(1) If a person who has filed an application for designation pursuant to Article 42-10 (1) is deemed to meet the detailed criteria for designation under Article 42-11, the designating authority may designate such person as an institution specializing in managing personal information. In such cases, if a person who has filed an application for designation pursuant to Article 42-10 (1) fails to meet some of the detailed criteria for designation, the designating authority may grant the designation on the condition that he or she shall meet such criteria within a specified period and verify whether such conditions are fulfilled after designation.
(2) If an institution specializing in managing personal information intends to change any of the following matters (excluding minor matters determined and publicly notified by the Protection Commission), it shall obtain prior approval from the designating authority:
1. A business plan (including adding or changing the information to be transmitted);
2. A personal information management plan;(3) The effective period of the designation of an institution specializing in managing personal information shall be 3 years.
(4) If an institution specializing in managing personal information applies for an extension of the effective period of designation under paragraph (3), the designating authority may re-designate it as an institution specializing in managing personal information if it deems that the institution meets the detailed criteria for designation under Article 42-11.
(5) When a designating authority (excluding the Protection Commission) intends to make the following decisions, it shall have a prior consultation with the Protection Commission:
1. Designation under paragraph (1) and re-designation under paragraph (4) (limited to specialized relay agencies);
2. Approval for modification under paragraph (2) (in cases of a general specialized agency or special specialized agency, limited to cases related to information subject to request for transmission).
(6) If a designating authority (excluding the Protection Commission in cases falling under subparagraph 1) grants designation under paragraph (1), approval for modification under paragraph (2), or re-designation under paragraph (4), it shall take the following measures:
1. Notification to the Protection Commission;
2. Public announcement in the Official Gazette or posting it on the website of the designating authority (excluding approval for modification).
(7) If a specialized relay agency intends to suspend or discontinue part or all of its relay services, it shall notify the designating authority thereof not later than 6 months prior to the scheduled date of suspension or discontinuance. In such cases, the designating authority may order the relevant specialized relay agency to take any of the following measures:
1. Destruction of personal information held by the relevant specialized relay agency (excluding cases where it is required to preserve personal information pursuant to other statutes or regulations);
2. Transfer of services being performed to another specialized relay agency;
3. Notifying any of the following persons of the planned suspension or discontinuation of services:a. Data subjects of personal information held by the relevant specialized relay agency;b. An information transmitter who transmits information to the relevant specialized relay agency;c. A general specialized agency, a special specialized agency, or a general recipient to which information is transmitted by the relevant specialized relay agency.
(8) If a general specialized institution or special specialized institution intends to suspend or discontinue part or all of its services related to the transmission of personal information, it shall provide prior notification of such fact to a specialized relay institution and register it on the personal information transmission support platform.[This Article Added on Feb. 25, 2025]