(1) Chapter III through VIII shall not apply to any of the following personal information:

1. (deleted);
2. Personal information collected or requested to be provided for the analysis of information related to national security;
3. (deleted);
4. Personal information collected or used for its own purposes of reporting by the press, missionary activities by religious organizations, and nomination of candidates by political parties, respectively.

(2) Articles 15, 22, 22-2, 27 (1) and (2), 34, and 37 shall not apply to any personal information that is processed by means of the fixed visual data processing devices installed and operated at open places pursuant to the subparagraphs of Article 25 (1).

(3) Articles 15, 30 and 31 shall not apply to any personal information that is processed by a personal information controller to operate a group or association for friendship, such as an alumni association and a hobby club.

(4) In the case of processing personal information pursuant to paragraph (1), a personal information controller shall process the personal information to the minimum extent necessary to attain the intended purpose for the minimum period; and shall also make necessary arrangements, such as technical, managerial and physical safeguards, individual grievance handling and other necessary measures for the safe management and appropriate processing of such personal information.

This Act shall not apply to information that no longer identifies a certain individual when combined with other information, reasonably considering time, cost, technology, etc.

Anyone who processes or has processed personal information shall be prohibited from engaging in any of the following activities:

1. To acquire personal information or to obtain consent to personal information processing by fraud or other improper means;
2. To divulge personal information acquired in the course of performing his or her work, or to provide it for any third party’s use without authority;
3. To use, damage, destroy, alter, forge, or divulge any other person’s personal information without legitimate authority or beyond proper authority.

Any person who performs or has performed the following work shall not divulge any confidential information acquired in the course of performing his or her duties to any other person, nor use such information for any purpose other than for his or her duties: Provided, That, this shall not apply except as provided in other statutes:

1. Work of the Protection Commission provided in Article 8;
2. Work of designating specialized institutions and duties of specialized institutions under Article 28-3;
3. Certification of personal information protection provided in Article 32-2;
4. Privacy impact assessments provided in Article 33;
5. Work of designating institutions specializing in managing personal information and affairs of such institutions under Article 35-3;
6. Dispute mediation of the Dispute Mediation Committee under Article 40.

(1) The Protection Commission may present its opinion to any relevant agency through deliberation and resolution where it is deemed necessary with respect to the statutes or regulations or municipal ordinances containing provisions that are likely to affect the protection of personal information.

(2) The Protection Commission may advise a personal information controller to improve the status of personal information processing where doing so is deemed necessary to protect personal information. In such cases, upon receiving the advice, the personal information controller shall make sincere efforts to comply with the advice, and shall inform the Protection Commission of the results.

(3) The head of a related central administrative agency may recommend that a personal information controller improve the status of personal information processing pursuant to the statutes under the related central administrative agency’s jurisdiction where doing so is deemed necessary to protect personal information. In such cases, upon receiving the recommendation, the personal information controller shall make sincere efforts to comply with the recommendation, and shall inform the head of the related central administrative agency of the results.

(4) Central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission may provide their opinions, or provide guidance or inspection with respect to the protection of personal information to their affiliated entities and the public institutions under their jurisdiction.

(1) Anyone who suffers infringement of rights or interests relating to his or her personal information in the course of personal information processing by a personal information controller may report such infringement to the Protection Commission.

(2) The Protection Commission may designate a specialized institution in order to efficiently receive and handle the claim reports pursuant to paragraph (1), as prescribed by Presidential Decree. In such cases, such specialized institution shall establish and operate a personal information infringement call center (hereinafter referred to as the “Privacy Call Center”).

(3) The Privacy Call Center shall perform the following work:

1. To receive claim reports and provide consultation in relation to personal information processing;
2. To investigate and confirm incidents and hear opinions of related parties;
3. Work incidental to those under subparagraphs 1 and 2.

(4) The Protection Commission may, if necessary, dispatch its public official to the specialized institution designated under paragraph (2) pursuant to Article 32-4 of the State Public Officials Act in order to efficiently investigate and confirm the incidents pursuant to paragraph (3) 2.

(1) The Protection Commission may request relevant materials, such as articles and documents, from a personal information controller in any of the following cases:

1. Where any violation of this Act is found or suspected;
2. Where any violation of this Act is reported or a civil complaint thereon is received;
3. In cases prescribed by Presidential Decree where it is necessary to protect the personal information of data subjects.

(2) Where a personal information controller fails to furnish materials pursuant to paragraph (1) or is regarded as having violated this Act, the Protection Commission may require its public official to enter the offices or places of business of the personal information controller and other persons related to such violation to inspect the status of business operations, ledgers, documents, etc. In such cases, the public official who conducts the inspection shall carry identification verifying his or her authority and show it to relevant persons.

(3) The Protection Commission may request the heads of the following relevant institutions to cooperate in taking prompt and effective measures where any serious personal information breach occurs due to a violation of laws related to the protection of personal information, such as this Act:

1. Central administrative agencies;
2. A local government;
3. Other public institutions having, delegated or entrusted with, administrative authority pursuant to statutes and regulations or municipal ordinances and rules.

(4) The head of a relevant institution who receives a request for cooperation under paragraph (3) shall comply with such request in the absence of special circumstances.

(5) Matters necessary for requests for the submission of materials, procedures and methods for inspection, etc. under paragraphs (1) and (2) may be determined and publicly notified by the Protection Commission.

(6) The Protection Commission shall neither provide any third party with the documents, materials, etc. furnished or collected pursuant to paragraphs (1) and (2), nor disclose them to the general public, except as provided in this Act.

(7) Upon receiving materials via information and communications networks, or digitalizing the collected materials, etc., the Protection Commission shall take systematic and technical supplementary measures to prevent the divulgence of personal information, trade secrets, etc.

(1) In cases not falling under the subparagraphs of Article 63 (1), the Protection Commission may inspect the status of protection of personal information of a personal information controller that is highly susceptible to a personal information breach incident and deemed to need a preliminary inspection of vulnerabilities in the protection of personal information.

(2) The Protection Commission may, if it finds any violation of this Act through a fact-finding inspection under paragraph (1), formulate a correction scheme and recommend that the relevant personal information controller comply with it.

(3) Upon receipt of the recommendation for correction under paragraph (2), a personal information controller shall notify the Protection Commission as to whether it accepts the recommendation within 10 days from the date of receipt of the recommendation, and inform the Protection Commission of the results of the implementation thereof, as prescribed by Notification of the Protection Commission.

(4) When any person upon receipt of the recommendation for correction under paragraph (2) accepts the relevant recommendation, he or she shall be deemed to have received an order for corrective measures (referring to a recommendation under Article 64 (3) in cases of central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission) under Article 64 (1).

(5) If a person upon receipt of the recommendation for correction under paragraph (2) refuses to accept or fails to comply with the relevant recommendation, the Protection Commission may conduct an inspection under Article 63 (2).

(6) The Protection Commission may inspect the status of personal information protection under paragraph (1) jointly with the head of a relevant central administrative agency.

(1) The Protection Commission may order a person who violates this Act (excluding central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission) to take the following measures:

1. To suspend personal information breach;
2. To temporarily suspend personal information processing;
3. Other measures necessary to protect personal information and to prevent personal information infringement.

(2) A local government, the National Assembly, the Court, the Constitutional Court, or the National Election Commission may order their affiliated entities and public institutions, which are found to have violated this Act, to take the measures provided in the subparagraphs of paragraph (1).

(3) When a central administrative agency, a local government, the National Assembly, the Court, the Constitutional Court, or the National Election Commission violates this Act, the Protection Commission may recommend that the head of the relevant agency take any of the measures provided in the subparagraphs of paragraph (1). In such cases, upon receiving the recommendation, the agency shall comply therewith unless there is a compelling reason not to do so.

(1) The Protection Commission may impose a penalty surcharge on the relevant personal information controller within the scope not exceeding 3/100 of the total sales, in any of the following cases: Provided, That a penalty surcharge not exceeding two billion won may be imposed in cases prescribed by Presidential Decree where no sales have been made or where it is impracticable to calculate the sales:

1. Where the personal information controller processes personal information, in violation of Article 15 (1), 17 (1), 18 (1) and (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), or 19;
2. Where the personal information controller processes personal information of a child under 14 years of age without his or her legal representative’s consent, in violation of Article 22-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
3. Where the personal information controller processes sensitive information without the data subject’s consent, in violation of Article 23 (1) 1 (including where it is applied mutatis mutandis pursuant to Article 26 (8));
4. Where the personal information controller processes personally identifiable information or resident registration numbers, in violation of Articles 24 (1) and 24-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
5. Where the personal information controller neglects its management, supervision, or education under Article 26 (4), thereby causing the person entrusted to violate this Act;
6. Where the personal information controller processes information to uniquely identify an individual (including where it is applied mutatis mutandis pursuant to Article 26 (8)) in violation of Article 28-5 (1);
7. Where the personal information controller makes cross-border transfers of personal information, in violation of Article 28-8 (1) (including where it is applied mutatis mutandis pursuant to Articles 26 (8) and 28-11);
8. Failing to comply with an order to suspend a cross-border transfer, in violation of Article 28-9 (1) (including where it is applied mutatis mutandis pursuant to Articles 26 (8) and 28-11);
9. Where the personal information processed by the personal information controller is lost, stolen, divulged, forged, altered, or damaged; Provided, That this shall not apply where a personal information controller has taken all measures necessary to ensure safety under Article 29 (including where it is applied mutatis mutandis pursuant to Article 26 (8)) to prevent personal information from being lost, stolen, divulged, forged, altered, or damaged.

(2) Where the Protection Commission intends to impose a penalty surcharge under paragraph (1), it shall calculate the penalty surcharge based on the gross sales net of the sales unrelated to the violation.

(3) Where the Protection Committee intends to impose a penalty surcharge pursuant to paragraph (1), it may calculate the sales based on the gross sales of the personal information controller if the personal information controller refuses to submit sales calculation data or submits false data without good case: Provided, That it may presume sales based on the scale of personal information retained, accounting data such as financial statements, prices of products and services, and other data regarding the business state of a personal information controller with a size similar to that of the relevant personal information controller.

(4) The Protection Commission shall, where it imposes a penalty surcharge under paragraph (1), take into account the following matters to ensure that the penalty surcharge shall be proportional to the violation and be effective in preventing breach:

1. The details and degree of a violation;
2. The duration and frequency of violations;
3. Scale of profits derived from a violation;
4. Efforts to take measures to ensure safety, such as encryption;
5. Where the personal information is lost, stolen, divulged, forged, altered, or damaged, the relation to the violation and the scale of loss, theft, divulgence, forgery, alteration, or damage;
6. Whether measures for recovering from damage and preventing the spread of damage have been taken;
7. The type and volume of work of the personal information controller;
8. Types of personal information processed by a personal information controller and the impact on data subjects;
9. The amount of damage caused by the violation;
10. Efforts for the protection of personal information, including the certification of personal information protection and autonomous protection activities;
11. Whether measures have been taken to rectify violations, including cooperation with the Protection Commission.

(5) The Protection Commission need not impose a penalty surcharge in any of the following cases:

1. Where the person subject to the penalty surcharge is objectively deemed unable to pay the penalty surcharge due to insolvency, suspension of payment, capital impairment, etc.;
2. Where there is good cause for the person subject to the penalty surcharge to mistakenly believe that his or her conduct is not illegal;
3. Where the details and degree of the violation are minor or where the assessed penalty surcharge is small;
4. Where any ground prescribed by Presidential Decree exists, on which the data subject has suffered no or minor damage.

(6) Penalty surcharges under paragraph (1) shall be calculated in consideration of paragraphs (2) through (5), but the detailed calculation criteria and procedures shall be prescribed by Presidential Decree.

(7) If the person subject to the penalty surcharge under paragraph (1) fails to pay it by the payment deadline, the Protection Commission shall collect the additional charge equivalent to 6/100 per annum of the unpaid penalty surcharge from the date following the payment deadline. In such cases, the period for collecting of the additional charge shall not exceed 60 months.

(8) Where a person liable to pay a penalty surcharge under paragraph (1) fails to pay it by the payment deadline, the Protection Commission shall demand payment thereof within a specified period; and where the penalty surcharges and additional charges under paragraph (7) are not paid within the specified period, the Protection Commission shall collect such penalty surcharges in the same manner as national taxes are compulsorily collected.

(9) When the penalty surcharges imposed according to paragraph (1) are refunded for such reasons as a court’s decision, the Protection Commission shall make an additional refund in an amount calculated based on the interest rate prescribed by Presidential Decree in consideration of the deposit interest rates of financial companies, etc., for the period beginning on the date of payment of penalty surcharges and ending on the date of the refund.

(10) Notwithstanding paragraph (9), when a disposition to impose penalty surcharges is revoked due to a court’s decision and new penalty surcharges are imposed based on the reasoning of the decision, additional refunds shall be calculated and paid only with respect to the amount that remains after the newly imposed penalty surcharges are deducted from the penalty surcharges already paid.

(1) When there is deemed substantial ground for suspecting a criminal violation of this Act or other data protection-related statutes, the Protection Commission may make an accusation to the competent investigative agency.

(2) When there is deemed substantial ground for deeming that there has been a violation of this Act or other data protection-related statutes, the Protection Commission may recommend the relevant personal information controller to take disciplinary action against the person responsible for such violation (including the representative and the executive officer in charge). In such cases, upon receiving the recommendation, the relevant personal information controller shall comply therewith, and notify the Protection Commission of the results.

(3) The head of a related central administrative agency may file a criminal complaint against a personal information controller pursuant to paragraph (1), or recommend that the head of an affiliated agency, organization, etc. take disciplinary action pursuant to paragraph (2), in accordance with the statutes under the central administrative agency’s jurisdiction. In such cases, upon receiving the recommendation under paragraph (2), the head of an affiliated agency, organization, etc. shall comply therewith, and notify the head of the related central administrative agency of the results.

(1) The Protection Commission may publish the recommendation for improvement under Article 61; the order to take corrective measures under Article 64; the imposition of penalty surcharges under Article 64- 2; the accusation or recommendation for a disciplinary action under Article 65; and the imposition of administrative fines under Article 75 and the results thereof.

(2) Where the Protection Commission makes dispositions such as a recommendation for improvement under Article 61, an order to take corrective measures under Article 64, the imposition of a penalty surcharge under Article 64-2, an accusation or recommendation for a disciplinary action under Article 65, or a disposition to impose an administrative fine under Article 75, it may order the person who has received such disposition to publish the fact of receiving such disposition.

(3) The method, criteria, procedure, etc. for publishing the fact of receiving a recommendation for improvement, etc. and issuing orders for publication under paragraphs (1) and (2) shall be prescribed by Presidential Decree.

(1) The Protection Commission shall prepare a report each year, based on necessary materials furnished by related agencies, etc., in relation to the establishment and implementation of personal information protection policy measures, and submit (including transmission via an information and communications networks) it to the National Assembly before the opening of the regular session.

(2) The annual report referred to in paragraph (1) shall contain the following matters:

1. Infringement on the rights of data subjects and the status of remedies thereof;
2. Results of fact-finding surveys on personal information processing and the assessments of the level of personal information protection;
3. Status of implementation of the personal information protection policy measures and achievements;
4. Global legislative and policy trends regarding personal information;
5. Status of the enactment and amendment of statutes, Presidential Decrees, the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, the National Election Commission Regulations, and the Board of Audit and Inspection Regulations, in relation to processing of resident registration numbers;
6. Other matters to be disclosed or reported in relation to the personal information protection policy measures.

(1) The authority of the Protection Commission or the head of a related central administrative agency under this Act may in part be delegated or entrusted, as prescribed by Presidential Decree, to the Special Metropolitan City Mayor, Metropolitan City Mayors, Do Governors, Special Self-Governing Province Governors, or the specialized institutions prescribed by Presidential Decree.

(2) The agencies to which the authority of the Protection Commission or the head of a related central administrative agency has been partially delegated or entrusted pursuant to paragraph (1) shall notify the Protection Commission or the head of the related central administrative agency of the results of performing the work delegated or entrusted.

(3) Where delegating or entrusting a part of the authority to a specialized institution pursuant to paragraph (1), the Protection Commission may provide a contribution to the special institution to cover expenses incurred in performing the work.

(1) Among the Commissioners of the Protection Commission, Commissioners other than public officials and employees other than public officials shall be deemed a public official for the purposes of applying penalty under the Criminal Act or other statutes.

(2) Any executive or employee of a relevant agency that performs the works entrusted by the Protection Commission or the head of a related central administrative agency shall be deemed a public official for the purposes of applying Articles 129 through 132 of the Criminal Act.