Enforcement Decree of the Personal Information Protection Act — Article 15 (Control of out-of-purpose use of personal information or provision thereof to third parties)

Where a public institution uses personal information for other than the intended purpose, or provides it to a third party pursuant to Article 18 (2) of the Act, it shall record the following in the Register for Control of Out-of-Purpose Use or Provision of Personal Information in the form determined and publicly notified by the Protection Commission; and shall manage the Register: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Aug. 4, 2020>

1. The name of the personal information or personal information file to be used or provided;

2. The name of the institution that uses, or is provided with, personal information;

3. The purpose of use or provision;

4. The statutory ground for such use or provision;

5. Particulars of personal information to be used or provided;

6. The date, frequency, or period for using or providing personal information;

7. Methods of use or provision of personal information;

8. Any limitation or necessary measure that the personal information controller has requested from the recipient pursuant to Article 18 (5) of the Act.