(1) The Protection Commission (including persons entrusted with the authority of the Protection Commission under Article 62 (3)) may process sensitive information and data that contain resident registration numbers, passport numbers, driver’s license numbers, or alien registration numbers referred to in Article 19, if inevitable to perform the following business affairs:

1. Business affairs regarding deliberation and resolution on any matter under Article 7-9 (1) 4 through 6 of the Act;
2. Business affairs regarding preparing for and supporting the establishment of systems providing alternative sign-up tools under Article 24-2 (4) of the Act;
3. (deleted).
4. Business affairs regarding work of the Privacy Call Center established pursuant to Article 62 (3) of the Act;
5. Business affairs regarding submission of materials and inspections under Articles 63 (1) and (2);
6. Business affairs regarding preliminary fact-finding inspections conducted under Article 63-2 of the Act;
7. Business affairs regarding imposing and collecting penalty surcharges under Article 64-2 of the Act.

(2) The Dispute Mediation Committee may process sensitive information and data that contain resident registration numbers, passport numbers, driver’s license numbers, or alien registration numbers referred to in Article 19, if inevitable to perform the business affairs related to personal information dispute mediation under Articles 45, 47, and 49 of the Act.