(1) A personal information controller that meets the criteria prescribed by Presidential Decree in consideration of sales and the scale of personal information retained shall take necessary measures such as purchasing insurance or joining a mutual aid organization or accumulating reserves to meet its liabilities for damages under Articles 39 and 39-2.

(2) Notwithstanding paragraph (1), any of the following need not take measures provided in paragraph (1):

1. A public institution, non-profit corporation, or organization prescribed by Presidential Decree;
2. A person who entrusts the processing of personal information to a person prescribed by Presidential Decree, who is a micro enterprise defined in Article 2 (1) of the Framework Act on Micro Enterprises;
3. A personal information controller that has purchased insurance or joined a mutual aid organization, or accumulated reserves pursuant to other statutes to cover liabilities for damages under Articles 39 and 39-2.

(3) Matters necessary for the criteria for meeting liabilities for damages, etc. under paragraphs (1) and (2) shall be prescribed by Presidential Decree.
[Moved from Article 39-9; previous Article 39-7 deleted]