(1) In order to manage and supervise the current status of information transmitters pursuant to Article 35-4 (1) of the Act, the Protection Commission may request personal information controllers to submit data necessary for verifying whether they are information transmitters.
(2) The Protection Commission may request an information transmitter, an institution specializing in managing personal information, or a general recipient to submit data according to the following classifications in order to manage and supervise matters regarding whether an information transmitter complies with data subject access requests and third-party transmission requests, whether an institution specializing in managing personal information meets the requirements for designation, or whether a general recipient meets the facilities and technical standards, and the person requested to submit data shall comply with such request unless there is a compelling reason not to do so:
1. An information transmitter: Data on the details of transmission of personal information under Article 42-6 (9);
2. An institution specializing in managing personal information: the following data:a. Data referred to in subparagraph 1;b. Data on the processing and management of personal information;c. Data on the method of requesting transmission (limited to general specialized agencies and special specialized agencies);d. Data proving that it meets the requirements for designation of an institution specializing in managing personal information;
3. A general recipient: Any of the following data:a. Data referred to in subparagraphs 1 and 2 (b);b. Data on the method of requesting transmission;c. Data proving that facilities and technologies under Article 42-3 (1) are in place.[This Article Added on Feb. 25, 2025]