(ii) Presidential Decree: Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 30509, 3. Mar, 2020., Amends Other Acts)
(iii) Data subject: an individual who is identifiable by the information processed hereby to become the subject of that information
(iv) Personal information controller: a public institution, legal person, organization, individual, etc. that processes personal information directly or indirectly as part of its activities;
(v) EU: EU (As of the end of February 2020, 27 member countries (2), including Belgium, Germany, France, Italy, Luxemburg, the Netherlands, Denmark, Ireland, Greece, Portugal, Spain, Austria, Finland, Sweden, Cyprus, Czech Republic, Estonia, Hungary, Latvia, Lithuania, Malta, Poland, Slovakia, Slovenia, Rumania, Bulgaria and Croatia) as well as countries associated to the EU through the EEA Agreement (Iceland, Liechtenstein, Norway).
(vi) GDPR: The EU’s general personal information protection law, General Data Protection Regulation (Regulation EU 2016/679)
(vii) Adequacy decision: According to Paragraph 3 of Article 45 of GDPR, the European Commission decided that a third country, the territory of a third country, one or more areas or an international organization guarantees an adequate level of personal information protection.
III.
Supplementary rules
1.
Limitation to Out-of-Purpose Use and Provision of Personal Information (Articles 3, 15 and 18 of the Act)
(Act No. 16930, partially amended on February 4, 2020)>
Article 3 (Principles for Protecting Personal Information)
(1) The personal information controller shall specify explicitly the purposes for which personal information is processed; and shall collect personal information lawfully and fairly to the minimum extent necessary for such purposes.
(2) The personal information controller shall process personal information in an appropriate manner necessary for the purposes for which the personal information is processed, and shall not use it beyond such purposes.
Article 15 (Collection and Use of Personal Information)
(1) A personal information controller may collect personal information in any of the following circumstances, and use it with the scope of the purpose of collection:
1.
Where consent is obtained from a data subject;
2.
Where special provisions exist in laws or it is inevitable to observe legal obligations;
3.
Where it is inevitable for a public institution’s performance of its duties under its jurisdiction as prescribed by statutes, etc.;
4.
Where it is inevitably necessary to execute and perform a contract with a data subject;
5.
Where it is deemed manifestly necessary for the protection of life, bodily or property interests of the data subject or third party from imminent danger where the data subject or his or her legal representative is not in a position to express intention, or prior consent cannot be obtained owing to unknown addresses, etc.;
6.
Where it is necessary to attain the justifiable interest of a personal information controller, which such interest is manifestly superior to the rights of the data subject. In such cases, processing shall be allowed only to the extent the processing is substantially related to the justifiable interest of the personal information controller and does not go beyond a reasonable scope.
Article 18 (Limitation to Out-of-Purpose Use and Provision of Personal Information)
(1) A personal information controller shall not use personal information beyond the scope provided for in Articles 15 (1) and 39-3 (1) and (2), or provide it to any third party beyond the scope provided for in Article 17 (1) and (3).
Feedback