information under the command and supervision of the personal information processor, such as an officer or employee, dispatched worker, part-timer, etc. (hereinafter referred to as the "personal information handler") so that the personal information may be managed. (2) The personal information processor shall provide necessary educational program to the personal information handler on a regular basis so as to ensure appropriate handling of the personal information. CHAPTER IV. SAFEGUARDS OF PERSONAL INFORMATION Article 29 (Duty of Safeguards) The personal information processor shall take such technical, managerial and physical measures as internal management plan and preservation of log-on records, etc. necessary to ensure the safety as specified by the Presidential Decree so that personal information may not be lost, stolen, leaked, altered or damaged. Article 30 (Establishment and Disclosure of Privacy Policy) (1) The personal information processor shall establish the personal information processing policy including the particulars in the following Subparagraphs (hereinafter referred to as the "Privacy Policy"). In this case, the public institutions shall set up the Privacy Policy toward the personal information files to be registered pursuant to Article 32: 1. The purpose of personal information procession; 2. The period for processing and retention of the personal information; 3. Provision of the personal information to a third party (if applicable); 4. Consignment of personal information processing (if applicable); 5. The rights and obligations of data subjects and how to exercise the rights; and 6. Other matters in relation to personal information processing as stated in the Presidential Decree. (2) The personal information processor shall, when it establishes or modifies the Privacy Policy, disclose the content so that data subjects may recognize it with ease in such a way as stated by the Presidential Decree. (3) If there are discrepancies between the Privacy Policy and the agreement executed by and between the personal information processor and data subjects, what is beneficial to data subjects prevails. (4) The Minister of Public Administration and Security may prepare the Privacy Policy Guidelines and encourage the personal information processor to comply with such guidelines. - 15 -