of the said personal data in whole or in part as demanded by the Data Subject; provided, however, that, where any of the following subparagraphs is applicable, the Personal Data Controller may reject the demand of the said Data Subject: 1. Where it is specifically stipulated by law or it is inevitably necessary to observe obligations under relevant laws and regulations; 2. Where it may probably cause damage to the life or body of others, or improper violation of properties and benefits of others; 3. Where the public institution cannot carry out its work as prescribed by other laws without processing the personal data in question; or 4. Where it is difficult to fulfill a contract entered by and between the Personal Data Controller and the Data Subject without processing the personal data and where the Data Subject fails to express explicitly the termination of the said contract. (3) The Personal Data Controller shall, when rejecting the demand pursuant to the proviso of paragraph (2)notify the Data Subject of the reason without delay. (4) The Personal Data Controller shall, without delay, take necessary measures including destruction of the relevant personal data when suspending the processing of personal data as demanded by
consent pursuant to paragraph (2), notify the User in advance of the whole matters stated in the following subparagraphs: 1. The items of personal information to be transferred; 2. The state to which personal information will be transferred, the date and time of transfer and the method thereof; 3. The name (referring to the company name and the contact points of the officer in charge of data protection in case of a juridical person) of a person who will be provided with the personal information; and 4. The purpose of utilization, and the period of retention and utilization, of personal information on the part of a person who will be provided with the personal information. (4) The Information and Communications Service Provider, etc. shall take the protective measures as prescribed by the Presidential Decree when they transfer the personal information to abroad with the consent pursuant to paragraph (2). 12. If you answered YES to question 10 and/or question 11, is the disclosure and/or transfer undertaken to fulfill the original purpose of collection or Article 24 (Restrictions on Utilizing Personal Information) No Information and Communications Service Provider shall utilize the personal information collected pursuant to Article 22 and the proviso of Article 23(1) for other purpose than the purpose consented by the relevant User or referred to in each subparagraph of Article 22(2). Article 18 (Limitations to Out-of-Purpose Use and Provision of Personal Data) (1) The Personal Data Controller shall not use personal data beyond the scope stated in Article 15(1), and shall not provide it to a third party beyond the scope stated in Article 17(1) and (3). (2) Notwithstanding paragraph (1), where any of the following subparagraphs applies, the Personal Data Controller may use
another compatible or related purpose? If YES, describe. Article 24-2 (Consent to the Provision of Personal Information, etc.) (2) The receiver of the personal information of Users provided by the Information and Communications Service Provider pursuant to paragraph (1) shall not provide such personal information to a third party, nor utilize such personal information for other use than the purpose of being provided except the cases specified in other acts. personal data for a purpose other than the intended one, or provide it to a third party, unless it likely infringes upon unfairly the interests of Data Subjects or a third party; provided, however, that subparagraphs 5 through 9 are applicable only to public institutions. 1. Where separate consent is obtained from Data Subjects; 2. Where special provisions exist in laws; 3. Where it is deemed explicitly necessary for the protection of, from impending danger, the life, body or economic profits of the Data Subject or a third party in case that the Data Subject or his/her legal representative is not in a position to express intention, or when prior consent cannot be obtained owing to unknown addresses; 4. Where personal data is provided in a manner that keeps individuals unidentifiable necessarily for the purposes of statistics and academic research, etc.; 5. Where it is impossible to carry out the work under its jurisdiction as stated in other laws unless the Personal Data Controller uses personal data for a purpose other than the intended one, or provides it to a third party, and it is subject to the deliberation and resolution of the Commission; 6. Where it is necessary to provide personal data to a foreign government or international organization so as to abide by a treaty obligation or other international
the grounds that the User does not provide any other personal information than the necessary minimum personal information. In this case, the necessary minimum personal information shall mean the inevitable information necessary to perform the fundamental function of the relevant service. explicitly, and obtain their consent thereof. (4) The Personal Data Controller shall not refuse the provision of goods or services to the Data Subjects on the ground that the Data Subjects would not consent to the matter eligible for selective consent pursuant to paragraph (2), or (3) and Article 18(2)i. (5) The Personal Data Controller shall, when required to obtain consent in accordance with this Act with regards to children below the age of 14 years, obtain consent from their legal representatives. In such case, the minimum personal data necessary to obtain consent from the legal representatives may be collected directly from such children without the consent of their legal representatives. 16. Subject to the qualifications described below, do you provide a mechanism for individuals to exercise choice in relation to the disclosure of their personal information? Where YES describe such mechanisms below. Where the Applicant answers YES, the Accountability Agent must verify that the Applicant provides a description of how individuals may exercise choice in relation to the disclosure of their personal information, such as: ∙ Online at point of collection ∙ Via e-mail ∙ Via preference/profile Article 24-2 (Consent to the Provision of Personal Information, etc.) (1) Any Information and Communications Service Provider shall, when it intends to provide User's personal information to a third party, notify the User of the whole matters stated in the following subparagraphs except the cases falling under subparagraphs 2 and 3 of Article 22(2), and obtain his/her consent thereof. The same shall apply to any change of the following subparagraphs: 1. The receiver of personal information; 2. The purpose of utilizing personal information of such receiver; 3. The items of personal information provided Article 17 (Provision of Personal Data) (1) The Personal Data Controller may provide (or share, hereinafter the same applies) the personal data of Data Subjects to a third party in cases applicable to any of the following subparagraphs: 1. Where the consent of the Data Subject is obtained; or 2. Where personal data is provided within the scope of purposes for which personal data is collected under subparagraphs 2, 3 and 5 of Article 15(1); (2) The Personal Data Controller shall inform Data Subjects of the following when it
disclose his/her Privacy Policy to the public under the title “Privacy Policy” by any of the following methods, based upon the place, media, etc. from which personal information has been collected: 1. Displaying the information about matters specified in Article 27-2 (2) of the Act on the first page of his/her web-site or a page linked to the first page to ensure that Users can read the information. In such cases, the Information and Communications Service Providers shall display the Privacy Policy conspicuously by utilizing size, color, etc. of fonts to ensure that Users can easily read; 2. Posting or keeping the information at a place where such information is easily noticeable in a shop or office; 3. Publishing the information in periodicals, new bulletins, leaflets, or bills issued regularly and distributed to Users at least twice a year under an identical title. (2) Pursuant to Article 27-2 (3) of the Act, reasons why a Privacy Policy is revised and the details of such revision shall be publicly notified by at least one of the following methods: 1. Posting public notice on a space for public notice in the first page of the web-site operated by the Information and Communications Service Providers or on a separate page; 2. Giving notice to Users by writing, facsimile, (4) The Personal Data Controller shall not refuse the provision of goods or services to the Data Subjects on the ground that the Data Subjects would not consent to the matter eligible for selective consent pursuant to paragraph (2), or (3) and Article 18(2)i. (5) The Personal Data Controller shall, when required to obtain consent in accordance with this Act with regards to children below the age of 14 years, obtain consent from their legal representatives. In such case, the minimum personal data necessary to obtain consent from the legal representatives may be collected directly from such children without the consent of their legal representatives. ENFORCEMENT DECREE Article 31 (Establishment and Disclosure of Privacy Policy) (1) “Other matters as stated in the Presidential Decree” in Article 30(1)vi shall mean the matters of following subparagraphs: 1. Items of personal information to be processed; 2. Matters in relation to destruction of personal information; and 3. Matters in relation to safety measures
which the User can check the relevant Internet address and matters subject to consent and then calling the User again to obtain consent over the telephone. (2) If it is impracticable for a Information and Communications Service Provider to fully state matters subject to consent due to the characteristics of a medium for collecting personal information, he/she may inform each User of a method by which the User can check matters subject to consent (Internet address, telephone numbers of the place of business, etc.) to obtain consent from the User. 18. When choices are provided to the individual offering the ability to limit the collection (question 14), use (question 15) and/or disclosure (question 16) of their personal information, are they clearly worded and easily understandable? Where the Applicant answers YES, the Accountability Agent must verify that the Applicant’s choice mechanism is clearly worded and easily understandable. Where the Applicant answers NO, and/or when the Accountability Agent finds that the Applicant’s choice mechanism is not clearly worded and easily understandable, the Accountability Agent must Article 27-2 (Disclosure of Privacy Policy) (1) In case of processing the personal information of Users, the Information and Communications Service Provider, etc. shall establish and disclose the Privacy Policy in such a manner as stated in the Presidential Decree so that Users may identify the policy with ease at any time. (2) The Privacy Policy subject to paragraph (1) shall contain each and all following subparagraphs: 1. The purpose of collection and utilization of the personal information, particulars of personal information collected hereunder and the method of collection thereof; 2. The name (referring to the company name in case of a juridical person) of a person who has Article 30 (Establishment and Disclosure of Privacy Policy) (1) The Personal Data Controller shall establish a personal data processing policy including the particulars in the following subparagraphs (hereinafter the "Privacy Policy"). In such case, the public institutions shall set up the Privacy Policy regarding the personal data files subject to be registered pursuant to Article 32: 1. The purpose of processing the personal data; 2. The period for processing and retention of the personal data; 3. Provision of the personal data to a third party (if applicable); 4. Entrustment of processing the personal
provider, etc.; 2. The content of how the information and communications service provider, etc. has utilized, or provided to a third party, the personal information of users; or 3. The status at which the information and communications service provider, etc. has obtained consent for the collection, utilization or provision of the personal information. (6) The Information and Communications Service Provider, etc. shall make the withdrawal of consent pursuant to paragraph (1), or how to request access to, provision of, or correction of errors in, the personal information much easier than the method how to collect the personal information. ENFORCEMENT DECREE Article 14 (Methods, etc. for Public Disclosure of Privacy Policy) (1) Pursuant to Article 27-2 (1) of the Act, in case of the Information and Communications Service Providers process personal information(any act of collecting, generating, connecting, interworking, recording, storing, retaining, value-added processing, editing, retrieving, printing, rectifying, restoring, using, providing, disclosing and destructing of personal information and other similar activities;), they shall disclose his/her Privacy Policy to the public under the title “Privacy Policy” by any of the following methods, based upon the place, media, etc. from refuse the provision of goods or services to the Data Subjects on the ground that the Data Subjects would not consent to the matter eligible for selective consent pursuant to paragraph (2), or (3) and Article 18(2)i. (5) The Personal Data Controller shall, when required to obtain consent in accordance with this Act with regards to children below the age of 14 years, obtain consent from their legal representatives. In such case, the minimum personal data necessary to obtain consent from the legal representatives may be collected directly from such children without the consent of their legal representatives. ENFORCEMENT DECREE Article 31 (Establishment and Disclosure of Privacy Policy) (1) “Other matters as stated in the Presidential Decree” in Article 30(1)vi shall mean the matters of following subparagraphs: 1. Items of personal information to be processed; 2. Matters in relation to destruction of personal information; and 3. Matters in relation to safety measures of personal information subject to Article 30.
29. Describe how you make your employees aware of the importance of maintaining the security of personal information (e.g. through regular training and oversight). The Accountability Agent must verify that the Applicant's employees are aware of the importance of, and obligations respecting, maintaining the security of personal information through regular training and oversight as demonstrated by procedures, which may include: ∙ Training program for employees ∙ Regular staff meetings or other communications ∙ Security policy signed by employees ∙ Other (specify) Where the Applicant answers that it does not make employees aware of the importance of, and obligations respecting, maintaining the security of Article 28 (Data Protection Measures) (1) In case of processing the personal information of Users, the Information and Communications Service Provider, etc. shall take such technological and managerial measures as mentioned in the following subparagraphs to prevent the loss, theft, leakage, forgery, alteration of, or damage to, the personal information and to ensure the safety of personal information by the standard as specified by the Presidential Decree. 1. To establish and implement the in-house management plan to process the personal information more safely; (2) The Information and Communications Service Provider, etc. shall limit the persons to process the personal information of Users to the minimum. ENFORCEMENT DECREE Article 15 (Protection Measures for Personal Information) (1) Pursuant to Article 28 (1) 1 of the Act, a Information and Communications Service Provider shall festablish and implement the management plan, including the following matters, in order to ensure safety in processing personal information: 1. The formation and operation of an organization for the protection of personal information, Article 28 (Supervision of the Personal Data Manager) (1) The Personal Data Controller shall see to it that the persons in charge of processing personal data, including employees, dispatched workers, part-timers, etc. are appropriately controlled and supervised by a designated manager (hereinafter the "Personal Data Manager") in order to ensure that personal data is properly managed. (2) The Personal Data Controller shall provide an appropriate educational program to the Personal Data Manager on a regular basis to ensure appropriate handling thereof.
Communications Service Provider, etc.; provided, however, that, if the business owner or representative shall become the Privacy Officer, the provision regarding report of corrective measures shall not apply. ※ (STANDARD ON TECHNOLOGICAL AND MANAGERIAL MEASURES OF PERSONAL INFORMATION PROTECTION) Korea Communications Commission established minimum standard to prevent the loss, theft, leakage, forgery, alteration of, or damage to, the personal information and to ensure the safety of personal information by Notification, accordingly the Information and Communications Service Providers shall establish and implement their own safeguards, considering the size of their businesses and the number of personal information they process 34. Do you use risk assessments or third-party certifications? Describe below. The Accountability Agent must verify that such risk assessments or certifications are undertaken at appropriate intervals, and that the Applicant adjusts their security safeguards to reflect the results of these certifications or risk assessments. One example is whether privacy Article 47-3 (Certification of Personal Information Management System) (1) The Korea Communications Commission may certify for the purpose of carrying out systemic and sustainable personal information protection activities in the communications network whether the person who has established and operated a consolidated management system including the managerial, technical and physical safeguards (hereinafter referred to as the “Personal Information Management System” or PIMS) could satisfy the criteria subject to paragraph (2). Article 32-2 (Certification of Personal Data Protection) (1) The Minister of the Interior may certify whether the data processing and other personal data protection related action of the Personal Data Controller abide by this Act, etc. (2) The certification pursuant to paragraph (1) shall be effective for three years. (3) The Minister of the Interior may withdraw the certification pursuant to paragraph (1) as stipulated by presidential decree if any of the following subparagraphs
Agency shall, without delay, inform the fact of the Korea Communications Commission. (3) The Information and Communications Service Provider, etc. shall explain the justifiable reasons pursuant to the main sentence and proviso of paragraph (1) to the Korea Communications Commission. (4) The method, procedure, etc. of notification and report pursuant to paragraph (1) and other necessary matters shall be prescribed by the Presidential Decree. (5) The Information and Communications Service Provider, etc. shall prepare for the leakage, etc. of personal information, and explore ways to establish measures to minimize the damage to victims. Article 28 (Data Protection Measures) (1) In case of processing the personal information of Users, the Information and Communications Service Provider, etc. shall take such technological and managerial measures as mentioned in the following subparagraphs to prevent the loss, theft, leakage, forgery, alteration of, or damage to, the personal information and to ensure the safety of personal information by the standard as specified by the Presidential Decree. 1. To establish and implement the in-house management plan to process the personal information more safely; 2. To install and operate the access control managerial and physical measures such as establishment of internal management plan and preservation of log-on records, etc. necessary to ensure security as stipulated by presidential decree so as to prevent personal data from being lost, stolen, leaked, forged, fabricated or damaged. Article 34 (Personal Data Breach Notification, etc.) (1) The Personal Data Controller shall notify the relevant Data Subjects without delay of the fact in the following subparagraphs when it becomes aware of the leakage of any personal data: 1. Items of personal data that had been leaked; 2. When and how the personal data was leaked; 3. Any measures that Data Subject may take in order to minimize probable damage that may break out due to leakage of personal data ; 4. Countermeasures of the Personal Data Controller and remedial procedures; and 5. Help desk of the Personal Data Controller and contact points for Data Subjects to report damages incurred due to the leakage of the personal data. (2) The Personal Data Controller shall
personal information to a third party, nor utilize such personal information for other use than the purpose of being provided except the cases specified in other acts. Article 25 (Entrusting Processing of Personal Information) (3) The Information and Communications Service Provider, etc. shall, when it intends to entrust processing of personal information, define the purpose in advance for which the trustee shall process the personal information of Users. The trustee shall not process the personal information of Users beyond such purpose. (4) The Information and Communications Service Provider, etc. shall manage, supervise and educate the trustee lest it should violate the provisions in this Chapter. (5) The trustee, who caused damage to the Users regarding the work processing entrusted hereunder in violation of the provisions in this Chapter, shall be deemed as an employee of the Information and Communications Service Provider, etc. only with respect to compensation for such damage. (6) What the Information and Communications Service Provider, etc. has entrusted processing of personal information to a trustee shall be in writing. 4. The fact that Data Subjects are entitled to refuse consent, and details of disadvantage, if any, due to refusal of consent. Article 16 (Limitations to Collection of Personal Data) (1) The Personal Data Controller shall collect the minimum personal data necessary to attain the purpose in any case applicable to any subparagraph of Article 15(1). In such case, the burden of proof that the minimum personal data is collected shall be borne by the Personal Data Controller. (2) The Personal Data Controller may collect personal data only after clearly informing the Data Subject that he/she may refuse consent to the collection of other personal data other than the minimum necessary. (3) The Personal Data Controller shall not refuse the provision of goods or services to the Data Subjects on the ground that the Data Subject did not consent to the collection of personal data exceeding the minimum requirement. Article 17 (Provision of Personal Data) (1) The Personal Data Controller may provide (or share, hereinafter the same applies) the personal data of Data Subjects to a third party in cases applicable to any of the following subparagraphs: 1. Where the consent of the Data Subject
subparagraphs: 1. The items of personal information to be transferred; 2. The state to which personal information will be transferred, the date and time of transfer and the method thereof; 3. The name (referring to the company name and the contact points of the officer in charge of data protection in case of a juridical person) of a person who will be provided with the personal information; and 4. The purpose of utilization, and the period of retention and utilization, of personal information on the part of a person who will be provided with the personal information. (4) The Information and Communications Service Provider, etc. shall take the protective measures as prescribed by the Presidential Decree when they transfer the personal information to abroad with the consent pursuant to paragraph (2). Article 28 (Data Protection Measures) (1) In case of processing the personal information of Users, the Information and Communications Service Provider, etc. shall take such technological and managerial measures as mentioned in the following subparagraphs to prevent the loss, theft, leakage, forgery, alteration of, or damage to, the personal information and to ensure the of paragraph (2), the Personal Data Controller shall request the recipient of the personal data to restrict the purpose and method of use and other necessary matters, or to prepare necessary measures to ensure the safety of the personal data. In such case, the person who is requested shall take necessary measures to ensure the safety of the personal data. Article 26 (Limitation to Processing Personal Data Subsequent to Entrustment of Work) (1) The Personal Data Controller shall, when entrusting the processing of personal data to a third party, shall implement and use paper-based formalities as stated in the following subparagraphs: 1. Prevention of processing personal data for any purposes other than those intended; 2. Technical and managerial safeguards of personal data; and 3. Other matters stipulated by presidential decree for the safe management of personal data (4) The entrustor shall instruct the entrustee to prevent the personal data of Data Subjects from being lost, stolen, leaked, forged, fabricated or damaged due to the entrustment of tasks and shall supervise the entrustee to ensure that the entrustee properly manages, protects and processes such personal data in accordance with
safety of personal information by the standard as specified by the Presidential Decree. 1. To establish and implement the management plan to process the personal information more safely; 2. To install and operate the access control system like firewall to block illegal access to the personal information; 3. To take measures to prevent the forgery or falsification of logon files; 4. To take security measures using encryption technologies in order to store and transmit the personal information more safely; 5. To take such preventive measures as download and operation of the vaccination softwares to protect from computer viruses; and 6. To take other protective measures necessary to secure the safety of the personal information. (2) The Information and Communications Service Provider, etc. shall limit the persons to process the personal information of Users to the minimum. Article 27-3 (Notification and Report of Personal Information Leakage, etc.) (1) Upon knowing the loss, theft and leakage of personal information (hereinafter referred to as "leakage, etc."), the Information and methods stipulated by presidential decree, such as inspecting of processing the personal data. (5) The entrustee shall not use personal data beyond the scope of the tasks entrusted by the Personal Data Controller, nor provide such personal data to a third party. (6) When civil liability to pay compensation arises as an entrustee violates this Act in the course of processing personal data in connection with the entrusted tasks, the entrustee shall be deemed as an employee of the entrustor. (7) Articles 15 through 25, 27 through 31, 33 through 38 and 59 shall apply mutatis mutandis to the entrustee. Article 29 (Duty of Security Measures) The Personal Data Controller shall take technical, managerial and physical measures such as establishment of internal management plan and preservation of records, etc. necessary to ensure security as stipulated by presidential decree so as to prevent personal data from being lost, stolen, leaked, forged, fabricated or damaged. Article 34 (Personal Data Breach