Personal Information Protection Commission

Overview

What is Request for Access, etc. to Personal Information?

It is a system that allows a data subject to request, to an institution which has collected his or her personal information, an access to the collection history or third party provision of the personal information, rectification/erasure of, and suspension of processing the personal information, ect.

What is the Identity Verification History Search Service?

A service that provides a data subject with the access history of ID verification by resident registration number, I-PIN, or mobile phone to carry out membership registration, age verification (adult authentication), and/or real-name verification, etc., on internet.

Purpose

To minimize the illegal use of others’ names and invasion of privacy due to divulgence and misuse or abuse of personal information and reinforce the data subject’s right to self-determination to personal information.

Legal basis and targets

Legal basis

• Article 4 of the Personal Information Protection Act (Rights of Data Subjects)
• Article 35 of the Personal Information Protection Act (Access to Personal Information)
• Article 37 of the Personal Information Protection Act (Suspension of Processing of Personal Information)
• Article 38 of the Personal Information Protection Act (Methods and Procedures for Exercise of Rights)

Subject of Application

Domestic Website Operators

Procedure

Request for Access, etc. to Personal Information

Enlarge image

1. Data subject : Access, Suspension of processing, Rectification/Erasure / www.[A].go.kr -> Request the instances of personal info. verification
2. ePrivacy Clean Service (KISA) Agent -> Data subject’s request for personal info. verification instances (notification)
3. Check the request (Dedicated website)
4. Review by laws
5. Access history
6. Reply with a result

Search All of Identity Verification History & Support for Membership Withdrawal

Internet Service

Increase of membership-based websites

Is My Personal Information Safe This Way?

ID theft
Privacy infringement
Burner phone, borrowed-name bankbook
Small-scale transaction scams
Prevention of inactive account

Search All of Identity Verification History

Resident registration no
i-PIN, Mobile

See all of the personal information verification instances at once

Search Result

• Resident registration no. : http://XXShop
• i-PIN
• mobile - 20170617

Support for Website Membership Withdrawal

Website where ID theft is suspected Website where membership cancellation is denied Website not used for an extended period of time

Easy Cancellation of Membership on Unnecessary Websites

Search Result

• Resident registration no. : http://XXShop
• i-PIN
• mobile - 20170617

Request for membership withdrawal

Division in Charge and Operating Agency

Division in charge

Self-Protection Policy Division of the Personal information Protection Commission

Operating agency

Korea Internet Security Agency (KISA)

Procedure

Request for Access, etc. to Personal Information

Enlarge image

Steps and Description

1. Request for Access
2. Check the requesting subject and the scope of access to personal data
3. Check the restriction on access
4. Notification of decision (Access authorized/ restricted/deferred)
5. Access
6. Notification of decision (Access denied)

1. Request for Rectification, Erasure & Suspension of Processing
2. Check the requesting subject and the scope of access to personal data
3. Check the restriction on rectification, erasure, and suspension of processing
4. Notification of results
5. Notification of restriction on rectification, erasure, and suspension of processing (incl. denial and matters related other laws, etc.

Expected Effects

• To guarantee an individual (data subject) the right to know the processing history of his or her own personal information, but also the opportunities to exercise his or her rights, such as right to access to personal information, and right to request suspension of processing personal information, etc. and
• To minimize the risk of damage from divulgence, misuse or abuse of personal information, such as identity theft and privacy infringement, etc.