1. Reason for Enactment

In accordance with the revision to the Personal Information Protection Act (promulgated on March 14, 2023) and the Enforcement Decree of the same Act, the proposed enactment stipulates the methods of requesting personal information transmission, transmission, designation of an institution specializing in managing personal information, and registration procedures for a personal information transmission support platform, etc., all of which are matters delegated to the notification.

2. Main contents

A. Facilities and technology for general recipients (Article 3 of the draft).

- The enactment stipulates detailed standards for the facilities and technology that general recipients must possess, such as transmission request-related systems, protection equipment and technology, transmission history recording and storage systems, access rights management, access control, etc.

B. Methods of requesting transmission and methods of transmission (Articles 4 to 5 of the draft).

- The enactment stipulates the format of transmission requests, which must be written and submitted to the transmitter of information when requesting transmission in accordance with Article 35-2, Paragraph 2 of the Act.

- It stipulates the method by which the safety and reliability of information transmission can be guaranteed.

- It stipulates the restrictions on the method of viewing the information to be transmitted, such as by requiring general recipients and institutions specializing in managing personal information to directly store each means of access by the data subject.

C. Criteria for designating an institution specializing in managing personal information and designating authority (Articles 6 to 7 of the draft).

- It stipulates stipulates the facilities and technology, protection systems, and insurance or mutual aid subscription standards with which an institution specializing in managing personal information must be equipped.

- It stipulates that the designating authority for an institution specializing in managing personal information shall be the head of the Protection Committee or the relevant central administrative agency, which shall be determined by considering the business relevance of the information to be transmitted.

D. Application for designation of an institution specializing in managing personal information and procedures (Articles 8 to 9 of the draft).

- It stipulates the designation application form and application documents to be submitted by the designation applicant and the relevant procedures.

- It stipulates specific designation procedures such as the method of examination, examination period, and consultation with the relevant ministries.

E. Composition and designation of the designation review committee (Articles 10 to 11 of the draft).

- It stipulates the composition, operation, and support of the designation review committee, which examines whether the criteria for the designation of an institution specializing in managing personal information are met.

- It stipulates such procedures as confirmation of the results of reviews conducted by the designation review committee, confirmation of compliance when imposing conditions, and issuance of designation certificates.

F. Preliminary designation and approval of change of an institution specializing in managing personal information (Articles 12 to 13 of the draft).

- It stipulates the preliminary designation application form and application documents to be submitted by the preliminary designation applicant and the relevant procedures.

- It stipulates the change approval application form and application documents to be submitted by the person seeking approval of a change and the relevant procedures, and specifies ‘minor matters’ that are not subject to change approval.

G. Redesignation and cancellation of designation of an institution specializing in managing personal information (Articles 14 to 15 of the draft).

- It stipulates the application period for re-designation, and application of the designation review procedures in cases of re-designation review, etc.

- The designating authority may request correction and supplementation by the specialized agency when a reason for cancellation occurs; and in the case of cancellation, it may order such measures as a suspension of business and the destruction of personal information.

H. Public notice of designation of an institution specializing in managing personal information (Article 16 of the draft).

- In the event that the designating authority designates, re-designates, or cancels the designation of a specialized agency, the relevant matters shall be announced in the Official Gazette or posted on the website.

- In the event that a decision is made to designate, pre-designate, change approval, re-designate, or cancel a designation, the Protection Commission shall be notified thereof at least 10 days prior to the date on which the decision takes effect.

I. Registration of a Personal Information Transmission Support Platform (Articles 17 to 18 of the draft).

- It stipulates the registration procedures for the personal information transmission support platform of general recipients, institutions specializing in managing personal information, and information transmitters.