(1) A personal information controller may collect personal information in any of the following cases, and use it within the scope of the purpose of collection:

1. Where consent is obtained from a data subject;
2. Where special provisions exist in other statutes or it is unavoidable due to obligations under statutes or regulations;
3. Where it is unavoidable for a public institution’s performance of work under its jurisdiction as prescribed by statutes or regulations, etc.;
4. Where it is necessary to take measures at the request of a data subject in the course of performing a contract concluded with the data subject or concluding a contract;
5. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
6. Where it is necessary to attain the legitimate interests of a personal information controller, which such interest is manifestly superior to the rights of the data subject. In such cases, processing shall be allowed only to the extent the processing is substantially related to the legitimate interests of the personal information controller and does not go beyond a reasonable scope.
7. Where it is urgently necessary for the public safety and security, public health, etc.

(2) A personal information controller shall inform a data subject of the following matters when it obtains consent under paragraph (1) 1. The same shall apply when any of the following is modified:

1. The purpose of the collection and use of personal information;
2. Particulars of personal information to be collected;
3. The period for retaining and using personal information;
4. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.

(3) A personal information controller may use personal information without the consent of a data subject within the scope reasonably related to the initial purpose of the collection as prescribed by Presidential Decree, in consideration whether disadvantages have been caused to the data subject and whether necessary measures to ensure safety such as encryption have been taken.

(1) A personal information controller shall collect the minimum personal information necessary to attain the purpose when collecting personal information pursuant to Article 15 (1). In such cases, the burden of proof that the minimum personal information is collected shall be borne by the personal information controller.

(2) A personal information controller shall collect personal information by specifically informing a data subject of the fact that he or she may deny the consent to the collection of other personal information than the minimum information necessary in case of collecting the personal information with consent of the data subject.

(3) A personal information controller shall not refuse to provide goods or services to a data subject on ground that the data subject does not consent to the collection of personal information exceeding minimum requirement.

(1) A personal information controller may provide (or share; hereinafter the same shall apply) the personal information of a data subject to a third party in any of the following cases:

1. Where consent is obtained from the data subject;
2. Where the personal information is provided within the scope of purposes for which it is collected pursuant to Articles 15 (1) 2, 3, and 5 through 7.

(2) A personal information controller shall inform a data subject of the following matters when it obtains the consent under paragraph (1) 1. The same shall apply when any of the following is modified:

1. The recipient of personal information;
2. The purpose for which the recipient of personal information uses such information;
3. Particulars of personal information to be provided;
4. The period during which the recipient retains and uses personal information;
5. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.

(3) (deleted)

(4) A personal information controller may provide personal information without the consent of a data subject within the scope reasonably related to the purposes for which the personal information was initially collected, in accordance with the matters prescribed by Presidential Decree taking into consideration whether disadvantages are caused to the data subject, whether measures necessary to secure safety, such as encryption, have been taken, etc.

(1) No personal information controller shall use personal information beyond the scope provided in Article 15 (1) or provide it to any third party beyond the scope provided in Articles 17 (1) and 28-8 (1).

(2) Notwithstanding paragraph (1), where any of the following subparagraphs applies, a personal information controller may repurpose personal information or provide it to a third party, unless doing so is likely to unfairly infringe on the interest of a data subject or third party: Provided, That subparagraphs 5 through 9 shall be applied only to public institutions:

1. Where separate consent is obtained from the data subject;
2. Where special provisions exist in other statutes;
3. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
4. (deleted);
5. Where it is impossible to perform the work under its jurisdiction as provided in other statutes, unless the personal information controller repurposes personal information or provides it to a third party, and it is subject to the deliberation and resolution by the Commission;
6. Where it is necessary to provide personal information to a foreign government or international organization to perform a treaty or other international convention;
7. Where it is necessary for the investigation of a crime, institution and maintenance of a prosecution;
8. Where it is necessary for a court to proceed with trial-related work;
9. Where it is necessary for the enforcement of punishment, probation and custody;
10. Where it is urgently necessary for the public safety and security, public health, etc.

(3) A personal information controller shall inform the data subject of the following matters when it obtains the consent under paragraph (2) 1; the same shall apply when any of the following is modified:

1. The recipient of personal information;
2. The purpose of use of personal information (in the case of provision of personal information, it means the purpose of use by the recipient);
3. Particulars of personal information to be used or provided;
4. The period for retaining and using personal information (where personal information is provided, it means the period for retention and use by the recipient);
5. The fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent.

(4) Where a public institution repurposes personal information or provides it to a third party under paragraph (2) 2 through 6 and 8 through 10, the public institution shall post matters necessary for the legal basis for such use or provision, purpose, scope, and the like on the Official Gazette or on its website, as prescribed by Notification of the Protection Commission.

(5) Where a personal information controller provides personal information to a third party for another purpose in any case provided in any subparagraph of paragraph (2), the personal information controller shall request the recipient of the personal information to limit the purpose and method of use and other necessary matters, or to prepare necessary safeguards to ensure the safety of the personal information. In such cases, the person upon receipt of such request shall take measures necessary to ensure the safety of the personal information.

A person who receives personal information from a personal information controller shall not use the personal information, or provide it to a third party, for any purpose other than the intended one, except in the following circumstances:

1. Where separate consent is obtained from the data subject;
2. Where special provisions exist in other statutes.

(1) When a personal information controller processes personal information collected from sources other than data subjects, the personal information controller shall immediately notify the data subject of the following matters at the request of such data subject:

1. The source of collected personal information;
2. The purpose of processing personal information;
3. The fact that the data subject is entitled to request suspension of processing of personal information or to withdraw consent, as prescribed in Article 37.

(2) Notwithstanding paragraph (1), when a personal information controller satisfying the criteria prescribed by Presidential Decree taking into account the types and amount of processed personal information, number of employees, amount of sales, etc., collects personal information from third parties and processes the same pursuant to Article 17 (1) 1, the personal information controller shall notify the data subject of the matters referred to in paragraph (1): Provided, That this shall not apply where the information collected by the personal information controller does not contain any personal information, such as contact information, through which notification can be given to the data subject.

(3) Matters necessary for the time, method, and procedure of giving notification to the data subject pursuant to the main clause of paragraph (2), shall be prescribed by Presidential Decree.

(4) Paragraph (1) and the main clause of paragraph (2) shall not apply to any of the following cases: Provided, That this shall be the case only where it is manifestly superior to the rights of data subjects under this Act:

1. Where personal information, which is subject to a notification request, is included in the personal information files referred to in any subparagraph of Article 32 (2);
2. Where such notification is likely to cause harm to the life or body of any other person, or to unfairly damage the property and other interests of any other person.

(1) A personal information controller who meets the criteria prescribed by Presidential Decree shall regularly notify data subjects of the details of the use and provision of personal information collected under this Act or the method of accessing the information system through which such details can be confirmed: Provided, That the notification may be omitted where personal information that enables notifications to the data subject, such as contact information, has not been collected or retained.

(2) Matters necessary for the scope of data subjects subject to notification, information to be notified, frequency, method, etc. of notification under paragraph (1) shall be prescribed by Presidential Decree.

(1) A personal information controller shall destroy personal information without delay when the personal information becomes unnecessary owing to the expiry of the retention period, attainment of the purpose of processing the personal information, the expiry of the processing period of pseudonymized information, etc.: Provided, That this shall not apply where the retention of such personal information is mandatory by other statutes or regulations.

(2) When a personal information controller destroys personal information pursuant to paragraph (1), measures necessary to prevent recovery and revival shall be taken.

(3) Where a personal information controller is obliged to retain, rather than destroy, personal information pursuant to the proviso of paragraph (1), the relevant personal information or personal information files shall be stored and managed separately from other personal information.

(4) Other necessary matters, such as the methods to destroy personal information and its destruction process, shall be prescribed by Presidential Decree.

(1) Where a personal information controller intends to obtain the consent of the data subject (including his or her legal representative as stated in Article 22-2 (1); hereafter in this Article the same shall apply) to the processing of his or her personal information, the personal information controller shall present the request for consent to the data subject in a clearly recognizable manner where each matter requiring consent is distinctly presented, and obtain his or her consent thereto. In such cases, the personal information controller shall categorize the matters requiring consent falling under the following subparagraphs and obtain consent, respectively.

1. Where consent shall be obtained under Article 15 (1) 1;
2. Where consent shall be obtained under Article 17 (1) 1;
3. Where consent shall be obtained under Article 18 (2) 1;
4. Where consent shall be obtained under subparagraph 1 of Article 19;
5. Where consent shall be obtained under Article 23 (1) 1;
6. Where consent shall be obtained under Article 24 (1) 1;
7. Where the personal information controller intends to obtain consent to the processing of personal information in order to promote goods or services or solicit purchase thereof;
8. Other cases prescribed by Presidential Decree where it is necessary to obtain consent by categorizing the matters requiring consent to protect a data subject.

(2) Where a personal information controller obtains the consent under paragraph (1) in writing (including electronic documents under Article 2, subparagraph 1 of the Framework Act on Electronic Documents and Transactions), the personal information controller shall clearly specify important matters prescribed by Presidential Decree such as the purpose of collection and use of personal information and the items of personal information to be collected and used, in the manner prescribed by Notification of the Protection Commission, so as to make such matters easy to be understood.

(3) With respect to the personal information that can be processed without consent of the data subject, a personal information controller shall disclose the relevant items and legal basis for such processing under Article 30 (2) by separating such information from the personal information processed with consent of the data subject, or shall inform the data subject thereof by e-mail or any other means prescribed by Presidential Decree. In such cases, the burden of proof that personal information can be processed without consent shall be borne by the personal information controller.

(4) (deleted)

(5) A personal information controller shall not refuse to provide goods or services to a data subject on the grounds that the data subject would not consent to the matter eligible for selective consent, or would not consent pursuant to paragraph (1) 3 and 7.

(6) (deleted)

(7) Except as provided in paragraphs (1) through (5), matters necessary for detailed methods to obtain the consent of data subjects shall be prescribed by Presidential Decree, in consideration of the collection media of personal information and other factors.

(1) When the consent of a child under 14 years of age is required to process the personal information of such child, a personal information controller shall obtain the consent of his or her legal representative and confirm whether the legal representative has granted consent.

(2) Notwithstanding paragraph (1), information prescribed by Presidential Decree as minimum information necessary for obtaining the consent of a legal representative may be collected directly from the relevant child without consent of the legal representative.

(3) A personal information controller shall, when notifying a child under 14 years of age of matters relating to the processing of personal information, use such a form and such a clear and plain language that the child can easily understand.

(4) Except as provided in paragraphs (1) through (3), matters necessary for the methods of obtaining consent and of obtaining confirmation of consent, etc., shall be prescribed by Presidential Decree.

(1) A personal information controller shall not process any information prescribed by Presidential Decree (hereinafter referred to as “sensitive information”), including ideology, belief, admission to or withdrawal from a trade union or political party, political opinions, health, sex life, and other personal information that is likely to markedly threaten the privacy of any data subject: Provided, That this shall not apply in any of the following circumstances:

1. Where the personal information controller informs the data subject of the matters provided for in Article 15 (2) or 17 (2), and obtains the consent of the data subject apart from the consent to the processing of other personal information;
2. Where other statutes or regulations require or permit the processing of sensitive information.

(2) Where a personal information controller processes sensitive information pursuant to paragraph (1), the personal information controller shall take measures necessary to ensure safety pursuant to Article 29 so that the sensitive information may not be lost, stolen, divulged, forged, altered, or damaged.

(3) Where a personal information controller deems that there is a risk of privacy invasion because sensitive information of the data subject is included in the information disclosed in the course of the provision of goods or services, the personal information controller shall communicate to the data subject the possibility of disclosure of sensitive information and the method of selecting non-disclosure in an easily understandable manner before providing the goods or services.

(1) A personal information controller shall not process any information prescribed by Presidential Decree that can be used to identify an individual in accordance with statutes or regulations (hereinafter referred to as "personally identifiable information"), except in any of the following cases:

1. Where the personal information controller informs a data subject of the matters provided for in Article 15 (2) or 17 (2), and obtains the consent of the data subject apart from the consent to the processing of other personal information;
2. Where other statutes or regulations specifically require or permit the processing of unique identification information.

(2) (deleted)

(3) Where a personal information controller processes personally identifiable information pursuant to paragraph (1), the personal information controller shall take measures necessary to ensure safety, including encryption, as prescribed by Presidential Decree, so that the personally identifiable information may not be lost, stolen, divulged, forged, altered, or damaged.

(4) The Protection Commission shall regularly inspect whether a personal information controller meeting the criteria prescribed by Presidential Decree taking into account the types and amount of processed personal information, number of employees, amount of sales, etc., has taken the measures necessary to ensure safety pursuant to paragraph (3), as prescribed by Presidential Decree.

(5) The Protection Commission may authorize specialized institutions prescribed by Presidential Decree to conduct the inspection referred to in paragraph (4).

(1) Notwithstanding Article 24 (1), a personal information controller shall not process any resident registration number, except in any of the following cases:

1. Where any Act, Presidential Decree, National Assembly Regulations, Supreme Court Regulations, Constitutional Court Regulations, National Election Commission Regulations or Board of Audit and Inspection Regulations specifically requires or permits the processing of resident registration numbers;
2. Where it is deemed manifestly necessary for the protection, from imminent danger, of life, bodily and property interests of a data subject or a third party;
3. Where it is inevitable to process resident registration numbers in line with subparagraphs 1 and 2 in cases prescribed by Notification of the Protection Commission.

(2) Notwithstanding Article 24 (3), a personal information controller shall retain resident registration numbers in a safe manner by means of encryption so that the resident registration numbers may not be lost, stolen, divulged, forged, altered, or damaged. In such cases, any necessary matters in relation to the scope of encryption objects and encryption timing by object, etc. shall be prescribed by Presidential Decree, taking into account the amount of personal information processed, data breach impact, etc.

(3) A personal information controller shall provide data subjects with an alternative sign-up tool without using their resident registration numbers in the stage of being admitted to membership via the website while processing the resident registration numbers pursuant to paragraph (1).

(4) The Protection Commission may prepare and support such measures as legislative arrangements, policy-making, necessary facilities, and systems build-up in order to support the provision of the measures provided for in paragraph (3).

(1) No one shall install and operate any fixed visual data processing device at open places, except in any of the following cases:

1. Where specifically allowed by statutes or regulations;
2. Where it is necessary for the prevention and investigation of crimes;
3. Where a person with legitimate authority installs and operates such device for the safety and management of facilities and prevention of fire;
4. Where a person with legitimate authority installs and operates such device for traffic enforcement;
5. Where a person with legitimate authority installs and operates such device for the collection, analysis, and provision of traffic information;
6. Cases prescribed by Presidential Decree, where the photographed image information is not stored.

(2) No one shall install and operate any fixed visual data processing device to look into the places which are likely to noticeably threaten individual privacy, such as a bathroom, restroom, sauna, and dressing room used by many unspecified persons: Provided, That this shall not apply to the facilities prescribed by Presidential Decree, which are used to detain or protect persons in accordance with statutes or regulations, such as correctional institutions and mental health care centers.

(3) The head of a public institution who intends to install and operate fixed visual data processing devices pursuant to the subparagraphs of paragraph (1) and a person who intends to install and operate fixed visual data processing devices pursuant to the proviso of paragraph (2) shall gather opinions of relevant specialist and interested persons through the procedures prescribed by Presidential Decree such as public hearings and information sessions.

(4) A person who installs and operates fixed visual data processing devices pursuant to the subparagraphs of paragraph (1) (hereinafter referred to as “fixed visual data processing device operator”) shall take necessary measures including posting on a signboard the following matters, so that data subjects may easily recognize such devices: Provided, That this shall not apply to military installations defined in subparagraph 2 of Article 2 of the Protection of Military Bases and Installations Act, important national facilities defined in subparagraph 13 of Article 2 of the United Defense Act, and other facilities prescribed by Presidential Decree:

1. The purpose and place of installation;
2. The scope and hours of photographing;
3. The contact information of the person in charge of its management;
4. Other matters prescribed by Presidential Decree.

(5) A fixed visual data processing device operator shall neither arbitrarily manipulate a fixed visual data processing device for purposes other than those for which the device was installed, nor direct the device toward different spots, nor use sound recording functions.

(6) A fixed visual data processing device operator shall take measures necessary to ensure safety pursuant to Article 29 to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged.

(7) A fixed visual data processing device operator shall establish an appropriate policy to operate and manage the fixed visual data processing devices, as prescribed by Presidential Decree: Provided, That the fixed visual data processing device operator need not formulate a policy to operate and manage the fixed visual data processing devices if he or she has included matters regarding the operation and management of fixed visual data processing devices when formulating the Privacy Policy under Article 30.

(8) A fixed visual data processing device operator may entrust the business affairs regarding the installation and operation of fixed visual data processing devices to a third party: Provided, That public institutions shall comply with the procedures and requirements prescribed by Presidential Decree when entrusting the business affairs regarding the installation and operation of fixed visual data processing devices to a third party.

(1) A person who intends to operate a mobile visual data processing device for work purposes shall not take photographs (limited to cases falling within the scope of personal information; hereinafter the same shall apply) of a person or things related to such person at public places, except in the following cases:

1. In any of the cases falling under any subparagraph of Article 15 (1);
2. Where the data subject fails to express his or her intention to refuse to be photographed, although the fact of photographing is clearly stated to inform the data subject; in such cases, it shall be limited to cases where it is unlikely to unduly infringe upon the right of a data subject and where it does not exceed reasonable limits;
3. Other cases prescribed by Presidential Decree, corresponding to those referred to in subparagraphs 1 and 2.

(2) No one shall take photographs of a person or things related to such person through a mobile visual data processing device at a place used by many unspecified persons where an individual's privacy could be significantly compromised, such as a bathroom, toilet, sauna, and changing room: Provided, That this shall not apply to cases prescribed by Presidential Decree, where it is necessary for lifesaving and first-aid services.

(3) Where a person or thing related to such person is photographed with a portable visual data processing device in cases falling under the subparagraphs of paragraph (1), the fact of photographing shall be indicated and notified as prescribed by Presidential Decree, by such means as light, sound, and signboard.

(4) Except as provided in paragraphs (1) through (3), Article 25 (6) through (8) shall apply mutatis mutandis to the operation of mobile visual data processing devices.

(1) A personal information controller shall, when entrusting the processing of personal information to a third party, do so in a document that states the following:

1. Prevention of personal information processing for other purposes than performing the entrusted work;
2. Technical and managerial safeguards of personal information;
3. Other matters prescribed by Presidential Decree to ensure safe management of personal information.

(2) A personal information controller who entrusts the processing of personal information pursuant to paragraph (1) (hereinafter referred to as "person entrusting") shall disclose the details of the entrusted affairs and the entity that processes personal information (including a third party re-entrusted from a person entrusted with the processing of personal information; hereinafter referred to as “person entrusted”) in the manner prescribed by Presidential Decree so as to be easily recognizable by data subjects at any time.

(3) The person entrusting shall, in case of entrusting the promotion of goods or services, or soliciting of sales thereof, notify data subjects of the entrusted work and the person entrusted in the manners prescribed by Presidential Decree. The same shall apply where the entrusted work or the person entrusted has been changed.

(4) The person entrusting shall educate the person entrusted so that personal information of data subjects may not be lost, stolen, divulged, forged, altered, or damaged owing to the outsourcing of work, and supervise how the person entrusted processes such personal information safely by inspecting the status of processing, etc., as prescribed by Presidential Decree.

(5) An person entrusted shall not use any personal information beyond the scope of the work entrusted by the personal information controller, nor provide personal information to a third party.

(6) A person entrusted shall, when he or she intends to re-entrust the processing of entrusted personal information to a third party, obtain consent from the person entrusting.

(7) With respect to liability for damages arising out of the processing of personal information entrusted to an person entrusted in violation of this Act, the person entrusted shall be deemed an employee of the personal information controller.

(8) Articles 15 through 18, 21, 22, 22-2, 23, 24, 24-2, 25, 25-2, 27, 28, 28-2 through 28-5, 28-7 through 28-11, 29, 30, 30-2, 31, 33, 34, 34-2, 35, 35-2, 36, 37, 37-2, 38, 59, 63, 63-2, and 64-2 shall apply mutatis mutandis to outsourcees. In such cases, "personal information controller" shall be construed as "person entrusted".

(1) A personal information controller shall notify in advance the data subjects of the following matters in the manner prescribed by Presidential Decree in the case of transfer of personal information to a third party owing to the transfer of some or all of his or her business, a merger, etc.:

1. The fact that the personal information will be transferred;
2. The name (referring to the company name in case of a legal person), address, telephone number and other contact information of the recipient of the personal information (hereinafter referred to as “business transferee, etc.”);
3. The method and procedure for withdrawing consent if the data subject does not wish his or her personal information to be transferred.

(2) Upon receiving personal information, the business transferee, etc. shall, without delay, notify data subjects of the fact in the manner prescribed by Presidential Decree: Provided, That this shall not apply where the personal information controller has already notified the data subjects of the fact of such transfer pursuant to paragraph (1).

(3) Upon receiving personal information owing to business transferee, etc., a merger, etc., the business transferee may use, or provide a third party with, the personal information only for the initial purposes dating to the time of the transfer. In such cases, the business transferee shall be deemed the personal information controller.

(1) In processing personal information, a personal information controller shall limit the scope of persons who process the personal information under his or her command and supervision, such as an executive officer or employee, temporary agency worker, and part-time worker (hereinafter referred to as “personal information handler”) to a minimum extent and shall appropriately manage and supervise such personal information handlers.

(2) A personal information controller shall provide personal information handlers with necessary educational programs on a regular basis in order to ensure the appropriate handling of personal information.

(1) A personal information controller may process pseudonymized information without the consent of data subjects for statistical purposes, scientific research purposes, and archiving purposes in the public interest, etc.

(2) A personal information controller shall not include information that may be used to uniquely identify an individual when providing pseudonymized information to a third party according to paragraph (1).

(1) Notwithstanding Article 28-2, the combination of pseudonymized information processed by different personal information controllers for statistical purposes, scientific research and preservation of records for public interest, etc. shall be conducted by a specialized institution designated by the Protection Commission or the head of the related central administrative agency.

(2) A personal information controller who intends to transfer the combined information outside the organization that combined the information shall obtain approval from the head of the specialized institution after processing the information into pseudonymized information or the form referred to in Article 58-2.

(3) Necessary matters including the procedures and methods of combination pursuant to paragraph (1), standards and procedures to designate, or revoke the designation of, a specialized institution management and supervision, and standards and procedures of transfer and approval pursuant to paragraph (2) shall be prescribed by Presidential Decree.

(1) In processing pseudonymized information under Article 28-2 or 28-3, a personal information controller shall take such technical, administrative, and physical measures as separately storing and managing additional information needed for restoration to the original state, which are necessary to ensure safety as prescribed by Presidential Decree to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged.

(2) In processing pseudonymized information in accordance with Article 28-2 or 28-3, a personal information controller may separately determine the processing period of the pseudonymized information in consideration of the processing purpose, etc.

(3) A personal information controller who intends to process pseudonymized information under Article 28-2 or 28-3 shall prepare and retain records relating to matters prescribed by Presidential Decree including the purpose of processing the pseudonymized information, a recipient in cases pseudonymized information is provided to a third party, the processing period of pseudonymized information, etc. (limited to cases where the processing period is separately determined under paragraph (2)) to manage the details of the processing of pseudonymized information, and shall retain the records for at least three years from the date of destruction in the event of destruction of pseudonymized information.

(1) No person who processes pseudonymized information under Article 28-2 or 28-3 shall process such information for the purpose of uniquely identifying an individual.

(2) When information that can uniquely identify an individual is generated in the process of processing pseudonymized information under Article 28-2 or 28-3, a personal information controller shall immediately cease the processing of the relevant information, and shall retrieve and destroy the information without delay.

@Articles 20, 20-2, 27, 34 (1), 35, 35-2, 36, and 37 shall not apply to pseudonymized information processed under Article 28-2 or 28-3.

(1) No cross-border provision (including inquiry), entrusted processing, or storage (hereafter in this Section referred to as "transfer") of personal information shall be allowed by a personal information controller: Provided, That in any of the following cases, the cross-border transfer of personal information may be allowed:

1. Where separate consent is obtained from the data subject;
2. Where there are special provisions regarding the cross-border transfer of personal information in a statute, a treaty to which the Republic of Korea is a party, or other international conventions;
3. In any of the following cases where it is necessary to entrust the processing of personal information and to retain such personal information in order to conclude and perform a contract with the data subject:
   • (a) Where the matters set forth in the subparagraphs of paragraph (2) are disclosed in the Privacy Policy provided in Article 30;
   • (b) Where the matters provided in the subparagraphs of paragraph (2) are communicated to the data subject by means prescribed by Presidential Decree, such as electronic mail;
4. Where the recipient of personal information obtains certification determined and publicly notified by the Protection Commission, such as the certification of personal information protection under Article 32-2, and takes all of the following measures:
   • (a) Safety measures necessary for protecting personal information and measures necessary for guaranteeing the rights of data subjects;
   • (b) Measures necessary for implementing certified matters in the country to which personal information is to be transferred;
5. Where the Protection Commission recognizes that the personal information protection system of the country or international organization to which the personal information is to be transferred, the scope of guarantee of the rights of the data subject, and the procedures for damage relief, etc. are substantially equal to the level of personal information protection under this Act.

(2) A personal information controller shall inform data subjects of the following matters in advance when obtaining consent under paragraph (1) 1:

1. Particulars of the personal information to be transferred;
2. The country to which the personal information is transferred, transfer date, and method;
3. Name of the recipient of personal information (referring to the name of a corporation and the contact information of the corporation, if the recipient is a corporation);
4. The purpose of using personal information by the recipient of personal information and the period of retention and use of personal information;
5. The method and procedure for refusing the transfer of personal information and the effect of such refusal.

(3) A personal information controller that intends to change the matters provided in any subparagraph of paragraph (2) shall inform a data subject of such change and obtain the data subject's consent thereto.

(4) A personal information controller shall comply with other provisions of this Act and Articles 17 through 19 and Chapter V of this Act, which are related to the cross-border transfer of personal information, and shall take protective measures prescribed by Presidential Decree, where it makes crossborder transfers of personal information pursuant to the proviso, with the exception of the subparagraphs, of paragraph (1).

(5) A personal information controller shall not enter into a contract for cross-border transfers of personal information containing terms and conditions that are in violation of this Act.

(6) Except as provided in paragraphs (1) through (5), matters necessary for the criteria and procedures for the cross-border transfer of personal information, etc. shall be prescribed by Presidential Decree.

(1) The Protection Commission may order a personal information controller to suspend cross-border transfers of personal information in any of the following cases where the cross-border transfer of personal information is ongoing or where any further cross-border transfer is expected:

1. Cases in violation of Article 28-8 (1), (4), or (5);
2. Where the recipient of personal information or the State or international organization to which the personal information is transferred fails to properly protect the personal information when compared to the level of personal information protection under this Act, and thus the data subject suffers damage or is highly likely to suffer damage.

(2) Upon receipt of an order to suspend cross-border transfers of personal information under paragraph (1), a personal information controller may file an objection with the Protection Commission within seven days after receipt of such order.

(3) Matters necessary for the standards for orders to suspend cross-border transfers of personal information under paragraph (1), the procedures for filing an objection under paragraph (2), etc. shall be prescribed by Presidential Decree.

Notwithstanding Article 28-8, personal information controllers in a country that restricts cross-border transfers of personal information may be subject to restrictions at a level equivalent to those imposed by the country: Provided, That this shall not apply where cross-border transfers are necessary to implement a treaty or other international conventions.