29. Describe how The Accountability Agent Article 28 (Data Protection Measures) (1) In case Article 28 (Supervision of the Personal Data you make your must verify that the of processing the personal information of Users, Manager) (1) The Personal Data Controller employees aware Applicant's employees are the Information and Communications Service shall see to it that the persons in charge of of the importance aware of the importance Provider, etc. shall take such technological and processing personal data, including of maintaining the of, and obligations managerial measures as mentioned in the employees, dispatched workers, part-timers, security of personal respecting, maintaining the following subparagraphs to prevent the loss, theft, etc. are appropriately controlled and information (e.g. security of personal leakage, forgery, alteration of, or damage to, the supervised by a designated manager through regular information through personal information and to ensure the safety of (hereinafter the "Personal Data Manager") in training and regular training and personal information by the standard as specified order to ensure that personal data is oversight). oversight as demonstrated by the Presidential Decree. properly managed. by procedures, which may 1. To establish and implement the in-house (2) The Personal Data Controller shall include: management plan to process the personal provide an appropriate educational program information more safely; ∙ to the Personal Data Manager on a regular Training program for (2) The Information and Communications Service basis to ensure appropriate handling thereof. employees Provider, etc. shall limit the persons to process the ∙ Regular staff meetings or personal information of Users to the minimum. other communications ∙ ENFORCEMENT DECREE Security policy signed by Article 15 (Protection Measures for Personal employees Information) (1) Pursuant to Article 28 (1) 1 of the ∙ Other (specify) Act, a Information and Communications Service Provider shall festablish and implement the Where the Applicant management plan, including the following answers that it does not matters, in order to ensure safety in processing make employees aware of personal information: the importance of, and 1. The formation and operation of an organization obligations respecting, for the protection of personal information, maintaining the security of
29. Describe how you make your employees aware of the importance of maintaining the security of personal information (e.g. through regular training and oversight). The Accountability Agent must verify that the Applicant's employees are aware of the importance of, and obligations respecting, maintaining the security of personal information through regular training and oversight as demonstrated by procedures, which may include: ∙ Training program for employees ∙ Regular staff meetings or other communications ∙ Security policy signed by employees ∙ Other (specify) Where the Applicant answers that it does not make employees aware of the importance of, and obligations respecting, maintaining the security of Article 28 (Data Protection Measures) (1) In case of processing the personal information of Users, the Information and Communications Service Provider, etc. shall take such technological and managerial measures as mentioned in the following subparagraphs to prevent the loss, theft, leakage, forgery, alteration of, or damage to, the personal information and to ensure the safety of personal information by the standard as specified by the Presidential Decree. 1. To establish and implement the in-house management plan to process the personal information more safely; (2) The Information and Communications Service Provider, etc. shall limit the persons to process the personal information of Users to the minimum. ENFORCEMENT DECREE Article 15 (Protection Measures for Personal Information) (1) Pursuant to Article 28 (1) 1 of the Act, a Information and Communications Service Provider shall festablish and implement the management plan, including the following matters, in order to ensure safety in processing personal information: 1. The formation and operation of an organization for the protection of personal information, Article 28 (Supervision of the Personal Data Manager) (1) The Personal Data Controller shall see to it that the persons in charge of processing personal data, including employees, dispatched workers, part-timers, etc. are appropriately controlled and supervised by a designated manager (hereinafter the "Personal Data Manager") in order to ensure that personal data is properly managed. (2) The Personal Data Controller shall provide an appropriate educational program to the Personal Data Manager on a regular basis to ensure appropriate handling thereof.