Any of the following organizations may file a lawsuit (hereinafter referred to as “class action lawsuit”) with the court to prevent or suspend an infringement with respect to personal information if a personal information controller rejects or would not accept the collective dispute mediation under Article 49:

1. A consumer group registered with the Fair Trade Commission pursuant to Article 29 of the Framework Act on Consumers that meets all of the following criteria:
   • (a) Its by-laws shall constantly state the purpose to augment the rights and interests of data subjects;
   • (b) The number of full members shall exceed 1,000;
   • (c) Three years shall have passed since the registration under Article 29 of the Framework Act on Consumers;
2. A non-profit, non-governmental organization referred to in Article 2 of the Assistance for Non-Profit, Non-Governmental Organizations Act that meets all of the following criteria:
   • (a) At least 100 data subjects, who experienced the same infringement as a matter of law or fact, shall submit a request to file a class action lawsuit;
   • (b) Its by-laws shall state the purpose of data protection and it has conducted such activities for the most recent three years;
   • (c) The number of regular members shall be at least 5,000;
   • (d) It shall be registered with any central administrative agency.

(1) A class action lawsuit shall be subject to the exclusive jurisdiction of the competent district court (panel of judges) at the place of business or main office, or at the address of the business manager in the case of no business establishment, of the defendant.

(2) Where paragraph (1) applies to a foreign business entity, the same shall be determined by the place of business or main office, or the address of the business manager located in the Republic of Korea.

The plaintiff of a class-action lawsuit shall retain an attorney-at-law as a litigation attorney.

(1) An organization that intends to file a class action shall submit to the court an application for permission of lawsuit describing the following in addition to the complaint:

1. Plaintiff and his or her litigation attorney;
2. Defendant;
3. Detailed violation of the rights of data subjects.

(2) An application for certification of lawsuit filed under paragraph (1) shall be accompanied by the following materials:

1. Materials that prove that the organization which has filed a lawsuit meets all criteria provided for in Article 51;
2. Documentary evidence that proves that the personal information controller has rejected the dispute mediation or would not accept the mediation award.

(1) The court shall permit a class action only when all of the following requirements are satisfied:

1. That the personal information controller has rejected the dispute mediation or would not accept the mediation award;
2. That none of the descriptions in the application for permission of lawsuit filed under Article 54 is defective.

(2) The court decision that permits, or refuses to permit, a class action may be challenged through immediate appeal.

When a judgment dismissing a plaintiff's complaint becomes conclusive, any other organizations provided for in Article 51 cannot file a class-action lawsuit regarding the identical case: Provided, That this shall not apply in any of the following circumstances:

1. Where, after the judgment became conclusive, new evidence has been found by the State, a local government, or a State or local government-invested institution regarding the said case;
2. Where the judgment dismissing the lawsuit proves to have been caused by intention by the plaintiff.

(1) Except as otherwise expressly provided for in this Act, the Civil Procedure Act shall apply to a class action.

(2) When a decision to permit a class action lawsuit is made under Article 55, a preservation order provided for in Part IV of the Civil Execution Act may be issued.

(3) Matters necessary for class action lawsuit proceedings shall be provided by the Supreme Court Regulations.