(1) Any head of the Protection Commission or related central administrative agency who has designated an Expert Data Combination Agency shall manage and supervise, among others, whether the Expert Data Combination Agency has maintained the work performance capacity, technologies and facilities required.

(2) The Expert Data Combination Agency shall submit to the head of the Protection Commission or the related central administrative agency the following documents every year for the management and supervision pursuant to paragraph (1):

1. Report on the combination and release of pseudonymized information;
2. Documents supporting that the agency continues to meet the standards for designation as an Expert Data Combination Agency;
3. Documents prescribed by Notification of the Protection Commission supporting that the agency has taken measures to secure the safety of pseudonymized information.

(3) The Protection Commission shall manage/supervise the following matters:

1. The Expert Data Combination Agency’s violation of law in the process of approving the combination and release of pseudonymized information;
2. The Applicant’s processing status with respect to pseudonymized information;
3. Other necessary matters required for the safe processing of pseudonymized information prescribed by Notification of the Protection Commission.