(1) Pursuant to Article 29 of the Act, a public institution that operates a personal information processing system that meets the standards publicly notified by the Protection Commission (hereinafter referred to as "public system operating institution"), such as the scale of personal information processing and the number of persons handling personal information with access authority, shall additionally take the following measures in addition to measures to ensure safety under Article 30 of this Decree: <Amended on Mar. 12, 2024>
1. Including measures to ensure safety prepared for each public system in an internal management plan under Article 30 (1) 1;
2. Measures necessary to safely manage access authority, such as allowing an institution that accesses a public system to process personal information (hereafter in this Article referred to as "institution using public systems") to grant access authority to a personal information handler with legitimate authority and to change and cancel such authority;
3. Measures such as storage, analysis, inspection, and management of the records of access to public systems to prevent illegal access to personal information and personal information breach incidents.
(2) Where an institution operating public systems or an institution using public systems finds out access to personal information without authority or beyond authorized access thereto, it shall without delay notify data subjects of the relevant fact and matters necessary for the prevention of any damage, etc.; in such cases, notification shall be deemed given in any of the following cases:
1. Where data subjects are notified of loss, theft, or divulgence of personal information under Article 34 (1) of the Act;
2. Where data subjects are notified of access to their personal information and matters necessary for the prevention of any damage, etc. pursuant to other statutes or regulations.
(3) An institution operating public systems (where there is a separate public institution that develops and distributes a public system, such public institution shall be included; hereafter in this Article, the same shall apply) shall designate and operate a department dedicated to work related to the safe management of personal information or shall assign personnel dedicated to such work, taking into account the size and characteristics of the relevant public system, the number of institutions using the relevant public system, and other relevant factors.
(4) An institution operating public systems shall designate the head of a department responsible for the general management of the relevant public system as a manager for each public system; provided, where there is no such department, it shall designate a manager from among the heads of relevant departments in consideration of work-relatedness, work capabilities, and other relevant factors.
(5) An institution operating public systems shall establish and operate a public system operation council comprised of the following institutions for each public system to consult on matters related to examining the implementation of measures to ensure the safety of public systems and improving such systems; provided, where one public institution operates at least two public systems, an integrated public system operation council may be established and operated:
1. The institution operating public systems;
2. Where the operation of public systems is entrusted, the person entrusted;
3. An institution using public systems deemed necessary by the institution operating public systems.
(6) The Protection Commission may provide institutions operating public systems with support necessary to implement measures to ensure the safety of personal information.
(7) Except as provided in paragraphs (1) through (6), matters necessary for the measures to ensure the safety of personal information taken by institutions operating public systems, etc. shall be determined and publicly notified by the Protection Commission.[This Article Added on Sep. 12, 2023]