Restrictions on Processing Resident Registration Numbers

Resident registration numbers may not be processed, including collection, except where there is a legal basis, as follows.

• Cases in which the processing of a resident registration number, including collection, is permitted (collection based on consent is not permitted)

Where a resident registration number is processed, the legal provision that serves as the basis for such processing must be specifically identified so that it can be proven.

• The phrase "where an Act, Presidential Decree, National Assembly Regulations, Supreme Court Regulations, Constitutional Court Regulations, National Election Commission Regulations, or Board of Audit and Inspection Regulations specifically require or permit the processing of resident registration numbers" means that a specific provision requiring or permitting the personal information controller to process resident registration numbers exists in at least one of the Acts and the like.
• Because Article 24-2(1)1 of the Personal Information Protection Act limits the scope of the statutes under which resident registration numbers may be processed, resident registration numbers may not be processed on the basis of enforcement rules.
• Pursuant to Article 24-2(1)2 of the Personal Information Protection Act, a resident registration number may exceptionally be processed where it is deemed clearly necessary for the urgent life, bodily, or property interests of a data subject or a third party.
• Unless one of the exceptional grounds specified in the subparagraphs of Article 24-2(1) of the Personal Information Protection Act applies, collecting a resident registration number, providing it to a third party, or storing/retaining it is also prohibited.

※ Examples of judging the lawfulness of processing resident registration numbers

• Enforcement rules, directives/established rules/public notices of administrative agencies at each level, and ordinances/rules of local governments and the like cannot serve as a basis for collecting resident registration numbers.
• If a statute merely prescribes an obligation to verify identity or verify age and the like, this does not constitute a specific provision of a basis for processing resident registration numbers.
• Collecting/using only the last 7 digits rather than the entire resident registration number is an act that utilizes the assignment scheme of the resident registration number and thus uses the unique characteristics of the resident registration number, namely its uniqueness and identifiability, so this can be regarded as collecting/using the entire resident registration number (the same applies where only part of the last 7 digits is processed).
• Until a job applicant is finally selected and becomes an employee, there is no provision in an Act or Presidential Decree that requires a company to process the applicant's resident registration number, so requiring the resident registration number to be entered on a resume/application form and the like is prohibited. However, after final selection, it is permissible for the company to collect and otherwise process the applicant's resident registration number as prescribed by the relevant Act or Presidential Decree for purposes such as enrollment in the four major insurances including employment insurance and withholding of income tax on wages.
• The act of visually checking an identification card bearing a resident registration number for the purpose of identity verification and returning it is not an act of collecting the resident registration number, so it does not violate the principle prohibiting the processing of resident registration numbers.

Even where a resident registration number is processed pursuant to a legal basis, a method (an alternative registration means to the resident registration number) by which a data subject can register as a member without using a resident registration number must be provided at the stage of registering as a member through the internet website.

• Examples of alternative registration means to the resident registration number: i-PIN, mobile phone, credit card, certificate, and the like

※ Identification values using an alternative registration means (examples)

• CI (Connection Information): a one-way encrypted 88-byte string generated in the case of identity verification through an alternative means at an identity verification agency; it must be used only as external connection information, and it is advisable not to use it for internal identification purposes.
• DI (Duplication Information): a one-way encrypted 64-byte string generated in the case of identity verification through an alternative means at an identity verification agency; it is used to restrict the creation of duplicate accounts by a user within a site.