safety of personal information by the methods stipulated by presidential decree, standard as specified by the Presidential such as inspecting of processing the Decree. personal data. 1. To establish and implement the (5) The entrustee shall not use personal management plan to process the data beyond the scope of the tasks personal information more safely; entrusted by the Personal Data Controller, 2. To install and operate the access nor provide such personal data to a third control system like firewall to block illegal party. access to the personal information; (6) When civil liability to pay compensation 3. To take measures to prevent the arises as an entrustee violates this Act in the forgery or falsification of logon files; course of processing personal data in 4. To take security measures using connection with the entrusted tasks, the encryption technologies in order to store entrustee shall be deemed as an employee and transmit the personal information more of the entrustor. safely; (7) Articles 15 through 25, 27 through 31, 33 5. To take such preventive measures as through 38 and 59 shall apply mutatis download and operation of the vaccination mutandis to the entrustee. softwares to protect from computer viruses; and 6. To take other protective measures Article 29 (Duty of Security Measures) The necessary to secure the safety of the Personal Data Controller shall take personal information. technical, managerial and physical measures (2) The Information and Communications such as establishment of internal Service Provider, etc. shall limit the persons management plan and preservation of to process the personal information of records, etc. necessary to ensure security Users to the minimum. as stipulated by presidential decree so as to prevent personal data from being lost, stolen, leaked, forged, fabricated or Article 27-3 (Notification and Report of damaged. Personal Information Leakage, etc.) (1) Upon knowing the loss, theft and leakage of personal information (hereinafter referred Article 34 (Personal Data Breach to as "leakage, etc."), the Information and
safety of personal information by the standard as specified by the Presidential Decree. 1. To establish and implement the management plan to process the personal information more safely; 2. To install and operate the access control system like firewall to block illegal access to the personal information; 3. To take measures to prevent the forgery or falsification of logon files; 4. To take security measures using encryption technologies in order to store and transmit the personal information more safely; 5. To take such preventive measures as download and operation of the vaccination softwares to protect from computer viruses; and 6. To take other protective measures necessary to secure the safety of the personal information. (2) The Information and Communications Service Provider, etc. shall limit the persons to process the personal information of Users to the minimum. Article 27-3 (Notification and Report of Personal Information Leakage, etc.) (1) Upon knowing the loss, theft and leakage of personal information (hereinafter referred to as "leakage, etc."), the Information and methods stipulated by presidential decree, such as inspecting of processing the personal data. (5) The entrustee shall not use personal data beyond the scope of the tasks entrusted by the Personal Data Controller, nor provide such personal data to a third party. (6) When civil liability to pay compensation arises as an entrustee violates this Act in the course of processing personal data in connection with the entrusted tasks, the entrustee shall be deemed as an employee of the entrustor. (7) Articles 15 through 25, 27 through 31, 33 through 38 and 59 shall apply mutatis mutandis to the entrustee. Article 29 (Duty of Security Measures) The Personal Data Controller shall take technical, managerial and physical measures such as establishment of internal management plan and preservation of records, etc. necessary to ensure security as stipulated by presidential decree so as to prevent personal data from being lost, stolen, leaked, forged, fabricated or damaged. Article 34 (Personal Data Breach