(1) A personal information controller shall disclose the following matters on its website, etc. so that data subjects can easily identify the following matters pursuant to Article 37-2 (4) of the Act; provided, where the personal information controller does not operate the website, etc. or it is not necessary to continuously inform the data subjects, the personal information controller may inform the data subjects in advance by means of written documents, etc.
1. The fact that an automated decision is made and the purpose and scope of the data subject to be subject to such decision;
2. Types of major personal information used for automated decisions and relationship between automated decisions;
3. Considerations in automated decision-making process and procedures for processing major personal information;
4. Where sensitive information is processed in the process of automated decision-making or personal information of a child under 14 years of age, the purpose of such processing and specific details of personal information to be processed;
5. The fact that the data subject may make a request for refusal, explanation, etc. of an automated decision and the method and procedure therefor.
(2) When a personal information controller discloses the matters referred to in the subparagraphs of paragraph (1), he or she shall use standardized and systematic terms so that data subjects can easily understand the relevant details, and may utilize visual methods, such as video, pictures, drawings, etc., so that data subjects can easily understand such details.[This Article Added on Mar. 12, 2024]