(1) An advice for improvement under Article 61 (2) and (3) of the Act and an advice for disciplinary action under Article 65 (2) and (3) of the Act shall be made in writing that explicitly state the matters to be advised, grounds therefor, outcomes of the action, reply period, etc.

(2) A person who has received an advice under paragraph (1) shall take necessary measures as advised, and notify the Protection Commission or the head of the related central administrative agency of the outcome in writing: Provided, That special circumstances, in which it is deemed impracticable to take measures as advised, shall be explained in the notice.

The Protection Commission shall designate the Korea Internet and Security Agency as a specialized institution to efficiently receive and handle the claim reports on infringements on personal informationrelated rights or interests pursuant to Article 62 (2) of the Act.

(1) “Cases prescribed by Presidential Decree” in Article 63 (1) 3 of the Act means circumstances in which a case or incident which infringes on data subject’s right or interest related to personal information, such as a divulgence of personal information, has occurred or is likely to occur.

(2) The Protection Commission may request the head of the Korea Internet and Security Agency to provide necessary assistance, including technical advice, in order to request materials and to conduct inspections, etc. pursuant to Article 63 (1) and (2) of the Act.

(3) (deleted).

(4) (deleted).

(5) (deleted).

(6) (deleted).

(7) (deleted).

(1) The total sales under the main clause, with the exception of the subparagraphs, of Article 64-2 (1) of the Act shall be the average annual sales of the relevant personal information controller for three business years immediately preceding the business year in which any violation is committed (hereafter in this Article referred to as the "relevant business year"): Provided, That where three years have not elapsed since the date of commencement of business as of the first day of the relevant business year, the total sales shall be the amount calculated by converting the sales from the date of commencement of business to the end of the immediately preceding business year into the average annual sales; and where business commences in the relevant business year, the total sales shall be the amount calculated by converting the sales from the date of commencement of business to the date a violation is committed into the average annual sales.

(2) “Cases prescribed by Presidential Decree” in the proviso, with the exception of the subparagraphs, of Article 64-2 (1) of the Act means any of the following cases:

1. Where there is no sales records due to any of the following reasons:
   • (a) No commencement of business;
   • (b) Suspension of business;
   • (c) Any other reason equivalent to those specified in items (a) and (b), such as no engagement in profit-making business;
2. Where it is impracticable to objectively calculate the sales because sales calculation data are lost or damaged due to a disaster, etc.

(3) Sales unrelated to a violation under Article 64-2 (2) of the Act shall be any of the following amounts of the total sales specified in paragraph (1):

1. Sales of goods or services which are unrelated to personal information processing;
2. Sales recognized by the Protection Commission as not the sales of goods or services directly or indirectly affected by a violation, based on the data, etc. submitted pursuant to paragraph (4).

(4) Where the Protection Commission needs financial statements or other data for the calculation of sales, etc. under paragraphs (1) through (3), it may request the relevant personal information controller to submit the relevant data within a specified period not exceeding 20 days.

(5) "Ground prescribed by Presidential Decree" in Article 64-2 (5) 4 of the Act means where the relevant personal information controller rectifies a violation and meets the criteria determined and publicly notified by the Protection Commission.

(6) The criteria and procedures for calculating penalty surcharges under Article 64-2 (6) of the Act shall be as specified in attached Table 1-5.

(1) Where the Protection Commission intends to impose a penalty surcharge under Article 64-2 of the Act, it shall investigate and verify the relevant violation and shall give the person subject to the penalty surcharge written notification specifying the violation, the amount imposed, the methods and period of filing an objection, etc.

(2) A person notified under paragraph (1) shall pay the relevant penalty surcharge to a financial institution designated by the Protection Commission within 30 days from the date of being notified.

(3) Upon receipt of a penalty surcharge under paragraph (2), a financial institution shall issue a receipt to the person who has paid the penalty surcharge.

(4) Upon receipt of a penalty surcharge pursuant to paragraph (2), a financial institution shall notify the Protection Commission of such fact without delay.

(1) Where the Protection Commission extends the payment deadline for penalty surcharges specified in Article 64-2 (1) of the Act pursuant to Article 29 of the Framework Act on Administration and Article 7 of the Enforcement Decree of that Act, an extended payment period shall not exceed two years from the date of expiry of the initial payment deadline.

(2) Where the Protection Commission allows a penalty surcharge under Article 64-2 (1) of the Act to be paid in installments pursuant to Article 29 of the Framework Act on Administration and Article 7 of the Enforcement Decree of that Act, the interval between each deadline for payment in installments shall not exceed six months and the number of installments shall not exceed six times.

(3) Except as provided in paragraphs (1) and (2), matters necessary for an extension of the payment deadline for penalty surcharges, an application for payment in installments, etc. shall be determined and publicly notified by the Protection Commission.

“Interest rate prescribed by Presidential Decree” in Article 64-2 (9) of the Act means the interest rate prescribed in the main clause of Article 43-3 (2) of the Enforcement Decree of the Framework Act on National Taxes.

(1) The Protection Commission may publish the following matters by posting them on its website, etc. under Article 66 (1) of the Act:

1. The details of violations;
2. The violators;
3. Recommendations for improvement, orders to take corrective measures, the imposition of penalty surcharges, accusations, and recommendations for disciplinary actions, and the details and outcomes of imposition of administrative fines.

(2) The Protection Commission may order a person subject to a recommendation for improvement, an order to take corrective measures, the imposition of a penalty surcharge, an accusation, a recommendation for a disciplinary action, the imposition of an administrative fine, etc. under Article 66 (2) of the Act (hereafter in this Article referred to as "disposition, etc.") to publish the following matters; in such cases, the Protection Commission shall, when issuing such order, determine the details, frequency, media of such publication, the size of pages, etc., and may consult with the person subject to the disposition, etc. on the text of the publication, etc.:

1. The details of violations;
2. The violators;
3. The fact that the person is subject to the disposition, etc.

(3) Where the Protection Commission intends to make the publication under paragraph (1) or to issue an order for publication under paragraph (2), it shall take into account the details, severity, period, and frequency of a violation, the scope and consequences of the damage caused by such violation, and other relevant matters.

(4) The Protection Commission shall provide a person subject to a disposition, etc. with an opportunity to submit explanatory materials or to present his or her opinion before deliberating and resolving on publication or an order for publication.

(1) (deleted).

(2) The Protection Commission may entrust the work to support the provision of alternative sign-up tool subject to Article 24-2 (4) of the Act to the following institutions under Article 68 (1) of the Act:

1. The Korea Local Information Research and Development Institute established under Article 72 (1) of the Electronic Government Act;
2. The Korea Internet and Security Agency;
3. A corporation, institution, or organization prescribed by Notification of the Protection Commission after being recognized as having technical and financial capacity and facilities to develop, provide, and manage the alternative sign-up tool safely.

(3) The Protection Commission may entrust the following business affairs to an institution provided in paragraph (4), under Article 68 (1) of the Act:

1. Exchange and cooperation with international organizations and foreign personal information protection agencies for the protection of personal information under subparagraph 5 of Article 7-8 of the Act;
2. Surveys and research on statutes and regulations, policies, systems, actual conditions, etc. related to the protection of personal information under subparagraph 6 of Article 7-8 of the Act;
3. Support for and dissemination of technology development for the protection of personal information under subparagraph 7 of Article 7-8 of the Act;
4. Education and public relations regarding the protection of personal information under subparagraph 1 of Article 13 of the Act;
5. Promotion of and support for agencies and organizations related to the protection of personal information under subparagraph 2 of Article 13 of the Act;
6. Training of relevant specialists and development of criteria for privacy impact assessments under Article 33 (6) of the Act;
7. Receipt and processing of access requests under Article 35 (2) of the Act; 8. Requests for materials and inspections under Article 63 of the Act that are related to the following matters:
   • (a) Technical assistance for reporting under the former part of Article 34 (3) of the Act;
   • (b) Receipt and processing of, and counseling on, reports received by the Privacy Call Center pursuant to Article 62 of the Act; 9. Receipt of applications for designating an assessment institution under Article 36 (2) and receipt of reports under Article 37 (6).

(4) The institutions to which the Protection Commission may entrust its work regarding the matters specified in the subparagraphs of paragraph (3) shall be as follows:

1. The Korea Internet and Security Agency;
2. A corporation, institution, or organization determined and publicly notified by the Protection Commission as having expertise in the field of personal information protection.

(5) Where the Protection Commission entrusts its work pursuant to paragraphs (2) through (4), it shall publicly announce the institutions to be entrusted with the affairs and details of the entrusted affairs in the Official Gazette or on its website.

(1) The Protection Commission (including persons entrusted with the authority of the Protection Commission under Article 62 (3)) may process sensitive information and data that contain resident registration numbers, passport numbers, driver’s license numbers, or alien registration numbers referred to in Article 19, if inevitable to perform the following business affairs:

1. Business affairs regarding deliberation and resolution on any matter under Article 7-9 (1) 4 through 6 of the Act;
2. Business affairs regarding preparing for and supporting the establishment of systems providing alternative sign-up tools under Article 24-2 (4) of the Act;
3. (deleted).
4. Business affairs regarding work of the Privacy Call Center established pursuant to Article 62 (3) of the Act;
5. Business affairs regarding submission of materials and inspections under Articles 63 (1) and (2);
6. Business affairs regarding preliminary fact-finding inspections conducted under Article 63-2 of the Act;
7. Business affairs regarding imposing and collecting penalty surcharges under Article 64-2 of the Act.

(2) The Dispute Mediation Committee may process sensitive information and data that contain resident registration numbers, passport numbers, driver’s license numbers, or alien registration numbers referred to in Article 19, if inevitable to perform the business affairs related to personal information dispute mediation under Articles 45, 47, and 49 of the Act.

(1) The Protection Commission shall examine the appropriateness of the following matters every three years, counting from each base date specified in the following (referring to the period that ends on the day before the base date of every third year), and shall take measures, such as making improvements:

1. Those eligible to be designated as assessment institutions, the requirements for revocation of designation, and the grounds for reporting changes under Article 36: January 1, 2022;
2. Scope of the persons required to be notified of the details of the use and provision of personal information, the types of information required to be notified, and the frequency and method of notification under Article 15-3: September 15, 2023;
3. Scope and standards of the parties required to purchase an insurance, etc. for performance of damage compensation responsibilities under Article 48-7: August 5, 2020.

(2) The Protection Commission shall examine the appropriateness of the following matters every two years, counting from each base date specified in the following (referring to the period that ends on the day before the base date of every second year), and shall take measures, such as making improvements:

1. Combination of pseudonymized information processed by different personal information controllers under Article 29-3: January 1, 2022;
2. Details, and method of disclosure, of the Privacy Policy under Article 31: January 1, 2015;
3. (deleted);
4. (deleted);
5. (deleted).

(3) (deleted).

The criteria for the imposition of administrative fines under Article 75 of the Act shall be as specified in attached Table 2.