(1) Where a data subject refuses to make an automated decision pursuant to Article 44-2 (1), a personal information controller shall take any of the following measures and notify the data subject of the results thereof, unless there is a compelling reason not to do so:
1. Measures not to apply automated decisions;
2. Reprocessing by personal intervention.
(2) Where a data subject requests an explanation under Article 44-2 (2) for an automated decision pursuant to Article 44-2 (2), the personal information controller shall provide the data subject with a concise and meaningful explanation, including the following matters, unless there is good cause; provided, where the relevant automated determination does not significantly affect the rights or obligations of the data subject, the personal information controller may notify the data subject of the matters referred to in Article 44-4 (1) 2 and 3:
1. The result of the relevant automated decision;
2. The types of major personal information used for the relevant automated decision;
3. Major criteria for automated decisions, such as the impact of the types of personal information under subparagraph 2 on automated decisions;
4. Procedures in which automated decisions are made, such as the process of major personal information used for the relevant automated decisions.
(3) Where a data subject requests a review under Article 44-2 (2) 2 pursuant to Article 44-2 (2), a personal information controller shall review whether the opinions submitted by the data subject are reflected and notify the data subject of whether the opinions are reflected and the results of reflection, unless there is a compelling reason not to do so.
(4) Where a personal information controller refuses a request for refusal or explanation, etc. pursuant to Article 38 (5) of the Act due to justifiable grounds, such as likelihood of unfairly infringing on the life, body, property, and other interests of other persons, the personal information controller shall notify the data subject of the grounds therefor in writing, etc. without delay.
(5) Where a personal information controller takes measures in accordance with a request for refusal or explanation by a data subject pursuant to paragraphs (1) through (3), he or she shall take such measures in writing, etc. within 30 days from the date he or she receives a request for refusal or explanation by the data subject; provided, where there exist any justifiable grounds that make it impracticable to process within 30 days, the personal information controller may extend the period by up to 30 days only twice after notifying the data subject of the grounds therefor.
(6) Detailed matters concerning measures taken in response to a request for refusal or explanation by a data subject under paragraphs (1) through (5) shall be determined and publicly notified by the Protection Commission.[This Article Added on Mar. 12, 2024]