Restrictions on Processing Sensitive Information and Unique Identifying Information

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.1.4 Restrictions on Processing Sensitive Information and Unique Identifying Information], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

Processing of sensitive information is prohibited in principle, and may only be carried out where separate consent has been obtained from the data subject or where there is a basis in the relevant laws.

• Scope of sensitive information

  1. Ideology/belief: various ideologies or ideological tendencies, religious beliefs, etc.
  2. Political opinion: information on positions on political matters or support for a particular political party
  3. Joining/withdrawing from a labor union/political party: information on joining/withdrawing from a labor union or political party
  4. Information on health and sex life: information on an individual's past and present medical history, physical/mental disability (whether a disability grade exists, etc.), sexual orientation, etc.
  5. Personal information likely to significantly infringe on privacy
     • Genetic information obtained as a result of genetic testing, etc., and information on criminal records
     • Information on criminal records such as sentences or dispositions including the imposition/exemption of and suspension of imposition of a penalty of a fine or heavier, protective custody, medical custody, protective observation, invalidation of suspension of imposition, cancellation of suspension of execution, confiscation/collection imposed together with a penalty of a fine or heavier, community service orders, attendance orders, etc.
     • Information on an individual's physical/physiological/behavioral characteristics generated through certain technical means for the purpose of uniquely identifying a specific individual (biometric feature information)
     • Information on race or ethnicity

• Cases in which sensitive information may be processed

  1. Where consent has been obtained from the data subject separately from consent to the processing of other personal information
  2. Where laws require or permit the processing of sensitive information

Unique identifying information (excluding resident registration numbers) must be processed only when separate consent has been obtained from the data subject or when there is a specific basis in the relevant laws.

• Scope of unique identifying information

  1. Resident registration number (however, under the statutory principle governing the collection of resident registration numbers, collection based on consent is not permitted)
  2. Passport number
  3. Driver's license number
  4. Alien registration number

• Cases in which unique identifying information (excluding resident registration numbers) may be processed

  1. Where consent has been obtained from the data subject separately from consent to the processing of other personal information
  2. Where laws specifically require or permit the processing of unique identifying information

When it is judged that there is a risk of privacy infringement because the data subject's sensitive information is included in information disclosed in the course of providing goods or services, the possibility of disclosure of the sensitive information and the method of choosing non-disclosure must be informed to the data subject in an easily recognizable manner before the goods or services are provided.

• Where applicable, this must also be disclosed in the privacy policy