(1) No person shall circumvent the technological protection measures under subparagraph 28 (a) of Article 2 by intention or negligence without legitimate authority by removing, altering, or bypassing such measures; provided, this shall not apply to any of the following: <Amended on Feb. 4, 2020; May 18, 2021; Feb. 27, 2024>
1. Where a person engaged in research on encryption circumvents technological protection measures to the extent necessary to research flaws or vulnerability of encryption technologies applied to such works, etc. after legitimately obtaining the copy of the works, etc.; provided, this shall be limited to cases where he or she has made a considerable effort to obtain permission for the use necessary for such research from the holder of rights, but failed to do so;
2. Where he or she includes components or parts circumventing technological protection measures in technology, products, services, or devices in order to prevent minors from accessing online works, etc. harmful to minors; provided, this shall be limited to cases where no ban is imposed pursuant to paragraph (2);
3. Where it is necessary to identify functions of non-disclosure collecting and distributing personally identifiable information capable of verifying individuals' online activities and circumventing them; provided, this shall not apply where it affects other persons' access to works, etc.;
4. Where it is necessary for law enforcement, legitimate information collection, guarantee of security, etc. by the State;
5. Where it is necessary for schools, educational institutions, educational and training institutions, and class-supporting institutions under Article 25 (3) and (4), libraries under Article 31 (1) (limited to non-profit libraries), or records management institutions under the Public Records Management Act to determine whether to purchase works, etc.; provided, this shall be limited to cases where any access thereto is impossible without circumventing technological protection measures;
6. Where a person who uses programs with legitimate authority engages in decompilating program codes to the extent necessary to secure compatibility with other programs;
7. Where it is necessary for a person who has legitimate authority to inspect, investigate, or correct the security of computers or information and communications networks;
8. Cases determined and publicly notified by the Minister of Culture, Sports and Tourism according to the procedures prescribed by Presidential Decree as it is deemed that the legitimate use of works, etc. of specific types is unreasonably affected or likely to be affected by the prohibition of circumventing technological protection measures. In such cases, the effect of such exception shall be valid for three years.
(2) No person may manufacture, import, distribute, interactively transmit, sell or rent, offer to the general public for subscription, advertise to sell or rent, store or possess to distribute the following devices, products or parts, or provide the relevant services, without legitimate authority:
1. Those publicized, advertised or promoted for the purpose of circumventing technological protection measures;
2. Those having limited business purposes or uses other than circumventing technological protection measures;
3. Those designed, produced or remodeled, or performed for the main purpose of making circumventing technological protection measures possible or easy.
(3) Notwithstanding the provisions of paragraph (2), the aforementioned shall not apply in either of the following cases:
1. Cases falling under paragraph (1) 1, 2, 4, 6 and 7 in relation to technological protection measures under subparagraph 28 (a) of Article 2;
2. Cases falling under paragraph (1) 4 and 6 in relation to technological protection measures under subparagraph 28 (b) of Article 2.[This Article Added on Jun. 30, 2011]