Communications Service Provider, etc.; provided, however, that, if the business owner or representative shall become the Privacy Officer, the provision regarding report of corrective measures shall not apply. ※ (STANDARD ON TECHNOLOGICAL AND MANAGERIAL MEASURES OF PERSONAL INFORMATION PROTECTION) Korea Communications Commission established minimum standard to prevent the loss, theft, leakage, forgery, alteration of, or damage to, the personal information and to ensure the safety of personal information by Notification, accordingly the Information and Communications Service Providers shall establish and implement their own safeguards, considering the size of their businesses and the number of personal information they process 34. Do you use risk The Accountability Agent Article 47-3 (Certification of Personal Information Article 32-2 (Certification of Personal Data assessments or must verify that such risk Management System) (1) The Korea Protection) (1) The Minister of the Interior third-party assessments or Communications Commission may certify for the may certify whether the data processing and certifications? certifications are purpose of carrying out systemic and sustainable other personal data protection related action Describe below. undertaken at appropriate personal information protection activities in the of the Personal Data Controller abide by this intervals, and that the communications network whether the person who Act, etc. Applicant adjusts their has established and operated a consolidated (2) The certification pursuant to paragraph security safeguards to management system including the managerial, (1) shall be effective for three years. reflect the results of these technical and physical safeguards (hereinafter (3) The Minister of the Interior may certifications or risk referred to as the “Personal Information withdraw the certification pursuant to assessments. One Management System” or PIMS) could satisfy the paragraph (1) as stipulated by presidential example is whether privacy criteria subject to paragraph (2). decree if any of the following subparagraphs
Communications Service Provider, etc.; provided, however, that, if the business owner or representative shall become the Privacy Officer, the provision regarding report of corrective measures shall not apply. ※ (STANDARD ON TECHNOLOGICAL AND MANAGERIAL MEASURES OF PERSONAL INFORMATION PROTECTION) Korea Communications Commission established minimum standard to prevent the loss, theft, leakage, forgery, alteration of, or damage to, the personal information and to ensure the safety of personal information by Notification, accordingly the Information and Communications Service Providers shall establish and implement their own safeguards, considering the size of their businesses and the number of personal information they process 34. Do you use risk assessments or third-party certifications? Describe below. The Accountability Agent must verify that such risk assessments or certifications are undertaken at appropriate intervals, and that the Applicant adjusts their security safeguards to reflect the results of these certifications or risk assessments. One example is whether privacy Article 47-3 (Certification of Personal Information Management System) (1) The Korea Communications Commission may certify for the purpose of carrying out systemic and sustainable personal information protection activities in the communications network whether the person who has established and operated a consolidated management system including the managerial, technical and physical safeguards (hereinafter referred to as the “Personal Information Management System” or PIMS) could satisfy the criteria subject to paragraph (2). Article 32-2 (Certification of Personal Data Protection) (1) The Minister of the Interior may certify whether the data processing and other personal data protection related action of the Personal Data Controller abide by this Act, etc. (2) The certification pursuant to paragraph (1) shall be effective for three years. (3) The Minister of the Interior may withdraw the certification pursuant to paragraph (1) as stipulated by presidential decree if any of the following subparagraphs