(1) Article 30 shall apply mutatis mutandis to measures to ensure the safety of personally identifiable information under Article 24 (3) of the Act. In such cases, "Article 29 of the Act" shall be construed as "Article 24 (3) of the Act"; and "personal information" as "personally identifiable information", respectively. <Amended on Aug. 4, 2020; Sep. 12, 2023>
(2) "Personal information controller" who meets the standards prescribed by Presidential Decree in Article 24 (4) of the Act means any of the following personal information controllers: <Amended on Mar. 12, 2024>
1. A public institution that processes personally identifiable information of at least 10,000 data subjects;
2. A public institution which the Protection Commission deems it necessary to conduct an investigation under Article 24 (4) of the Act in consideration of the history of violations of the Act, the details and degree of violation, the risk of processing personally identifiable information, etc.;
3. A person, other than a public institution, who processes personally identifiable information on at least 50,000 data subjects.
(3) The Protection Commission shall investigate whether a personal information controller falling under any subparagraph of paragraph (2) has taken measures necessary to ensure safety pursuant to Article 24 (4) of the Act at least once every three years. <Amended on Jul. 26, 2017; Aug. 4, 2020; Mar. 12, 2024>
(4) Inspection of measures to ensure the safety of personally identifiable information has been conducted in any of the following cases, an investigation under paragraph (3) shall be deemed to have been conducted. <Added on Mar. 12, 2024>
1. Where the evaluation of the level of personal information protection has been conducted pursuant to Article 11-2 of the Act;
2. Where personal information protection is certified pursuant to Article 32-2 of the Act;
3. Where a regular inspection is conducted on whether measures to ensure the safety of personally identifiable information have been implemented under other Acts, such as a regular evaluation of the status of utilization and management of personal credit information under Article 45-5 of the Credit Information Use and Protection Act, and where the Protection Commission deems that the relevant inspection is equivalent to an investigation under paragraph (3) at the request of the head of the relevant central administrative agency.
(5) The investigation under paragraph (3) shall be conducted by requiring a personal information controller falling under any subparagraph of paragraph (2) to submit necessary materials online or in writing. <Amended on Mar. 12, 2024>
(6) "Specialized Institution prescribed by Presidential Decree” in Article 24 (5) of the Act means any of the following institutions: <Amended on Jul. 26, 2017; Aug. 4, 2020; Mar. 12, 2024>
1. The Korea Internet and Security Agency established under Article 52 of the Act on Promotion of Information and Communications Network Utilization and Information Protection. (hereinafter referred to as the "Korea Internet and Security Agency");
2. A corporation, organization, or institution determined and publicly notified by the Protection Commission as deemed to have technical and financial capacity and equipment to conduct the inspection pursuant to Article 24 (4) of the Act.[This Article Wholly Amended on Sep. 29, 2016]