to ensure Accountability Agent must Service Provider, etc. shall designate the out the tasks enumerated in the following individuals receive verify that the Applicant Privacy Officer to protect the personal subparagraphs: a timely response has procedures in place to information of Users and deal with 3. Handling of complaints and to their ensure individuals receive a complaints of Users related with the compensation for damages incurred in complaints? timely response to their personal information; provided, however, relation to the processing of personal data; complaints. that the same may not apply to the Information and Communications Service Where the Applicant Provider, etc. who satisfies the number of Article 30 (Establishment and Disclosure of answers NO, the employees and Users, and other criteria Privacy Policy) (1) The Personal Data Accountability Agent must specified by the Presidential Decree. Controller shall establish a personal data inform the Applicant that processing policy including the particulars in (4) When the person in charge of data implementation of such the following subparagraphs (hereinafter protection finds out any fact in violation of procedures is required for the "Privacy Policy"). In such case, the this Act and other relevant laws and compliance with this public institutions shall set up the Privacy regulations, he/she shall immediately take principle. Policy regarding the personal data files measures to correct such violations, and, if subject to be registered pursuant to Article necessary, report such measures to the 32: business owner or representative of the information and communications service 6. Other matters in relation to personal provider, etc.; provided, however, that, if data processing as stipulated by presidential the business owner or representative shall decree. become the person in charge of data protection, the provision regarding report of corrective measures shall not apply. Article 39 (Liability for Damages) (1) A Data Subject, suffering damages caused by a violation of this Act of Personal Data Article 27-2 (Disclosure of Privacy Policy) Controller, may claim damages against the (2) The Privacy Policy subject to paragraph Personal Data Controller. In such case, the (1) shall contain each and all following said Personal Data Controller may not be subparagraphs: released from the liability for damages if he/she fails to prove non-existence of its 7. The name of a Privacy Officer, or the wrongful intent or negligence. department to protect the personal information of Users and deal with
to ensure individuals receive a timely response to their complaints? Accountability Agent must verify that the Applicant has procedures in place to ensure individuals receive a timely response to their complaints. Where the Applicant answers NO, the Accountability Agent must inform the Applicant that implementation of such procedures is required for compliance with this principle. Service Provider, etc. shall designate the Privacy Officer to protect the personal information of Users and deal with complaints of Users related with the personal information; provided, however, that the same may not apply to the Information and Communications Service Provider, etc. who satisfies the number of employees and Users, and other criteria specified by the Presidential Decree. (4) When the person in charge of data protection finds out any fact in violation of this Act and other relevant laws and regulations, he/she shall immediately take measures to correct such violations, and, if necessary, report such measures to the business owner or representative of the information and communications service provider, etc.; provided, however, that, if the business owner or representative shall become the person in charge of data protection, the provision regarding report of corrective measures shall not apply. Article 27-2 (Disclosure of Privacy Policy) (2) The Privacy Policy subject to paragraph (1) shall contain each and all following subparagraphs: 7. The name of a Privacy Officer, or the department to protect the personal information of Users and deal with out the tasks enumerated in the following subparagraphs: 3. Handling of complaints and compensation for damages incurred in relation to the processing of personal data; Article 30 (Establishment and Disclosure of Privacy Policy) (1) The Personal Data Controller shall establish a personal data processing policy including the particulars in the following subparagraphs (hereinafter the "Privacy Policy"). In such case, the public institutions shall set up the Privacy Policy regarding the personal data files subject to be registered pursuant to Article 32: 6. Other matters in relation to personal data processing as stipulated by presidential decree. Article 39 (Liability for Damages) (1) A Data Subject, suffering damages caused by a violation of this Act of Personal Data Controller, may claim damages against the Personal Data Controller. In such case, the said Personal Data Controller may not be released from the liability for damages if he/she fails to prove non-existence of its wrongful intent or negligence.