(1) Any personal information controller who retains resident registration numbers by electronic means shall take encryption measures pursuant to Article 24-2 (2) of the Act.

(2) The encryption of resident registration numbers by a personal information controller under paragraph (1) shall start from one of the following dates:

1. As to the personal information controllers who retain the resident registration numbers of less than one million data subjects: January 1, 2017;
2. As to the personal information controllers who retain the resident registration numbers of at least one million data subjects: January 1, 2018.

(3) The Protection Commission may determine and publicly notify the detailed matters regarding encryption measures under paragraph (1), taking into account the technical and economic feasibility and other factors.