

this Act.

Article 4 (Transitional Measures concerning Personal Information being Managed)

Any personal information legitimately managed under other Acts before this Act enters into force shall be deemed to have been managed under this Act.

Article 5 (Transitional Measures concerning Application of Penalty Provisions)

(1) The application of the penalty provisions to a violation of the previous Act on the Protection of Personal Information Maintained by Public Institutions before this Act enters into force shall be governed by the previous Act on the Protection of Personal Information Maintained by Public Institutions.

(2) The application of the penalty provisions to a violation of the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. before this Act enters into force shall be governed by the previous Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

Article 6 Omitted.

Article 7 (Relationship to other Acts)

Where the previous

Addenda

Act on the Protection of Personal Information Maintained by Public Institutions or the provisions thereof are cited in other statutes at the time this Act enters into force, and any provision corresponding thereto exists in this Act, this Act or the corresponding provision of this Act shall be deemed cited in lieu of the previous provision.

ADDENDA <Act No. 11690, Mar. 23, 2013>

Article 1 (Enforcement Date)

(1) This Act shall enter into force on the date of its promulgation.

(2) Omitted.

Articles 2 through 7 Omitted.

ADDENDA <Act No. 11990, Aug. 6, 2013>

Article 1 (Enforcement Date)

This Act shall enter into force one year after the date of its promulgation.

Article 2 (Transitional Measures concerning Restriction on Management of Resident Registration Numbers)

(1) A person who manages resident registration numbers at the time this Act enters into force shall destroy the resident registration numbers possessed, within two years from the enforcement date of

Addenda

this Act: Provided, That any the cases falling under the amended subparagraphs of Article 24-2 (1) shall be excluded from the destruction.

(2) Where no resident registration numbers possessed are destroyed within the period referred to in paragraph (1), the amended provisions of Article 24-2 (1) shall be deemed to have been violated.

ADDENDUM <Act No. 12504, Mar. 24, 2014>

This Act shall enter into force on the date of its promulgation: Provided, That the amended provisions of Articles 24-2 and 75 (2) 5 of the Personal Information Protection Act (Act No. 11990) shall enter into force on January 1, 2016.

ADDENDA <Act No. 12844, Nov. 19, 2014>

Article 1 (Enforcement Date)

This Act shall enter into force on the date of its promulgation. (Proviso Omitted.)

Articles 2 through 7 Omitted.

ADDENDA <Act No. 13423, Jul. 24, 2015>

Article 1 (Enforcement Date)

This Act shall enter into force on the date of its promulgation: Provided,

Addenda

That the amended provisions of Articles 8 (1), 8-2, 9, 11 (1), 32-2, 39 (3) and (4), 39-2, 40, and 75 (2) 7-2 shall enter into force one year after the date of its promulgation, and the amended provisions of the forepart of Article 24-2 (2) and Article 75 (2) 4-3 of the partially amended Personal Information Protection Act (Act No. 12504) shall enter into force on January 1, 2016, respectively.

Article 2 (Applicability to Compensation)

The amended provisions of Articles 39 (3) and (4) and 39-2 shall apply, beginning with the first claim for damages filed in connection with personal information lost, stolen, divulged, forged, altered or damaged after this Act enters into force.

Article 3 (Transitional Measures concerning Certification as to Protection of Personal Information)

A person who has obtained certification as to protection of personal information from the Minister of the Interior before this Act enters into force shall be deemed obtained certification as to protection of personal information under the amended provisions of Article 32-2.

Article 4 (Transitional Measures concerning Qualifications as Certification Examiners for Protection of Personal Information)

A person who has been qualified as a certification examiner for the protection of personal information before this Act enters into force

Addenda

shall be deemed qualified as a rtification examiner for the protection of personal information under this Act.

Article 5 (Transitional Measures concerning Terms of Office of Members of Dispute Mediation Committee)

Members of the Dispute Mediation Committee appointed or commissioned by the Minister of the Interior before this Act enters into force shall be deemed members of the Dispute Mediation Committee commissioned by the Protection Commission under the amended provisions of Article 40.

Article 6 (Transitional Measures concerning Penalty Provisions, etc.)

The former provisions shall apply to the application of penalty provisions or imposition of administrative fines for offenses committed before this Act enters into force.

Addenda