(1) "Institutions prescribed by Presidential Decree" in Article 11-2 (1) of the Act means the following institutions:
1. A public institution defined in Article 4 of the Act on the Management of Public Institutions;
2. Public corporations and public agencies under the Local Public Enterprises Act;
3. Other public institutions referred to in subparagraphs 4 and 5 of Article 2, which meet the standards publicly notified by the Protection Commission in consideration of the characteristics of personal information processing business of the public institutions.
(2) The standards for the evaluation of the level of personal information protection under Article 11-2 (1) of the Act (hereinafter referred to as "evaluation of the level of personal information protection") shall be as follows:
1. Personal information protection policies and performance records and degree of improvement;
2. Appropriateness of personal information management system;
3. Measures taken to guarantee rights of data subjects and degree of implementation;
4. Measures to prevent infringement of personal information and degree of implementation of measures to ensure safety;
5. Compliance with other measures necessary for the processing and safe management of personal information.
(3) Before conducting evaluation of the level of personal information protection level, the Protection Commission shall prepare an evaluation plan including the subject matter, criteria, methods, indexes, etc. of evaluation and notify the head of an institution subject to evaluation of the level of personal information protection (hereinafter referred to as "institution subject to evaluation") of the evaluation of the level of personal information protection.
(4) In order to efficiently conduct the evaluation of the level of personal information protection, the Protection Commission may organize and operate an evaluation team, including experts with abundant expertise and experience in personal information protection.
(5) The Protection Commission may require the following materials to be submitted pursuant to Article 11-2 (2) of the Act:
1. Where an institution subject to evaluation conducts its own inspection of the level of personal information protection, the results thereof and evidential data;
2. Data necessary for verifying evidentiary materials under subparagraph 1;
3. Other data necessary to evaluate the level of personal information protection, such as whether personal information is safely managed.
(6) The Protection Commission may conduct an evaluation based on the data submitted by the head of an institution subject to evaluation pursuant to paragraph (5) or visit an institution subject to evaluation to conduct such evaluation.
(7) The Protection Commission may request the head of a central administrative agency or the head of a local government to provide support necessary for measures to protect personal information based on the preparation for evaluation or the results of evaluation by an institution subject to evaluation in the relevant field, such as an institution under its jurisdiction. In such cases, upon receipt of such request, the head of a central administrative agency or the head of a local government shall endeavor to provide support upon receipt of such request.
(8) Details of the evaluation of the level of personal information protection under paragraphs (1) through (7) shall be determined and publicly notified by the Protection Commission.[This Article Added on Mar. 12, 2024]