Guaranteeing the Rights of Data Subjects

Methods and procedures for exercising rights shall be established and disclosed so that a data subject or their representative can request access to, correction/deletion of, suspension of processing of, and withdrawal of consent regarding personal information (hereinafter referred to as "requests for access, etc.") no more difficult than the method/procedure for collecting personal information.

• Specific methods and procedures by which the data subject can make requests for access, etc. shall be established and disclosed so that the data subject can easily become aware of them
• The methods and procedures for the data subject to exercise their rights shall, at a minimum, be easier and more convenient than the personal information collection procedure or the membership registration procedure, and supporting documents that were not required at the time of collecting personal information shall not be additionally required
• It is necessary to provide as diverse a range of methods for exercising rights as possible so that the data subject can conveniently choose (visit, in writing, telephone, e-mail, internet website, etc.)

Matters to be observed when establishing methods and procedures for access requests (Article 41(2) of the Enforcement Decree of the Personal Information Protection Act)

1. Provide methods that the data subject can easily use, such as in writing, telephone, e-mail, and internet
2. Except where there is a justifiable reason, such as where continuous operation of the channel through which the personal information was collected is difficult, allow requests for access to personal information to be made at least through the same channel or method by which the personal information was collected
3. A personal information controller that operates an internet website shall disclose the methods and procedures for access requests on the website

※ When establishing methods and procedures, they shall be no more difficult than the methods and procedures for collecting the relevant personal information

• It shall be verified whether the person making the request for access, etc. is the data subject in person or a legitimate representative, and the verification method shall be one that is objectively recognized as a reasonable means (electronic signature, i-PIN, identity card verification, etc.)

Scope of representatives (Article 45 of the Enforcement Decree of the Personal Information Protection Act)

1. The legal representative of the data subject
2. A person delegated by the data subject (a voluntary representative granted power of representation by the data subject under a delegation contract, etc.)

• Where the personal information controller is a public institution, if identity verification is possible through the shared use of administrative information under the "Electronic Government Act," verification shall be carried out through the shared use of administrative information
• A fee and postage may be charged to the person who made the request for access, etc. within the scope of the actual cost necessary to perform the related work; however, where the reason for the request for access, etc. lies with the relevant personal information controller, no fee or postage may be charged

Where a request for access to personal information is received from the data subject or their representative, the necessary measures shall be taken within 10 days so that the data subject can access the relevant personal information.

• The data subject may request access to the following matters regarding their own personal information processed by the personal information controller

Matters subject to access requests (Article 41(1) of the Enforcement Decree of the Personal Information Protection Act)

1. The items and content of the personal information
2. The purpose of collecting/using the personal information
3. The period of retention and use of the personal information
4. The status of provision of the personal information to third parties
5. The fact of and content of consent to the processing of personal information

• Where there is a justifiable reason that access cannot be granted within 10 days, the data subject shall be notified of the reason and access may be postponed; after access to personal information has been postponed, when the reason ceases to exist, access shall be granted within 10 days from the date on which the reason for postponement ceased to exist
• Where there is a ground for restricting or refusing access to personal information, the data subject shall be notified of the reason and access may be restricted or refused

Grounds on which a data subject's access request may be restricted/refused (Article 35(4) of the Personal Information Protection Act)

1. Where access is prohibited or restricted by law
2. Where there is a risk of harming another person's life/body, or a risk of unjustly infringing on another person's property or other interests
3. Where a serious impediment would be caused to a public institution in performing any of the following tasks
   • a. Tasks concerning the imposition/collection or refund of taxes
   • b. Tasks concerning grade assessment or the selection of applicants for admission at schools of each level under the "Elementary and Secondary Education Act" and the "Higher Education Act," lifelong education establishments under the "Lifelong Education Act," and other higher education institutions established under other Acts
   • c. Tasks concerning examinations related to academic ability/skills and recruitment, and qualification screening
   • d. Tasks concerning ongoing evaluation or judgment regarding the calculation of compensation/benefits, etc.
   • e. Tasks concerning audits and investigations in progress under other Acts

• Where a ground for restricting or refusing access exists for part of the matters subject to the access request, access to that part may be restricted, and access shall be granted to the portion excluding the matters for which access is restricted

Where the entity falls under those with legal obligations, procedures and measures shall be established and implemented to respond to requests for the transmission of personal information from the data subject or their representative.

• Entities with a legal obligation to comply with a data subject's request for the transmission of personal information (transmitting parties)

Category	Entity with legal obligation	Remarks
Request to transmit to the data subject themselves	A personal information controller that meets the standards prescribed by Presidential Decree in consideration of personal information processing capability	Article 35-2(1) of the Personal Information Protection Act
Request to transmit to another personal information controller (however, within a reasonable scope that is technically feasible)	A personal information controller that meets the standards prescribed by Presidential Decree in consideration of turnover, the scale of personal information held, personal information processing capability, and industry-specific characteristics	Article 35-2(2) of the Personal Information Protection Act

• Information for which transmission may be requested (personal information that meets all of the following requirements)

No	Requirements for information whose transmission may be requested
1	The information whose transmission the data subject requests is personal information about the data subject themselves and falls under any of the following: a. Personal information processed with consent under Article 15(1)1, Article 23(1)1, or Article 24(1)1 b. Personal information processed to perform a contract concluded under Article 15(1)4 or to carry out measures at the data subject's request in the course of concluding a contract c. Among personal information processed under Article 15(1)2, Article 15(1)3, Article 23(1)2, or Article 24(1)2, personal information designated as subject to transmission requests, deliberated on and resolved by the Protection Commission at the request of the head of the relevant central administrative agency, for the benefit of the data subject or for a public interest purpose
2	The personal information whose transmission is requested is not information separately generated by the personal information controller through analysis/processing based on the personal information it collected
3	The personal information whose transmission is requested is personal information processed by an information processing device such as a computer

• Requirements for personal information controllers that may receive personal information transmitted pursuant to a transmission request (information recipients)

No	Requirements for information recipients
1	A specialized personal information management institution under Article 35-3(1) of the Personal Information Protection Act
2	A person who fulfills the safety measure obligations under Article 29 of the Personal Information Protection Act and meets the facility and technical standards prescribed by Presidential Decree

※ The amended provisions of Article 35-2 of the Personal Information Protection Act concerning the right to request transmission of personal information shall take effect on a date prescribed by Presidential Decree, within a range that is not more than 2 years after promulgation, from the date on which one year has elapsed after promulgation (March 14, 2023)

Where a request to correct/delete personal information is received from the data subject or their representative, if the data subject's request is judged to be justified, the relevant personal information shall be investigated within 10 days, measures such as correction/deletion of the relevant personal information shall be taken in accordance with the data subject's request, and the result shall be notified to the data subject.

• Notify the result of the measures within 10 days from the date of receiving the request to correct/delete personal information
• When there is a request to correct or a withdrawal of consent regarding personal information that has been outsourced externally or provided to a third party, contact the trustee or third party to request the measure
• Where the personal information is specified as subject to collection by another statute, the deletion request may be refused; in this case, the fact of the decision not to comply with the request, the content of the underlying statute and the reason therefor, and the method of objection shall be notified to the relevant data subject by means of a personal information correction/deletion notice within 10 days from the date of receiving the correction/deletion request (records of contract/subscription withdrawal under the Act on Electronic Commerce, etc.)

Where a request to suspend the processing of personal information is received from the data subject or their representative, all or part of the processing shall be suspended without delay unless there is a special reason, and the result shall be notified to the data subject.

• Notify the result of the measures within 10 days from the date of receiving the request to suspend the processing of personal information
• Where there is a ground for refusing to suspend the processing of personal information, the relevant fact shall be notified to the person requesting suspension of processing within 10 days from the date of receiving the request

Grounds for refusing a request to suspend processing (Article 37(2) of the Personal Information Protection Act)

1. Where there is a special provision in law, or where it is unavoidable to comply with a statutory obligation
2. Where there is a risk of harming another person's life/body, or a risk of unjustly infringing on another person's property or other interests
3. Where a public institution would be unable to perform the tasks under its jurisdiction prescribed by other Acts if it does not process the personal information
4. Where the performance of a contract would be difficult, such as being unable to provide the service agreed upon with the data subject if the personal information is not processed, and the data subject has not clearly expressed an intention to terminate that contract

Where the data subject or their representative withdraws consent to the collection/use/provision, etc. of personal information, necessary measures such as destroying the collected personal information shall be taken without delay.

※ Measures upon withdrawal of consent by the data subject (examples)

• Destruction without delay of the personal information related to the relevant data subject
• Where a retention obligation is imposed under other statutes, storing it separately for the period prescribed by the relevant statute
• In the case of withdrawal of consent to third-party provision, taking measures so that personal information is no longer provided to the third party
• Taking measures so that text messages, e-mails, etc. for promotion, marketing, and the like are no longer sent

Where the data subject or their representative refuses a decision made by processing personal information through a fully automated system (including a system to which artificial intelligence technology is applied) (hereinafter referred to as an "automated decision") or requests an explanation, etc., necessary measures shall be taken.

• The data subject has the right to refuse an automated decision or to request an explanation, etc.

Rights of the data subject regarding automated decisions (Article 37-2 of the Personal Information Protection Act)

(1) Where a decision made by processing personal information through a fully automated system (including a system to which artificial intelligence technology is applied) (excluding automatic dispositions by an administrative agency under Article 20 of the "General Act on Public Administration"; hereinafter referred to as an "automated decision" in this Article) has a significant effect on their rights or obligations, the data subject shall have the right to refuse the relevant decision from the relevant personal information controller. However, this shall not apply where the automated decision is made pursuant to Article 15(1)1, Article 15(1)2, or Article 15(1)4.

(2) Where a personal information controller has made an automated decision, the data subject may request an explanation, etc. regarding that decision.

• Where the data subject refuses an automated decision or requests an explanation, etc. thereof, establish and implement relevant procedures so that, unless there is a justifiable reason, the automated decision is not applied, or necessary measures such as reprocessing through human intervention/explanation, etc. can be carried out
• When making an automated decision, disclose the criteria and procedures for the automated decision, the manner in which personal information is processed, etc. so that the data subject can easily check them

※ The amended provisions of Article 37-2 of the Personal Information Protection Act concerning the refusal of, and request for explanation regarding, automated decisions shall take effect from the date on which one year has elapsed after promulgation (effective March 15, 2024)

Where there is an objection to the measures taken in response to a data subject's request for access, etc., the necessary procedures shall be established and provided so that the objection can be raised.

• In this case, it is necessary to involve external experts or establish internal checks so that the objection procedure can be operated fairly

Records shall be kept of the results of receiving and processing data subjects' requests for access, etc.

• Periodically review the results of receiving and processing data subjects' requests for access, etc. to confirm whether data subjects' rights are being appropriately guaranteed, and take supplementary measures if necessary

Where someone's rights, such as privacy or reputation, are infringed on an information and communications network, procedures shall be established and implemented so that the person who suffered the infringement can request the information and communications service provider to delete the information, etc., and necessary measures shall be taken to prevent personal information from being exposed to the public through the information and communications network.

• Where someone's rights, such as privacy or reputation, are infringed by information provided for the purpose of public disclosure through an information and communications network, the person who suffered the infringement shall be able to substantiate the fact of the infringement to the information and communications service provider that processed the information and request the deletion of that information or the posting of rebuttal content
• Where someone's rights are infringed, upon receiving a request to delete the relevant information, etc., the information and communications service provider shall, without delay, take necessary measures such as deletion/interim measures and immediately notify the applicant and the person who posted the information
• Content/procedures, etc. concerning remedy procedures and other necessary measures for cases where someone's rights are infringed shall be specifically set out in advance in the terms and conditions
• The personal information controller shall ensure that personal information such as unique identifying information, account information, and credit card information is not exposed to the public through the information and communications network, and where there is a request from the Personal Information Protection Commission or the Korea Internet & Security Agency regarding personal information exposed to the public, the personal information controller shall take necessary measures such as deleting or blocking the relevant information