(1) A data subject may request the personal information controller satisfying the criteria prescribed by Presidential Decree in consideration of the ability to process personal information, etc. to transmit to him or her personal information that satisfies all of the following requirements:

1. The personal information, the transmission of which is requested by the data subject, shall be any of the following personal information on himself or herself:
   • (a) Personal information processed with consent under Article 15 (1) 1, 23 (1) 1, or 24 (1) 1;
   • (b) Personal information processed to take measures at the request of a data subject in the course of performing or concluding a contract under Article 15 (1) 4;
   • (c) Among the personal information processed pursuant to Article 15 (1) 2 and 3, Article 23 (1) 2, or Article 24 (1) 2, the personal information designated as being subject to request for transmission by deliberation and resolution by the Protection Commission at the request of the head of a relevant central administrative agency for the interest of a data subject or public interest of a data subject;
2. Personal information, the transmission of which is requested, shall not be information separately generated by analyzing and processing the personal information collected by a personal information controller;
3. The personal information, the transmission of which is requested, shall be the personal information processed by a computer or any other information processing device.

(2) A data subject may request a personal information controller satisfying the criteria prescribed by Presidential Decree in consideration of the sales, the scale of personal information retained, the capability of personal information processing, industrial characteristics, and other relevant factors, to transmit his or her personal information requested under paragraph (1) to the following persons, to the extent it is technically feasible and reasonable:

1. Institutions specializing in managing personal information under Article 35-3 (1);
2. A person who fulfills his or her duty of safeguards under Article 29 and meets the standards for facilities and technology prescribed by Presidential Decree.

(3) Upon receipt of a request for transmission under paragraphs (1) and (2), the personal information controller shall transmit the relevant information in a form processable through a computer or other information processing device to the extent reasonable in terms of time, expenses, and technology.

(4) Upon receipt of a request for transmission under paragraphs (1) and (2), a personal information controller shall transmit the personal information of the data subject, notwithstanding the relevant provisions of any of the following statutes:

1. Article 81-13 of the Framework Act on National Taxes;
2. Article 86 of the Framework Act on Local Taxes;
3. Provisions of statutes prescribed by Presidential Decree, which are similar to those provided in subparagraphs 1 and 2.

(5) A data subject may withdraw his or her request for transmission under paragraphs (1) and (2).

(6) A personal information controller may refuse the request for transmission under paragraph (1) or (2) or suspend the transmission in cases prescribed by Presidential Decree, such as where it is impossible to verify whether a data subject is the person in question.

(7) No data subject shall infringe upon another person's rights or legitimate interests on the grounds of a request for transmission under paragraphs (1) and (2).

(8) Except as provided in paragraphs (1) through (7), necessary matters, such as the scope of information subject to a request for transmission, methods of requesting transmission, deadlines and methods for transmission, methods of withdrawing requests for transmission, rejection of requests for transmission, and methods of suspending transmission, shall be prescribed by Presidential Decree.