|
Article 8
|
When commissioning others to collect, process or use personal information, the commissioning agency shall properly supervise the commissioned agency.
The supervision prescribed in the preceding paragraph shall contain at least the followings:
- the planned scope, classification, specific purpose and time period of collecting, processing or using personal information;
- the measures taken by the commissioned agency in accordance with Paragraph 2 of Article 12;
- the third party, if any, further commissioned by the commissioned agency;
- the matters to be notified to the commissioning agency and the remedial measures to be taken when the commissioned agency or its employees violate the Act, other personal information protection related laws or their regulations;
- the matters of a reserved instruction, if there are any reserved instruction(s) given to the commissioned agency by the commissioning agency; and
- the return of any instrument containing personal information and the deletion of any personal information stored and possessed by the commissioned agency as a result of performing the commission agreement, when the commission agreement is terminated or rescinded.
For the purpose of supervision prescribed in Paragraph 1, the commissioning agency shall periodically confirm the implementation status of the commissioned agency and record the result of such confirmation.
The commissioned agency may collect process or use personal information but only to the extent within the commissioning agency’s instruction. If considering that the commissioning agency’s instruction violates the Act, other personal information protection related laws or their regulations, the commissioned agency shall notify the commissioning agency immediately.
|