1. Reasons for Enactment
This Notice aims to define selection criteria and evaluation procedures for personal information processing policy subject to evaluation as delegated under an amendment to the Personal Information Protection Act (Act No. 19234; promulgated on March 14, 2023; enforced on September 15, 2023) and the Enforcement Decree of the same Act in an effort to increase accountability and transparency in personal information processing.
* Under Article 31-2 of the Amendment to the Enforcement Decree of the Personal Information Protection Act, the selection criteria and evaluation procedures for personal information processing policy subject to evaluation are delegated to the Notice.
2. Major Provisions
A. Selection criteria for personal information processing policy subject to evaluation (Article 4)
- Define specific criteria to be considered, including revenue, types of personal information, and the size of personal information retained, when selecting those subject to evaluation as specified in the Enforcement Decree.
B. Evaluation procedures for personal information processing policy (Articles 3, 5, and 7)
- Specify evaluation procedures, such as the conduct of evaluation, including establishing and disclosing evaluation plans, organizing the Evaluation Committee, and reviewing documents, the notification of evaluation results, and the filing of an objection.
C. Organization and operation of the Evaluation Committee (Article 6)
- Allow the Protection Committee to organize and operate the Evaluation Committee with 20 to 50 external experts academically knowledgeable and experienced with personal information protection.
D. Use of evaluation results (Article 8)
- Allow the Protection Committee to make improvement recommendations under Article 61 Paragraph 2 of the Act if improvements are required upon evaluation, disclose or order the disclosure of evaluation results under Article 66 of the Act, and reward an outstanding personal information processor.
