Installation/Operation of Video Information Processing Devices

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.1.6 Installation/Operation of Video Information Processing Devices], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

• When installing/operating a fixed video information processing device in a public place, it must be reviewed whether the case falls under the legally permitted requirements.

  • Definition of a fixed video information processing device : A device installed in a fixed space to continuously or periodically capture images, etc. of persons or objects, or to transmit such images through a wired/wireless network, referring to closed-circuit television and network cameras (Article 2, Subparagraph 7 of the Personal Information Protection Act and Article 3(1) of the Enforcement Decree of the same Act)
    • Scope of fixed video information processing devices (Article 3(1) of the Enforcement Decree of the Personal Information Protection Act)
      1. Closed-circuit television: a device falling under any of the following
         • a. A device that, through a camera installed in a fixed space, continuously or periodically captures images, etc. or transmits the captured video information to a specific place through a transmission line such as a wired/wireless closed circuit
         • b. A device that enables the recording/logging of video information captured or transmitted pursuant to item a
      2. Network camera: a device that enables the person who installs/manages the equipment to process the video information, continuously or periodically captured through equipment installed in a fixed space, such as by collecting/storing it from anywhere via the wired/wireless internet
  • Cases in which a fixed video information processing device may be installed/operated in a public place
    1. When specifically permitted by law
    2. When necessary for the prevention and investigation of crime
    3. When installed/operated by a person with legitimate authority for the safety and management of facilities and the prevention of fire
    4. When installed/operated by a person with legitimate authority for traffic enforcement
    5. When installed/operated by a person with legitimate authority for the collection/analysis and provision of traffic information
    6. Cases where the captured video information is not stored and which fall under any of the following
       • When necessary to derive statistical values such as the number of visitors
       • When necessary to derive statistical characteristic values such as gender and age group
       • Other cases equivalent to the above two, where the matter has undergone deliberation/resolution by the Personal Information Protection Commission
  • It is prohibited to install/operate a video information processing device so as to be able to view the interior of places likely to significantly infringe on an individual's privacy, such as bathhouses, restrooms, sweat rooms (發汗室), and dressing rooms used by an unspecified number of people. However, this is exceptionally permitted for facilities that detain or protect persons based on law, such as prisons and mental health facilities, as prescribed by Presidential Decree (correctional facilities, mental medical institutions equipped with confinement facilities, mental care facilities, and mental rehabilitation facilities).

• When a public institution, etc. intends to install/operate a fixed video information processing device in a public place, it must collect the opinions of relevant experts and interested parties by going through legal procedures such as a public hearing/briefing session.

  • Persons who must go through the opinion-collection procedure
    1. The head of a public institution that intends to install/operate a fixed video information processing device in a public place
    2. Correctional facilities, mental medical institutions, mental care facilities, and mental rehabilitation facilities that intend to install/operate a fixed video information processing device so as to be able to view the interior of places likely to significantly infringe on an individual's privacy
  • Opinion-collection procedure
    1. Conducting an administrative notice or hearing of opinions pursuant to the Administrative Procedures Act
    2. A briefing session/survey or public opinion poll targeting local residents, etc. who are directly affected by the installation of the video information processing device concerned
  • Persons subject to opinion collection
    1. Relevant experts
    2. Interested parties such as persons working at the facility concerned, persons detained or protected at the facility concerned, or the guardians of such persons

• When installing/operating a fixed video information processing device, an information sign must be installed so that data subjects can easily recognize it.

  • Matters to be included in the information sign
    1. Purpose and location of installation
    2. Filming scope and time
    3. Contact information of the person responsible for management
    4. Name and contact information of the trustee (when the affairs of installing/operating the video information processing device are entrusted)
  • Exceptions to installing an information sign
    1. Military facilities
    2. National key facilities
    3. National security facilities
  • Considerations when installing an information sign
    • Install it in a location where data subjects can easily see it
    • When multiple fixed video information processing devices are installed within a building, an information sign indicating that the entire facility or place is a fixed video information processing device installation area may be installed in a conspicuous place such as the entrance
    • Where it is impossible to install an information sign due to the characteristics of the location, or where data subjects cannot easily see it even if an information sign is installed, such as when a public institution installs a fixed video information processing device for purposes such as long-distance filming, speeding/signal violation enforcement, or traffic flow surveys with little risk of infringement of personal information, or when installing a fixed video information processing device for forest fire monitoring, the relevant matters may be posted on the internet homepage

• When operating a mobile video information processing device in a public place for business purposes, it must be reviewed whether the case falls under the legally permitted requirements, and measures accordingly must be implemented.

  • Definition of a mobile video information processing device : A device that captures images, etc. of persons or objects by being worn on or carried by the body, or attached to or mounted (据置) on a movable object, or that transmits such images through a wired/wireless network, as prescribed by Presidential Decree (Article 2, Subparagraph 7-2 of the Personal Information Protection Act and Article 3(2) of the Enforcement Decree of the same Act)
    • Scope of mobile video information processing devices (Article 3(2) of the Enforcement Decree of the Personal Information Protection Act)
      1. Wearable device: a device such as glasses or a watch worn on a person's body or clothing that captures images, etc. or collects/stores or transmits captured video information
      2. Portable device: a device such as a mobile communication terminal or digital camera carried by a person that captures images, etc. or collects/stores or transmits captured video information
      3. Attached/mounted device: a device attached to or mounted (据置) on a movable object such as a vehicle or drone that captures images, etc. or collects/stores or transmits captured video information
  • Cases in which a mobile video information processing device may be operated in a public place for business purposes
    1. Cases falling under any of the subparagraphs of Article 15(1) of the Personal Information Protection Act (consent of the data subject, etc.)
    2. Cases where the data subject has not expressed an intention to refuse filming despite the fact of filming being clearly indicated so that the data subject can be aware of it. In this case, this is limited to cases where there is no risk of unfairly infringing on the rights of the data subject and which do not exceed a reasonable scope
    3. Other cases equivalent to Subparagraphs 1 and 2, as prescribed by Presidential Decree
  • Anyone is prohibited from capturing images of a person or objects related to that person using a mobile video information processing device in a place from which the interior of places likely to significantly infringe on an individual's privacy, such as bathhouses, restrooms, sweat rooms, and dressing rooms used by an unspecified number of people, can be viewed. However, filming is exceptionally permitted when it is necessary for the rescue/emergency aid of human life, etc. in situations such as crime, disaster, fire, or those equivalent thereto.

• When capturing images of a person or objects related to that person using a mobile video information processing device in a public place for business purposes, the fact of filming must be indicated and notified by means of light, sound, information sign, etc. so that the data subject can easily be aware of the fact of filming.

  • Methods of indicating the fact of filming : light, sound, information sign, written notice, announcement, or other means equivalent thereto
  • Exceptions to indicating the fact of filming : Where it is difficult to indicate and notify data subjects of the fact of filming in a manner that they can easily be aware of, due to the characteristics of the filming method such as aerial photography by drone, the fact and purpose of filming, and the date, time, and place of filming, etc. shall be announced through the homepage established/operated by the Personal Information Protection Commission to support the indication of the fact of filming by mobile video information processing devices (Article 39-2(2) of the Standard Personal Information Protection Guidelines)

• The video information processing device operator must establish and implement a video information processing device operation/management policy for the safe management of video information processing devices and video information.

  • In the case of a fixed video information processing device operator, establish a fixed video information processing device operation/management policy, and in the case of a mobile video information processing device operator, establish a mobile video information processing device operation/management policy
  • Matters to be included in the video information processing device operation/management policy
    1. Basis and purpose of installation of the video information processing device
    2. Number of devices installed, installation location, and filming scope of the video information processing device
    3. The person responsible for management, the department in charge, and persons with access authority to the video information
    4. Filming time, retention period, storage location, and processing method of the video information
    5. The video information processing device operator's method and place for checking video information
    6. Measures in response to the data subject's requests such as viewing of video information
    7. Technical/administrative and physical measures for the protection of video information
    8. Other matters necessary for the installation/operation and management of the video information processing device
  • When matters concerning the operation/management of video information processing devices are included when establishing the privacy policy, a separate video information processing device operation/management policy need not be established
  • Include in the regulations and carry out management/supervision so that the fixed video information processing device is not arbitrarily manipulated or aimed at another place for a purpose different from that for which it was installed
  • Take measures so that the audio recording function of the fixed video information processing device cannot be used

• A retention period for video information must be set, and it must be destroyed without delay upon expiration of the retention period.

  • Determine the retention period as the minimum period for achieving the purpose of retaining the video information
  • However, where there are special provisions in other laws regarding the retention period of video information, retain it in accordance with the relevant provisions
  • Where it is difficult for the video information processing device operator to calculate the minimum period for achieving the purpose of retention according to its circumstances, the retention period shall be within 30 days after the collection of the personal video information (Article 41(2) of the Standard Personal Information Protection Guidelines)

• When the affairs concerning the installation/operation of video information processing devices are entrusted, the necessary content must be reflected in the contract in accordance with the relevant procedures and requirements.

  • Content to be included in a public institution's contract for entrusting the affairs of installing/operating video information processing devices (Article 26(1) of the Enforcement Decree of the Personal Information Protection Act)
    1. Purpose and scope of the entrusted affairs
    2. Matters concerning restrictions on re-entrustment
    3. Matters concerning measures to secure safety, such as restricting access to video information
    4. Matters concerning the inspection of the management status of video information
    5. Matters concerning liability such as damages in the event that the trustee violates its obligations