Article 20 (Notification of Other Sources, etc. of Personal Information Than Data Subject) (1) When the personal information processor processes personal information collected from other sources than data subject, the personal information processor shall notify such data subject of everything stated in the following Subparagraphs immediately on demand from such data subject: 1. The source of collected personal information; 2. The purpose of processing of personal information; and 3. The fact that a data subject is entitled to demand suspension of the processing of personal information. (2) Paragraph (1) shall not apply to the case where any of the following Subparagraphs is applicable; provided, however, that it is explicitly superior to the rights of data subjects under this Act. 1. Where personal information, which is the object to demand notification, is included in the personal information files applicable to any of the Subparagraphs of Article 32(2); or 2. Where such notification likely causes harm to the life or body of other person, or unfairly damages the properties and other profits of other person. Article 21 (Destruction of Personal Information) (1) When the personal information processor shall destroy the personal information without delay when such personal information becomes unnecessary owing to the expiry of retention period, attainment of purpose of personal information processing, etc.; provided, however, that the same shall not apply where preservation of it is mandatory by other laws and regulations. (2) When the personal information processor destroys the personal information under Paragraph (1), necessary measures to block recovery or revival shall be taken. (3) When the personal information processor is obliged to preserve, rather than destroy, the personal information under the proviso of Paragraph (1), the relevant personal information or personal information files shall be stored and managed apart from other personal information. (4) Other necessary matters such as the method to destroy the personal information, its destruction process, etc. shall be stated by the Presidential Decree. Article 22 (Method to Obtain Consent) (1) When the personal information processor obtains the consent from the data subjects (including their legal representatives as stated in Paragraph (5). Hereinafter the same applies to this Article) with respect to personal information processing under this Act, the personal information processor shall notify the data subjects of the fact by separating the matters requiring consent and helping the data subjects to recognize it explicitly, and - 10 -