(1) Where the Protection Commission evaluates the Privacy Policy pursuant to Article 30-2 (1) of the Act, it shall select persons subject to evaluation by comprehensively considering the following matters: <Amended on Mar. 12, 2024>
1. Type of personal information controller and scale of sales (referring to income generated from profit-making business under Article 4 (3) 1 of the Corporate Tax Act, if sales are not calculated; hereafter referred to as "sales, etc." in Articles 32 and 48-7);
2. The type and scale of personal information processed, such as sensitive information and personally identifiable information;
3. The legal grounds and methods for personal information processing;
4. Whether any statute is violated;
5. The characteristics of data subjects, such as children and youth.
(2) Upon selecting those subject to the evaluation of the Privacy Policy pursuant to paragraph (1), the Protection Commission shall notify the relevant personal information controller of an evaluation plan including the details, time schedule, procedures, etc. of the evaluation no later than 10 days before the commencement of the evaluation.
(3) Where necessary to evaluate the Privacy Policy under Article 30-2 of the Act, the Protection Commission may request the relevant personal information controller to present its opinion.
(4) The Protection Commission shall evaluate the Privacy Policy pursuant to Article 30-2 of the Act and notify the relevant personal information controller of the results of such evaluation without delay.
(5) Except as provided in paragraphs (1) through (4), the detailed standards and procedures for selecting those subject to the evaluation of the Privacy Policy shall be determined and publicly notified by the Protection Commission.[This Article Added on Sep. 12, 2023]