(1) The Personal Information Protection Commission (hereinafter referred to as the “Protection Commission”) shall be established under the Prime Minister to independently perform business affairs relating to the protection of personal information.

(2) The Protection Commission shall be deemed a central administrative agency under Article 2 of the Government Organization Act: Provided, That Article 18 of the Government Organization Act shall not apply to any of the following matters:

1. Business affairs specified in subparagraphs 3 and 4 of Article 7-8;
2. Matters falling under subparagraph 1 among those to be deliberated and resolved on under Article 7-9 (1).

(1) The Protection Commission shall be comprised of nine Commissioners including two Standing Commissioners (one Chairperson and one Vice Chairperson).

(2) Commissioners of the Protection Commission shall be selected from among any of the following persons with sufficient experience and expertise in the protection of personal information, with the Chairperson and Vice Chairperson being proposed by the Prime Minister, two other Commissioners being proposed by Chairperson, two other Commissioners being recommended by the negotiation body of the political party to which the President belongs or belonged, and three other persons being recommended by another negotiation body and named or appointed by the President:

1. A person who serves, or served, as a public official of Grade III or higher (including public officials belonging to the Senior Executive Service) who is responsible for personal information protection;
2. A person who has been serving, or served, as a judge, prosecutor or lawyer for 10 years or longer;
3. A person who served as an officer at a public institution or group (including groups comprised of personal information controllers) for three years or longer or a person recommended by the above public institution or group who was in charge of personal information protection for three years or longer;
4. A person who has expertise in a field relating to personal information and has been serving, or served, as an associate professor or higher at a school set forth in subparagraph 1 of Article 2 of the Higher Education Act for five years or longer.

(3) The Chairperson and the Vice Chairperson shall be appointed from among public officials in political service.

(4) The Chairperson, Vice Chairperson and the head of the secretariat under Article 7-13 shall become cabinet member, notwithstanding Article 10 of the Government Organization Act.

(1) The Chairperson shall represent the Protection Commission, preside over meetings of the Protection Commission, and oversee the related business affairs.

(2) If the Chairperson cannot perform his or her duties for inevitable reasons, the Vice Chairperson shall act on his or her behalf, and if both the Chairperson and Vice Chairperson cannot perform his or her duties for inevitable reasons, another Commissioner, determined by the Protection Commission in advance, shall act on behalf of Chairperson.

(3) The Chairperson may attend the National Assembly and make statements in relation to the business affairs of the Protection Commission, and if required by the National Assembly, he or she shall attend the National Assembly to make a report or respond to questions.

(4) The Chairperson may attend a meeting of the State Council and recommend the Prime Minister to submit a bill concerning the business affairs under his or her jurisdiction.

(1) A Commissioner shall serve for a term of three years but may be consecutively appointed one time.

(2) When the post of a Commissioner becomes vacant, a new Commissioner shall be named or appointed without delay. In such cases, the term of the named or appointed succeeding Commissioner shall be newly commenced.

(1) No Commissioner shall be dismissed or de-commissioned against his or her will except in the following cases:

1. Where he or she is unable to perform his or her duties for a long period due to mental or physical disorder;
2. Where he or she falls under any ground for disqualification provided for in Article 7-7;
3. Where he or she violates his or her duties under this Act or any other Act.

(2) Each Commissioner shall independently perform his or her duties in compliance with statutes and his or her conscience.

(1) Each Commissioner shall neither concurrently engage in any of the following posts, nor engage in any work for profits related to his or her duties:

1. Member of the National Assembly or Local Council;
2. State or local public official; 3. Other positions prescribed by Presidential Decree.

(2) Matters relating to work for profit set forth in paragraph (1) shall be prescribed by Presidential Decree.

(3) A Commissioner shall not engage in political activities.

(1) Persons falling under any of the following cannot be a Commissioner:

1. Non-Korean national;
2. A person falling under any of the subparagraphs under Article 33 of the State Public Officials Act;
3. A party member set forth in Article 22 of the Political Parties Act.

(2) A Commissioner falling under any of the above subparagraphs 1 through 3 shall be automatically discharged from his or her position: Provided, That, in the case of subparagraph 2 of Article 33 of the State Public Officials Act, this only applies to a person who was declared bankrupt and did not apply for immunity within the application deadline, or received a confirmed decision of immunity disapproval or cancellation, according to the Debtor Rehabilitation and Bankruptcy Act; in the case of subparagraph 5 of Article 33 of the Same Act, this only applies to Articles 129 through 132 of the Criminal Act, Article 2 of the Act on Special Cases Concerning the Punishment of Sexual Crimes, subparagraph 2 of Article 2 of the Act on the Protection of Children and Youth against Sex Offenses and a person who committed a crime prescribed in Articles 355 or 356 of the Criminal Act with regard to his or her duties and received a suspended sentence of imprisonment without labor or a heavier punishment.

The Protection Commission shall perform the following affairs:

1. Matters relating to the improvement of statutes or regulations relating to personal information protection;
2. Matters relating to the establishment or execution of policies, systems or plans relating to personal information protection;
3. Matters relating to investigation into infringement upon the right of data subjects and the ensuing dispositions;
4. Handling of complaints or remedial procedures relating to personal information processing and mediation of disputes over personal information;
5. Exchange and cooperation with international organizations and foreign personal information protection agencies to protect personal information;
6. Matters relating to the investigation and study, education and promotion of statutes or regulations, policies, systems and status relating to personal information protection;
7. Matters relating to support for and dissemination of technological development relating to personal information protection, the standardization of technologies, and nurturing of experts;
8. Matters provided in this Act and other statutes or regulations as affairs under the jurisdiction of the Protection Commission.

(1) The Protection Commission shall deliberate and resolve on the following matters:

1. Matters relating to the assessment of personal information breach incident factors under Article 8-2;
2. Establishment of the Master Plan referred to in Article 9 and the Implementation Plan referred to in Article 10;
3. Matters relating to the improvement of policies, systems, and law relating to personal information protection;
4. Matters relating to the coordination of positions taken by public institutions with respect to the processing of personal information;
5. Matters relating to the interpretation and operation of statutes or regulations related to the protection of personal information;
6. Matters relating to the use and provision of personal information under Article 18 (2) 5; 6-2. Matters relating to orders to suspend cross-border transfers of personal information under Article 28-9;
7. Matters relating to the results of the privacy impact assessment under Article 33 (4);
8. Matters relating to the imposition of penalty surcharges under Article 64-2;
9. Matters relating to the presentation of opinions and recommendation for improvement under Article 61;
   9-2. Matters concerning recommendations for correction pursuant to Article 63-2 (2);
10. Matters relating to corrective measures under Article 64;
11. Matters relating to accusation and recommendation for disciplinary actions under Article 65;
12. Matters relating to the publication of processing results and orders for publication under Article 66;
13. Matters relating to the imposition of administrative fines under Article 75;
14. Matters relating to the enactment, amendment and abolition of statutes or regulations under its jurisdiction and rules of the Protection Commission;
15. Matters referred to a meeting by Chairperson or at least two Commissioners of the Protection Commission with respect to the protection of personal information;
16. Other matters on which the Protection Commission deliberates or resolves pursuant to this Act or other statutes or regulations.

(2) The Protection Commission may take the following measures if necessary to deliberate and resolve matters provided in paragraph (1): 1. Listening to the opinions of relevant public officials, experts in personal information protection, civic organizations and relevant business operators; 2. Requesting submission of relevant materials or facts with respect to relevant agencies.

(3) Relevant agencies upon receipt of a request made under paragraph (2) 2 shall comply with the request unless there are extraordinary circumstances.

(4) Upon deliberating and resolving on matters provided in paragraph (1) 3, the Protection Commission may advise on the improvement of such matters to the relevant agency.

(5) The Protection Commission may inspect whether the details of its advice given under paragraph (4) has been implemented or not.

(1) Meetings of the Protection Commission shall be convened by the Chairperson when he or she deems it necessary or at the request of not less than 1/4 of all incumbent Commissioners.

(2) The Chairperson or at least two Commissioners of the Protection Commission may propose a bill to the Protection Commission.

(3) The quorum for holding meetings of the Protection Commission shall be the presence of a majority of its members enrolled, and any resolution shall require the affirmative votes of a majority of the members present.

(1) A Commissioner of the Protection Commission shall be excluded from deliberation and resolution on a case if:

1. The Commissioner or his or her current or former spouse is a party to the relevant case or is a joint right holder or a joint obligor with respect to the case;
2. The Commissioner is or was a relative of a party to the case;
3. The Commissioner has given any testimony, expert opinion, or legal advice with respect to the case;
4. The Commissioner is or was involved in the case as an agent or representative of a party to the case;
5. The Commissioner or a public institution, corporation or group where he or she belongs shares interests with a person who provides advice or other support for the case.

(2) Where the circumstances indicate that it would be impracticable to expect fair deliberations and resolutions by a Commissioner, any party may file a motion for challenge, and the Protection Commission shall make a decision by resolution.

(3) A Commissioner may recuse himself or herself from the case on the grounds provided in paragraph (1) or (2).

(1) The Protection Commission may have sub-commissions which will deliberate and resolve minor personal information breach cases or similar or repetitive matters to ensure more efficient work procedures.

(2) Each sub-commission shall be comprised of three members.

(3) Matters deliberated and resolved by the sub-commission pursuant to paragraph (1) shall be deemed deliberated and resolved by the Protection Commission.

(4) Resolution for a meeting of the sub-commission shall be made by the presence of all the members enrolled and affirmative votes of all members present.

The Protection Commission shall have a secretariat to perform business affairs, and matters that are not specified in this Act in relation to the organization of the Protection Commission shall be prescribed by Presidential Decree.

Matters that are not specified in this Act and other statutes in relation to the operation of the Protection Commission shall be prescribed by the rules of the Protection Commission.

(1) The head of a central administrative agency shall request the Protection Commission to assess the factors of personal information breach incident where a policy or system that entails personal information processing is adopted or changed by the enactment or amendment of any statute under his or her jurisdiction.

(2) Upon receipt of a request made pursuant to paragraph (1), the Protection Commission may advise the head of the relevant agency of the matters necessary to improve the relevant statute or regulation by analyzing and reviewing the personal information breach incident factors of such statute or regulation.

(3) Matters necessary for the procedure and method to assess the personal information breach incident factors under paragraph (1) shall be prescribed by Presidential Decree.

(1) The Protection Commission shall establish a Master Plan to protect personal information (hereinafter referred to as a “Master Plan”) every three years in consultation with the heads of relevant central administrative agencies to ensure the protection of personal information and the rights and interests of data subjects:

(2) The Master Plan shall include the following:

1. Basic goals and intended directions of the protection of personal information;
2. Improvement of systems and statutes or regulations related to the protection of personal information;
3. Measure to prevent personal information breaches;
4. Vitalization of self-regulation to protect personal information;
5. Promoting education and public relations to protect personal information;
6. Training of specialists in the protection of personal information;
7. Other matters necessary to protect personal information.

(3) The National Assembly, the Court, the Constitutional Court, and the National Election Commission may establish and implement its own Master Plan to protect personal information of relevant institutions (including affiliated entities).

(1) The head of a central administrative agency shall establish an implementation plan to protect personal information each year in accordance with the Master Plan and submit it to the Protection Commission, and shall execute the implementation plan subject to the deliberation and resolution of the Protection Commission.

(2) Matters necessary for the establishment and execution of the implementation plan shall be prescribed by Presidential Decree.

(1) To efficiently establish the Master Plan, the Protection Commission may request materials or opinions regarding the status of regulatory compliance, personal information management, etc. by personal information controllers from personal information controllers, the heads of relevant central administrative agencies, the heads of local governments and related organizations or associations, etc.

(2) The Protection Commission may conduct an investigation with respect to data controllers, the competent head of the central administrative departments or agencies and local governments, and the competent agencies and organizations about the level and actual status of how personal data is managed where necessary to implement policies for personal data protection and to evaluate performance, etc.

(3) The head of a central administrative agency may request the materials referred to in paragraph (1) from personal information controllers in the fields under his or her jurisdiction to efficiently establish and promote Implementation Plans.

(4) Any person upon receipt of a request to furnish the materials under paragraphs (1) through (3) shall comply with the request unless there are extraordinary circumstances.

(5) The scope and method to furnish the materials under paragraphs (1) through (3) and other necessary matters shall be prescribed by Presidential Decree.

(1) The Protection Commission shall conduct an annual assessment of central administrative agencies and institutions affiliated with such agencies, local governments, or any other institutions prescribed by Presidential Decree for the performance of policies and work for the protection of personal information and the compliance of obligations under this Act (hereinafter referred to as "assessment of the level of personal information protection").

(2) The Protection Commission may require the head of a relevant public institution to submit relevant materials where necessary for the assessment of the level of personal information protection.

(3) The Protection Commission may disclose the results of the assessment of the level of personal information protection on its website, etc.

(4) The Protection Commission may grant awards to exemplary institutions and employees belonging thereto according to the results of the assessment of the level of personal information protection, and recommend improvement to the head of a relevant public institutions, if deemed necessary for the protection of personal information. In such cases, the head of the public institution shall make good faith efforts to comply with the recommendation, and notify the Protection Commission of the results of the measures taken.

(5) Other matters necessary for the criteria, methods, and procedures for the assessment of the level of personal information protection, the scope of data to be submitted under paragraph (2), etc. shall be prescribed by Presidential Decree.

(1) The Protection Commission may establish the Standard Personal Information Protection Guidelines (hereinafter referred to as the “Standard Guidelines”) regarding the personal information processing standard, types of personal information breaches, preventive measures, etc., and recommend that personal information controllers comply with such Guidelines.

(2) The head of a central administrative agency may establish the personal information protection guidelines regarding the personal information processing in the fields under his or her jurisdiction in accordance with the Standard Guidelines; and may recommend that personal information controllers comply with such guidelines.

(3) The National Assembly, the Court, the Constitutional Court, and the National Election Commission may establish and implement its own personal information protection guidelines for each relevant institution (including affiliated entities).

The Protection Commission shall establish policies necessary for the following matters to promote and support self-regulating activities of personal information controllers to protect personal information:

1. Education and public relations concerning the protection of personal information;
2. Promotion and support of agencies and organizations related to the protection of personal information;
3. Introduction and facilitation of privacy mark;
4. Support for personal information controllers in the establishment and implementation of self-regulatory rules;
5. Other matters necessary to support the self-regulating data protection activities of personal information controllers.

(1) September 30 of each year shall be designated as the Personal Information Protection Day to raise awareness among citizens as to the importance of the protection and processing of personal information.

(2) The State and local governments may hold various events to spread the culture of personal information protection during the week in which the Personal Information Protection Day is included.

(1) The Government shall establish policy measures necessary to enhance the personal information protection standard in the international environment.

(2) The Government shall establish relevant policy measures so that the rights of data subjects may not be infringed on owing to cross-border transfers of personal information.