(1) A personal information controller who meets the criteria prescribed by Presidential Decree shall regularly notify data subjects of the details of the use and provision of personal information collected under this Act or the method of accessing the information system through which such details can be confirmed: Provided, That the notification may be omitted where personal information that enables notifications to the data subject, such as contact information, has not been collected or retained.

(2) Matters necessary for the scope of data subjects subject to notification, information to be notified, frequency, method, etc. of notification under paragraph (1) shall be prescribed by Presidential Decree.