interests of data subjects exists; b. The number of full members shall be more than one thousand; and c. Three years have elapsed since the registration pursuant to Article 29 of the Consumer Framework Act. 2. A non-profit organization pursuant to Article 2 of the Non-Profit Private Organization Support Act, which is fully qualified by the following Items: a. More than a hundred data subjects, who experienced the same sufferings as a matter of law or fact, have requested to file the Collective Suit; b. An organization, whose by-laws states the purpose of data protection, has conducted such activities for the last three years; c. The number of regular members shall be more than five thousand; and d. An organization has been registered with the central administrative department or agency. Article 52 (Exclusive Jurisdictions) (1) The Collective Suit shall be subject to the exclusive jurisdiction of the competent district court (panel of judges) at the place of business or main office, or at the address of the business manager in case of no business establishment, of the defendant. (2) Where Paragraph (1) applies to a foreign business entity, the same shall be determined by the place of business, main office or the address of the business manager located in the Republic of Korea. Article 53 (Retention of Attorney) The plaintiff of the Collective Suit shall retain an attorney-at-law as a litigation attorney. Article 54 (Application for Approval of Lawsuit) (1) An organization which intends to file the Collective Suit shall submit the application for approval of lawsuit describing the followings as well as the petition: 1. Plaintiff and its litigation attorney; 2. Defendant; and 3. Detailed infringements upon the rights of data subjects (2) The following materials shall be attached to the application for approval of lawsuit as stated in Paragraph (1): 1. Evidential materials which prove that the lawsuit filing organization be qualified with any of each Subparagraph of Article 51; and 2. Evidential documents which prove that the personal information processor rejected the dispute mediation or would not accept the mediation award. - 27 -

Select target paragraph3