(1) Upon receipt of a request for access under Article 41 (1), correction or erasure of personal information under Article 43 (1), transmission under Article 35-2 of the Act, suspension of processing of personal information or withdrawal of consent under Article 37 (1) of the Act (hereafter in this Article and Articles 47 and 48 referred to as "request for access, etc."), a personal information controller shall confirm whether the person who has submitted the request for access, etc. is the principal or the duly authorized representative. <Amended on Aug. 4, 2020; Sep. 12, 2023; Feb. 25, 2025>
(2) Any personal information controller, which is a public institution eligible for the administrative data matching pursuant to Article 36 (1) of the Electronic Government Act, shall confirm as provided in paragraph (1) through administrative data matching; provided, this shall not apply where the public institution is unable to use administrative data matching or the data subject does not consent to such confirmation.
(3) In relation to a request for transmission of personal information under Article 35-2 of the Act, the Protection Commission and the head of a relevant central administrative agency may request the relevant agencies for electronic data on resident registration information under Article 30 (1) of the Resident Registration Act and computerized registration data under Article 11 (6) of the Act on Registration of Family Relations in order to assist the personal information controller under paragraph (1) in ascertaining whether the request is made by the data subject or his or her representative. <Added on Feb. 25, 2025>