(1) An identity verification agency shall not create, provide, use, compare, link irreversibly encrypted form of any user's resident registration number (hereinafter referred to as "connecting information") or perform other similar acts (hereinafter referred to as "processing") for the purpose of interlinking the services of a provider of information and communication services, except in cases falling under any of the following subparagraphs: <Amended on Oct. 1, 2025>
1. Where providing services to safely identify and authenticate users using information entered by the users;
2. Where administrative agencies and public institutions (hereinafter referred to as "administrative agencies, etc.") holding uniquely identifiable information under Article 24 of the Personal Information Protection Act (hereinafter in this Article referred to as "uniquely identifiable information") utilize connecting information to provide electronic government service defined in subparagraph 5 of Article 2 of the Electronic Government Act, in any of the following cases:(a) Where the head of a central agency responsible for administrative affairs under subparagraph 4 of Article 2 of the Electronic Government Act requests for the creation and processing of connecting information in order to provide integral support to administrative agencies, etc. for the identification of users;(b) Where an administrative agency, etc. inevitably requests the creation and processing of connecting information without obtaining the user's consent within the scope of the purpose of processing uniquely identifiable information;
3. Where a person holding uniquely identifiable information requests the creation and processing of connecting information of a data subject who has requested the transmission of personal information in order to fulfill the obligation to transmit personal information pursuant to Article 35-2 of the Personal Information Protection Act;
4. Where the processing of resident registration numbers is permitted under the subparagraphs of Article 24-2 (1) of the Personal Information Protection Act, and the identity verification agency and the relevant provider of information and communications services together have obtained approval from the Korea Media and Communications Commission for providing information and communication services prescribed by the Presidential Decree for which it is inevitable to create and process connecting information without obtaining the consent of the user.
(2) Where the Korea Media and Communications Commission intends to approve the creation and processing of connecting information under paragraph (1) 4, the Commission shall comprehensively examine the following matters: <Amended on Oct. 1, 2025>
1. Appropriateness and innovativeness of the realization of services to be provided:
2. Adequacy of procedures for creating and processing connecting information;
3. Plans for physical, technical, and administrative measures to ensure safety in creating and processing connecting information;
4. Adequacy of measures to protect the rights of users:
5. Impacts and effects on relevant markets and user benefits:(3) The Korea Media and Communications Commission may revoke approval for the creation and processing of connecting information under paragraph (1) 4 in any of the following; provided, in the case of subparagraph 1, the approval shall be revoked: <Amended on Oct. 1, 2025>
1. Where they have obtained approval for the creation and processing of connecting information under paragraph (1) 4 by fraud or in any other improper means;
2. Where they fail to comply with the matters examined under each subparagraph of paragraph (2);
3. Where they violate the obligation to take physical, technical, or administrative measures under Article 23-6 (1);
4. Where they violate a statute or regulation related to the protection of personal information and the reason for such violation is material.
(4) A person who is provided with connecting information from an identity verification agency (hereinafter referred to as a "entity using connecting information") for the services under the subparagraphs of paragraph (1) may process the connecting information within the scope of purposes for which the person has been provided; provided, if the data subject separately consents, the connecting information may be processed within the scope of the consented purpose.
(5) Matters necessary for approval procedures for creating and processing connecting information under paragraphs (1) through (4), detailed examination criteria for each approval, criteria for revoking approval, and other matters shall be prescribed by Presidential Decree.[This Article Added on Jan. 23, 2024]