ENFORCEMENT DECREE (2) Pursuant to Article 27-2 (3) of the Act, reasons Article 31 (Establishment and Disclosure of why a Privacy Policy is revised and the details of Privacy Policy) (1) “Other matters as stated such revision shall be publicly notified by at least in the Presidential Decree” in Article 30(1)vi one of the following methods: shall mean the matters of following 1. Posting public notice on a space for public notice subparagraphs: in the first page of the web-site operated by the 1. Items of personal information to be Information and Communications Service Providers processed; or on a separate page; 2. Matters in relation to destruction of 2. Giving notice to Users by writing, facsimile, personal information; and or any similar means; 3. Matters in relation to safety measures 3. Posting or keeping public notice at a place where of personal information subject to Article 30. such notice is easily noticeable in a shop or office. (2) The Personal Data Controller shall post continuously the Privacy Policy established ENFORCEMENT DECREE or modified pursuant to Article 30(2) of the Article 12 (Methods for Obtaining Consent) (1) Act on its website. Pursuant to Article 26-2 of the Act, a Information (3) If it is not possible to post on the website and Communications Service Provider shall obtain pursuant to paragraph (2), the Personal Data consent by any of the following methods: In such Controller shall make public the Privacy cases, a Information and Communications Service Policy established or modified in a way of Provider shall state matters for which he/she shall more than one of the following obtain consent (hereinafter referred to as “matters subparagraphs: subject to consent”) so that Users can clearly recognize and check such matters: 1. Posting at easily noticeable places of the Personal Data Controller’s , etc.; 1. Publishing matters subject to consent in his/her 2. Publishing at the Official Gazette (only web-site and requesting each User to express in case the Personal Data Controller is the whether he/she consents thereto; public institution), or general daily 2. Delivering a document containing matters newspaper, weekly newsmagazine or subject to consent to each User in person or by Internet media subject to Articles 2 i a. and
(2) Pursuant to Article 27-2 (3) of the Act, reasons why a Privacy Policy is revised and the details of such revision shall be publicly notified by at least one of the following methods: 1. Posting public notice on a space for public notice in the first page of the web-site operated by the Information and Communications Service Providers or on a separate page; 2. Giving notice to Users by writing, facsimile, or any similar means; 3. Posting or keeping public notice at a place where such notice is easily noticeable in a shop or office. ENFORCEMENT DECREE Article 12 (Methods for Obtaining Consent) (1) Pursuant to Article 26-2 of the Act, a Information and Communications Service Provider shall obtain consent by any of the following methods: In such cases, a Information and Communications Service Provider shall state matters for which he/she shall obtain consent (hereinafter referred to as “matters subject to consent”) so that Users can clearly recognize and check such matters: 1. Publishing matters subject to consent in his/her web-site and requesting each User to express whether he/she consents thereto; 2. Delivering a document containing matters subject to consent to each User in person or by ENFORCEMENT DECREE Article 31 (Establishment and Disclosure of Privacy Policy) (1) “Other matters as stated in the Presidential Decree” in Article 30(1)vi shall mean the matters of following subparagraphs: 1. Items of personal information to be processed; 2. Matters in relation to destruction of personal information; and 3. Matters in relation to safety measures of personal information subject to Article 30. (2) The Personal Data Controller shall post continuously the Privacy Policy established or modified pursuant to Article 30(2) of the Act on its website. (3) If it is not possible to post on the website pursuant to paragraph (2), the Personal Data Controller shall make public the Privacy Policy established or modified in a way of more than one of the following subparagraphs: 1. Posting at easily noticeable places of the Personal Data Controller’s , etc.; 2. Publishing at the Official Gazette (only in case the Personal Data Controller is the public institution), or general daily newspaper, weekly newsmagazine or Internet media subject to Articles 2 i a. and