(1) The Protection Commission may request materials or opinions regarding the following from a personal information controller pursuant to Article 11 (1) of the Act:

1. Matters concerning the management of personal information and personal information files processed by the personal information controller and the installation and operation of fixed or mobile visual data processing devices;
2. Matters concerning whether the privacy officer has been designated pursuant to Article 31 of the Act;
3. Matters concerning technical, managerial, and physical measures to ensure the safety of personal information;
4. Matters concerning access by data subjects, requests for correction, deletion, suspension of personal information processing, and the status of measures taken;
5. Other matters necessary to establish and implement a Master Plan, such as compliance with the Act and this Decree.

(2) When requesting materials, opinions, etc. pursuant to paragraph (1), the Protection Commission shall request the same to the minimum extent necessary to efficiently establish and implement the Master Plan.

(3) Paragraphs (1) and (2) shall apply mutatis mutandis where the head of a central administrative agency requests materials, etc. from a personal information controller under his or her jurisdiction pursuant to Article 11 (3) of the Act. In such cases, the “Protection Commission” shall be construed as the “head of a central administrative agency”, and “Article 11 (1) of the Act” as “Article 11 (3) of the Act”, respectively.