(1) The standards for the designation of an expert agency (hereinafter referred to as "Expert Data Combination Agency") pursuant to Article 28-3 (1) of the Act shall be as follows: <Amended on Feb. 25, 2025>
1. The agency shall have formed an organization responsible for the combination and release of pseudonymized information and employed at least three full-time personnel with qualifications or experience relating to personal information protection, as determined and publicly notified by the Protection Commission;
2. The agency shall have set up space, facilities and equipment necessary to combine pseudonymized information safely and prepared policies and procedures relating to the combination and release of pseudonymized information, as determined and publicly notified by the Protection Commission;
3. The agency shall have financial capabilities in compliance with the standards determined and publicly notified by the Protection Commission;
4. The relevant agency shall not have been subject to public announcement pursuant to Article 66 (1) of the Act nor been ordered to make a public announcement under Article 66 (2) within the last 3 years;
5. The agency shall not have failed to obtain re-designation after applying for an extension of the effective period under paragraph (4) and shall not have had its designation revoked pursuant to paragraph (5) within the last 1 year.
(2) Any corporation, organization, or institution intending to be designated as an Expert Data Combination Agency pursuant to Article 28-3 (1) of the Act shall submit to the head of the Protection Commission or the related central administrative agency an application for the Designation of Expert Data Combination Agency determined and publicly notified by the Protection Commission with the following documents attached (including electronic documents; the same shall apply hereinafter):
1. Articles of incorporation or bylaws;
2. Documents prescribed and notified by the Protection Commission supporting that the agency satisfies the designation standards under paragraph (1).
(3) The head of the Protection Commission or related central administrative agency may designate the corporation, organization, or institution which submitted the application for the Designation of Expert Data Combination Agency under paragraph (2) as an Expert Data Combination Agency if it satisfies the designation standards under paragraph (1).
(4) Designation as an Expert Data Combination Agency shall be effective for 3 years from the date of designation, and if the Expert Data Combination Agency requests extension of the effective period, the head of the Protection Commission or the relevant central administrative agency may re-designate it as an Expert Data Combination Agency after reviewing the following matters: <Amended on Feb. 25, 2025>
1. Whether it meets the standards for designation under paragraph (1);
2. Whether the future business performance plan is suitable for achieving the purpose of designation;
3. Whether it has properly performed its business affairs according to the purpose of designation;
4. Whether it has unduly restricted data combinations, such as by charging excessive fees under Article 29(3) 5.
(5) If the Expert Data Combination Agency falls under any of the following, the head of the Protection Commission or related central administrative agency may cancel the designation of the Expert Data Combination Agency; provided, in the cases of subparagraph 1 or 2, designation shall be canceled:
1. If the agency has received the designation by fraud or improper means;
2. If the agency voluntarily requests cancellation of its designation or discontinues its business;
3. If the agency becomes non-compliant with the standards for designation of an Expert Data Combination Agency under paragraph (1);
4. If a personal information breach incident, including divulgence of information, occurs in connection with data combination, release, etc.;
5. If the agency otherwise violates any obligation under the Act or this Decree.
(6) The head of the Protection Commission or related central administrative agency shall hold a hearing when seeking to cancel the designation of an Expert Data Combination Agency in accordance with paragraph (5).
(7) The head of the Protection Commission or related central administrative agency shall publicly announce any designation, re-designation or cancellation of designation of an Expert Data Combination Agency in the Official Gazette or the websites of the Protection Commission or related central administrative agency. In such cases, if the head of the related central administrative agency designated, re-designated, or canceled the designation of any Expert Data Combination Agency, the head of the central administrative agency shall notify the Protection Commission of the same.
(8) Except as provided in paragraphs (1) through (7), matters necessary in connection with the designation, re-designation and cancellation of designation of an Expert Data Combination Agency shall be determined and publicly notified by the Protection Commission.[This Article Added on Aug. 4, 2020]