Chapter  III Information Collection, Processing and Use by a Non-government Agency

Article 19
Except the information stated in Paragraph 1 of Article 6, the non-government agency should not collect or process personal information unless there is a specific purpose and should comply with one of the following conditions:
1. it is in accordance with law;
2. there is a contractual or quasi-contractual relationship between the Parties, and proper security measures have been adopted;
3. the Party has disclosed such information by himself or when the information has been publicized legally;
4. it is necessary for public interests on statistics or the purpose of academic research conducted by a research institution. The information may not lead to the identification of a certain person after its processing by the provider, or from the disclosure by the collector;
5. consent has been given by the Party;
6. it is necessary to promote public interests;
7. the personal information is obtained from publicly available resources. However, it is exempted if the information is limited by the Party on the processing or use and the interests of the Party should be protected;
8. the rights and interests of the Party are not harmed.
By the time when the collector or processor realizes or has been notified of the provision in Item 7 of the preceding Paragraph by the Party, he should delete, stop processing or using the personal information, ex officio or upon the request of the Party.

Article 20
Except the information stated in Paragraph 1 of Article 6, the non-government agency should use the personal information in accordance with the scope of the specific purpose of collection provided. However, the information may be used outside the scope upon the occurrence of one of the following conditions:
1. it is in accordance with law;
2. it is necessary to promote public interests;
3. it is to prevent harm on the life, body, freedom or property of the Party;
4. it is to prevent harm on the rights and interests of other people;
5. it is necessary for public interests on statistics or the purpose of academic research conducted by a government agency or an academic research institution, respectively.The information may not lead to the identification of a certain person after its processing by the provider, or from the disclosure by the collector;
6. consent has been given by the Party;
7. such use benefits the Party.
When the non-government agency uses the personal information for the purpose of marketing pursuant to the preceding Paragraph and has been turned down by the Party, the agency should stop its action.
The non-government agency should notify the Party the measures of refusal at the first marketing action and should pay for fees necessary.

Article 21
If one of the followings has occurred when the non-government agency transmits personal information internationally, the government authority in charge of subject industry may limit its action:
1. Where it involves major national interests;
2. Where national treaty or agreement specifies otherwise;
3. Where the country receiving personal information lacks of proper regulations towards the protection of personal information and it might harm the rights and interests of the Party:
4. Where international transmission of personal information is made through an indirect method in which the provisions of this Law may not be applicable.

Article 22
The government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government may perform an inspection by its staff workers who carry badges, if it is necessary for the protection of personal information, the disposal after termination of business, the limitation of international transmission, other routine examinations, or if this Law may be violated. Those who perform the inspection should illustrate the action, take necessary measures and provide relating documents.
When the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government conducts such an inspection as stipulated in the preceding Paragraph, may detain or duplicate the personal information or its files which may be confiscated or may be served as evidence. The owner, holder or keeper of those objects should offer them upon request. A compulsory enforcement that might harm the rights of the non-government agency the least may be applied to refusals without proper reasons.
When the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government conducts the inspection stipulated in Paragraph 1 of this Article, the professional of information technology, telecommunications or law may be accompanied.
The non-government agency and its personnel should not evade, obstruct or refuse the entering, inspection or measures adopted which are stipulated in Paragraph 1 and 2 of this Article.
All the personnel who take part in the inspection should fulfill the obligation of confidentiality for the information obtained during the job-undertaking.

Article 23
The objects detained or duplicated in accordance with Paragraph 2 of the preceding Article should be sealed or tagged, and properly located. Those may not be carried or kept may be guarded by a designated personnel, or be kept by the owner or suitable persons. If it is no more necessary to keep the detained or duplicated objects, or when a punishment is not applied or a confiscation is not applied, those objects should be returned. However, it does not apply to objects that should be confiscated or kept for other cases.

Article 24
The non-government agency, owner, holder, keeper or interested persons of those detained or duplicated objects may raise an objection to the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government for the demand, compulsory enforcement, detention, or duplication mentioned in the preceding two Articles.
For the objection mentioned in the preceding Paragraph, the government authority in charge of subject industry at the central government level, municipality directly under the central government or county or city government should stop or alter such acts immediately, when it is considered reasonable. Otherwise, it may continue such acts. Upon the request of the person who raises the objection, the competent government authority should issue a record of reasons towards the objection.
The objection against the decision of the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government in the preceding Paragraph may only be raised jointly with the objection against the decision of the case. However, people who may not raise an objection against the decision of the case as regulated in Paragraph 1 of this Article may bring an administrative litigation against the action mentioned in the same Paragraph.

Article 25
For the non-government agency that violates the provisions of this Law, one of the following actions may be ordered jointly with a fine as regulated by the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government:
1. to forbid the collecting, processing or use of the personal information;
2. to demand the deletion of the personal information files already processed;
3. to confiscate or to destroy the personal information illegally collected;
4. to publicize the violation case, the name of the non-government agency, and the name of the person in charge.
The decisions mentioned in the preceding Paragraph should be done by the measures that may harm the non-government agency the least and should be within the range set in this Law.

Article 26
After performing the inspection mentioned in Article 22, the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government may publicize the result of that after the consent of the non-government agency, if there is no violation found.

Article 27
The non-government agency which keeps personal information files should adopt proper security measures to prevent them from being stolen, altered, damaged, destroyed or disclosed.
The government authority in charge of subject industry at the central government level may designate a non-government agency for setting up the plan of security measures for the personal information file or the disposal measures for the personal information after termination of business.
The rules of the fore-mentioned plan and processing methods should be set up by the government authority in charge of subject industry at the central government level.