(1) If a decision (excluding an automatic disposition by an administrative authority under Article 20 of the Framework Act on Administration; hereafter in this Article referred to as "automated decision") made by processing personal information with a completely automated system (including a system to which artificial intelligence technologies are applied) has a significant effect on his or her right or duty, a data subject shall have the right to file with the relevant personal information controller an objection against the relevant decision; provided, this shall not apply to cases where automated decisions are made pursuant to Article 15 (1) 1, 2, and 4.
(2) A data subject may, if the personal information controller has made an automated decision, request explanation, etc. thereof.
(3) Where a data subject refuses to accept an automated decision or requests a personal information controller to provide explanations, etc. thereof pursuant to paragraph (1) or (2), the personal information controller shall not apply the automated decision unless there is a compelling reason not to do so, or shall take necessary measures, such as re-processing through human involvement and providing explanations.
(4) A personal information controller shall disclose the criteria and procedures for making automated decisions and the methods, etc. of processing personal information so that data subjects can easily confirm them.
(5) Except as provided in paragraphs (1) through (4), matters necessary for the procedures and methods for refusing to accept automated decisions, requesting explanations, etc. thereof, necessary measures in response to refusal, a request for explanations, etc., the criteria and procedures for making automated decisions, the disclosure of the method in which personal information is processed, etc. shall be prescribed by Presidential Decree.[This Article Added on Mar. 14, 2023]