7. Other matters as stated by the Presidential Decree. (2) Paragraph (1) shall not apply to the personal information files applicable to any of the following Subparagraphs: 1. The personal information files which record the national security, diplomatic secrets and other matters relating to grave national interests; 2. The personal information files which record the investigation of crimes, indictment and prosecution, punishment, and enforcement of care and custody, corrective order, protective order, security observation order and immigration; 3. The personal information files which record the examination of law violating activities pursuant to the Law of Punishment on Tax Criminals and the Customs Act; 4. The personal information files which are used exclusively for internal job performance of the public institution; or 5. The personal information files which are classified as secret pursuant to other laws and regulations. (3) The Minister of Public Administration and Security may, if necessary, review the registration and its content of the personal information files stated in Paragraph (1), and advise the relevant head of the public institutions to improve such files. (4) The Minister of Public Administration and Security shall make public the current status of the registered personal information files stated in Paragraph (1) so that any one may access to them with ease. (5) Necessary matters in relation to the registration stated in Paragraph (1), the method, scope and procedure of public disclosure stated in Paragraph (4) shall be provided by the Presidential Decree. (6) The registration and public disclosure of the personal information files retained by the National Assembly, the Court, the Constitutional Court and the National Election Commission (including their affiliated entities) shall be provided by the respective rules of the National Assembly, the Court, the Constitutional Court and the National Election Commission. Article 33 (Privacy Impact Assessment) (1) The head of the public institution shall, in case of probable violation of personal information of data subjects owing to the operation of personal information files applicable to the criteria as specified by the Presidential Decree, conduct the assessment for the analysis and improvement of such risk factors (hereinafter referred to as the "Privacy Impact Assessment"), and submit its result to the Minister of Public Administration and Security. In this case, the head of the public institution shall request the Privacy Impact Assessment to among the institutions (hereinafter referred to as the "PIA institution") designated by the Minister of Public Administration and Security. - 17 -