|
Article 26
|
(Protection of Personal Data)
- The following data safety management measures shall be adopted to protect the safety of personal data held:
- Use of each type of equipment or storage medium shall be regulated. Appropriate measures shall be taken against data leak when any equipment or medium is discarded or used for other purposes.
- Appropriate measures of encryption shall be taken when personal data held that needs to be encrypted are collected, processed, or used.
- Where it is necessary to backup persona data in the course of operation, the backup data shall be protected appropriately.
- The following safety management measures shall be adopted for the relevant equipment if personal data held is stored in a hard copy, disc, magnetic film, optical disk, microfilm, integrated circuit chip, computer, automated machine or equipment, or other medium:
- Access shall be properly restricted.
- Methods of safekeeping media shall be prescribed.
- Appropriate protective equipment or technology shall be installed by the characteristics and environment of each medium.
- For the purposes of protecting the safety of personal data held, the level of authority of relevant personnel to access personal data shall be determined by the need to execute business, their access shall be controlled, and confidentiality obligations shall be entered into with the personnel.
- It shall be confirmed that risk assessment and control are performed of personal data held in the core systems and all computer systems.
- A core system or computer system shall keep audit trails of the use of personal data (such as login accounts, system functions, times, system names, inquiry commands or results) or have in place an identification mechanism to facilitate tracking of the use of personal data in the event of a leak.
- A data leak protection mechanism shall be established to control transmission of personal data through copying through an input/output device, communication software, or system operation to a webpage or network file, etc. The relevant records, trails, and evidence shall be retained.
- The following records shall be retained in the event of an erasure or suspension of processing or use of personal data held:
- Method and time of said erasure or suspension.
- Where the personal data is transferred to others after the erasure or suspension, the reason of the transfer, party to which the personal data is transferred, method of transfer, time of transfer, and legal basis for said party’s collection, processing, or use.
|