|
Article 1
|
These Rules are enacted according to Article 44 of the Law Governing Protection of Personal Data Processed by Computers ("the Law").
|
|
Article 2
|
"Individual" referred to in the Law means the living natural person who is specific or specifiable.
|
|
Article 3
|
The magnetic storage or other similar media referred to in Item 2 of Article 3 of the Law means the objects that copy or record the magnetic records, including the disks, the tapes, the CD-ROM, the magnetic bubble memories, the magnetic drums and other materials that can store magnetic records.
The magnetic storage referred to in the preceding Paragraph means the records made by electricity, magnetism or the other ways that can not be recognized by human senses, and are provided for computer processing.
|
|
Article 4
|
The personal data file referred to in Item 2 of Article 3 of the Law includes the backup files.
|
|
Article 5
|
The automatic machinery referred to in Item 3 of Article 3 of the Law means the machines that can function as computers to receive commands, programs or other instructions to process matters automatically.
|
|
Article 6
|
The third party referred to in Item 5 of Article 3 of the Law means the natural persons, juristic persons or the other groups except the government agency or non- government agency which keep personal data file.However, this term does not include the groups or individuals that are en-trusted to process data.
|
|
Article 7
|
The enterprises, groups or individuals referred to in sub-item 3 of Item 7 of Article 3 of the Law means those that use computers to process personal data that are numerous enough to have influence on the rights and interests of the principal and therefore, need to be regulated.
|
|
Article 8
|
When the principal exercises its rights provided in Article 4 of the Law to the government agency, the procedure shall be prescribed by the government agency.
When the principal exercises its rights provided in Article 4 of the Law to non-government agency, the procedure shall be prescribed by the central authority in charge of the industry.
|
|
Article 9
|
When the principal exercises higher rights provided in Item 1 and 2 of Article 4 of the Law, the personal data shall be limited to those that are printed from its personal data file.
|
|
Article 10
|
The deletion referred to in Item 5 of Article 4 of the Law means to make the stored personal data disappear from the personal data file according to Paragraph 3 of Article 13 of the Law.
|
|
Article 11
|
The groups or individuals that are en-trusted by the government agency or the non-government agency to process data shall process the personal data according to the Law.
In the situation of the preceding Paragraph, the principal shall exercise its rights under the Law to the agencies which entrust the matter.
|
|
Article 12
|
The utilization benefiting the rights and interests of the principal referred to in Item 8 of Article 8 of the Law means the utilization that are obviously favorable to the principal and there is no reason to refuse such a utilization if the principal knows such a utilization.
|
|
Article 13
|
The international transmission and utilization referred to in Articles 9 and 24 of the Law mean the transmission and utilization that make use of telegraph, wireless, optics system or the other magnetic system that are passed through and used by the communication network, not including the transmission that makes use of post, hand-carry transmission microcards, punch cards, computer worksheets or magnetic storage.
|
|
Article 14
|
When the government agency wants to make the announcement according to Paragraph 1 of Article 10 of the Law, the government agency shall make the announcement within one month after the personal data file becomes on line; the above provision applies to any amendment thereof.
The way of announcement in the preceding Paragraph shall be specified and shall not be changed at will.
|
|
Article 15
|
The other proper means referred to in Paragraph 1 of Article 10 of the Law mean the announcements that make use of televisions, newspapers, magazines or other media that can be known by the public.
The period of the announcement in the preceding Paragraph shall not be less than two days.
|
|
Article 16
|
The name of the government agency utilizing the personal data file referred to in Item 3 of Paragraph 1 of Article 10 of the Law may be announced in the generalized way that indicates the range and number of the government agencies.But in regard to the utilization for the specific purpose, the announcement shall state the name of the agencies and the reasons provided in Article 8 of the Law.
|
|
Article 17
|
The basis referred to in Item 4 of Paragraph 1 of Article 10 of the Law means regulations or administrative plans based on which the personal data file is being kept.
|
|
Article 18
|
The places referred to in Item 8 of Paragraph 1 of Article 10 of the Law shall state the addresses.If the recipient is a juristic person or a group, the name of the recipient and its representative shall be stated; If an individual, the name.
The direct recipient referred to in Item 9 of Paragraph 1 of Articles 10 and 20 of the Law shall state the address of its place.If the direct recipient is a juristic person or a group, the nationality, and its name and the name of its representative shall be stated; If an individual, the nationality and name.
If the agency referred to in Item 10 of Paragraph 1 of Article 10 of the Law is the same as the agency that keeps the record of the personal data file, the agency needs not to announce the name and address of said agency.
|
|
Article 19
|
The matters relevant to administration of entry/exit referred to in Item 5 of Article 11 of the Law include the matters relevant to personal passports.
|
|
Article 20
|
The matters relevant to personnel issues referred to in Item 7 of Article 11 of the Law mean the personal and basic information and information on selection and appointment of a public servant stored and managed by the government agencies of different levels, including the matters that the training organization of the government agencies handle the personal data file with respect to the resumes, achievements and assessments of the trainees.
When there are questions about the identification of the preceding data, the competent authority should confirm said questions.
|
|
Article 21
|
The personal data files used for computer processing for experimental purpose referred to in Item 7 of Articles 11 of the Law mean the personal data files that are used for the temporary experiments and tests and shall be destroyed with six months.
|
|
Article 22
|
The material interests of a third party adversely affected referred to in Item 3 of Article 12 of the Law mean one of the following circumstances:
- harmful to the life, health, freedom, properties or other important interests of a third party;
- the data files are received from a third party and the relationships of assistance and trust between the third party and the safekeeping agency will be damaged if said data files are allowed to be inquired, read and copied upon the request of the principal.
|
|
Article 23
|
The accuracy referred to in Paragraph 1 of Article 13 of the Law means that the personal data used for specific purposes should be true, complete and up-to-date.What is called timeliness means that the government agency should make corrections or supplements as soon as possible.
The performance of an official duty referred to in Paragraphs 2 and 3 of Article 13 of the Law means that the government agencies perform official duties according to the laws or the non-government agencies operate their business or behave according to their establishment purposes.
The specific purpose no longer existing referred to in Paragraph 3 of Article 13 means one of the following circumstances:
- the government agencies have been disbanded or reorganized;
- the non-government agencies cease doing business, stop work, dissolve or change their business;
- the specific purpose has been reached and there is no necessity to continue using;
- other facts that are enough to recognize that the specific purpose can not be reached.
|
|
Article 24
|
When the government agencies correct, supplement, delete or discontinue the processing or utilization of data file according to Article 13 of the Law, the government agencies shall notify the individuals, groups or agencies that are known to have received said personal data file.
The personal data referred to in the preceding Paragraph includes the worksheets printed by computers or the other things that can be recorded.Provided, the Law or other laws shall govern if the Law or other laws provide otherwise.
|
|
Article 25
|
When the principal requests the government agencies to make correction or supplements of his personal data according to Paragraph 1 of Article 13 of the Law, the principal shall submit explanatory evidence.
|
|
Article 26
|
The book referred to in Articles 14 and 22 of the Law may be substituted in the forms of computer terminals or other relevant equipment and documents for the principal to look up.
|
|
Article 27
|
When the government agencies according to Article 14 of the Law and the non-government agencies according to Article 22 of the Law maintain the books, in addition to disclosing the facts provided in Paragraph 1 of Article 10 and Items 1 to 10 of Paragraph 1of Article 20 of the Law, they may include maintenance deadline of the data is and whether the data has been publicized.
The government agencies and the non-government agencies should designate the management organization and the location where the books can be reviewed.
|
|
Article 28
|
The fees that the government agencies and the non-government agencies charge for the review and copying of the personal data files shall reflect the costs that the government agencies and the non-government agencies incur to process the review and copying of the personal data files.
|
|
Article 29
|
When the non-government agencies apply for registrations according to Paragraph 1 of Article 20 of the Law, the non-government agencies may apply for the registrations of two or more specific purposes.
|
|
Article 30
|
The written consent obtained from the principal referred to in Paragraph 1 of Article 18 of the Law means the written statement sufficient to show the principal's consent.
In order to obtain the principal's consent for the specific purpose, the non-government agencies shall give the principal or his agent the data and relevant information collected and processed by computers and used for the specific purpose when it contacts the principal for the first time, along with papers indicating that the principal may object within the specified time period.If the principal does not object within the specified period, it may be presumed that the principal has consented.
|
|
Article 31
|
The contracts referred to in Item 2 of Article 18 are not limited to the contracts concluded after the Law becomes effective.
|
|
Article 32
|
The similar contractual relationship referred to in Item 2 of Article 18 of the Law means one of the following circumstances:
- the trust relationship resulting from the contact and discussion between the non-government agency and the principal for the purpose of concluding contracts or transaction before such contracts are concluded.
- the contact relationship resulting from the exercise of rights, the performance of obligations or the maintenance of the personal data file by the non-government agency or the principal when the contract is void, cancelled, rescinded, terminated, or fulfilled.
The information already known to the public referred to in Item 3 of Article 18 of the Law means the personal data that a non-specific third party may receive or know legally.
|
|
Article 33
|
The handling fees referred to in Item 3 of Article 19 of the Law mean the amount of the examination fee, registration fee, license fee or other fees that the competent authority in charge of the industry of different levels charge for registration, issuance of a permit and a license according to the Law.
|
|
Article 34
|
The government agency that maintains the personal data file shall enact a regulation that protects the security of the personal data file processed by computers and includes the data security, data audit, equipment management and the other security protection.
|
|
Article 35
|
The provisions of Paragraph 1 of Articles 24, 25 and 34 shall be applied mutatis mutandis to all non-government agencies.
|
|
Article 36
|
When the non-government agency reports the method of handling according to Paragraph 3 of Article 20 of the Law, the non-government agency shall list the following particulars according to various types of data:
- Destruction
- method of destruction;
- the time and place of destruction;
- the manner to evidence the destruction
- Transfer
- the reason to transfer, such as sale gift or other reasons;
- the transferee, including its nature such as the government agency or non-government agency;
- the legal basis and evidence with respect to the maintenance of personal data file by the transferee;
- the manner, time and place of transfer.
The competent authority in charge of the industry may send officials to supervise the process of destruction and transfer if necessary.
The non-government agency shall submit the evidence to the competent authority in charge of the industry after said destruction or transfer.
|
|
Article 37
|
The non-government agency shall make the public announcement required under Article 21 of the Law within two months after the application for registration is approved.The same applies to the change of registration.
|
|
Article 38
|
The period of public announcement in a local newspaper according to Article 21 of the Law shall not be less than two days.
|
|
Article 39
|
The non-government agency need not list the following particulars when it makes public announcement in a local newspaper according to Article 21 of the Law:
- the personnel, official duty, salary, sanitation, welfare or other affairs with respect to the non-government agency;
- the computer processing for experimental purpose;
- the particulars that will be deleted prior to the public announcement.
- the other particulars provided in the other laws.
|
|
Article 40
|
The necessity referred to in Paragraph 1of Article 25 of the Law means that there are facts that are sufficient to show that the non-government agency violates or is likely to violate Articles 18 to 24 of the Law.
The identification certificates referred to in Paragraph 1 of Article 25 of the Law shall state the following particulars:
- the name of the investigating agency;
- the name and title of the investigators;
- the basis of the investigation.
The investigating agency shall keep confidential and pay attention to the reputation of the investigated non-government agency.
|
|
Article 41
|
When the government authority in charge of the industry sends officials to investigate according to Paragraph 1of Article 25 of the Law and asks the investigated non-government agency to provide data, written explanation or other things or seize anything, the government authority in charge of the industry shall give a receipt stating the name, quantity, the owner, place and time.
After the investigation, the government authority in charge of the industry shall make records stating the investigation procedure, the required data, the result of the investigation and other coordination arrangement.If anything is seized, said record shall state the particulars that should be stated in the receipt of the preceding Paragraph.
If the record of the preceding Paragraph is made on the spot, the government authority in charge of the industry shall let the investigated non-government agency review and sign; said non-government agency may state its opinion per another written document.If the record of the preceding Paragraph is made afterward, the government authority in charge of the industry shall send a copy of the record to the investigated non-government agency and inform it of its right to state opinions; said non-government agency may state its opinion per another written document after receipt of said copy.
If the government authority in charge of the industry determines that the investigated non-government agency violates the laws according to the report on the investigation and the opinions submitted by the investigated non-government agency, the government authority in charge of the industry shall handle such according to the laws.
If there is no necessity to keep the things seized, the government authority in charge of the industry shall return said things.
|
|
Article 42
|
The claims for compensation according to Article 27 or 28 of the Law shall be limited to those relating to the illegal behavior and for the damage occurring after the Law becomes effective.
|
|
Article 43
|
If the supervising government agency of the government agency receives the written application filed by the principal according to Paragraph 1 of Article 31 of the Law and regards such an application as illegal or has no reasons, the supervising government agency shall reject such an application and express the reason; if the supervising government agency regards such an application has reasons, the supervising government agency shall order the government agency to correct its handling according to the principal's application within the specified time period and notify the principal of the result.
|
|
Article 44
|
The public interest groups referred to in Paragraph 3 of Article 42 of the Law mean the public interest associations and foundations formed according to the Civil Code or other special laws and the non-juristic person groups approved by the central government authority in charge of the industry that are engaged in public interest activities that are related to the personal data.
|
|
Article 45
|
If the non-government agency is already engaged in the collection or computer processing of personal data before promulgation and enforcement of the Law and informs the principal before its application for registration or approval according to the Law and the principal does not object, the non-government agency may continue being engaged in the collection or computer processing of personal data within the time period specified in Paragraph 1 of Article 43 of the Law.
|
|
Article 46
|
These Enforcement Rules shall become effective upon promulgation.
|