obtain their consent thereof, respectively.
(2) When the personal information processor obtains the consent from the data subjects with
respect to personal information processing in accordance with Articles 15(1) i, 17(1) i and
24(1) i, the personal information processor shall segregate the personal information which
needs the data subjects’ consent to processing, from the personal information which needs
no consent in executing a contract with data subjects. In this case, the burden of proof
that no consent is required in processing the personal information shall be borne by the
personal information processor.
(3) The personal information processor shall, when it intends to obtain the data subjects’
consent to personal information processing so as to promote goods and services or solicit
purchase hereof, notify the data subjects of the fact by helping the data subjects to
recognize it explicitly, and obtain their consent thereof.
(4) The personal information processor shall not deny the provision of goods or services to
the data subjects on ground that the data subjects would not consent to the matter eligible
for selective consent pursuant to Paragraph (2), or would not consent pursuant to Paragraph
(3) and Article 18(2) i.
(5) The personal information processor shall, when it is required to obtain the consent in
accordance with this Act so as to process the personal information of minors of age below
14, obtain the consent from their legal representatives. In this case, the minimum personal
information necessary to obtain the consent from legal representatives may be collected
directly from such minors without the consent of their legal representatives.
(6) Other matters than those provided from Paragraphs (1) through (5), necessary to secure a
detailed method to obtain the consent from data subjects and the minimum information
pursuant to Paragraph (5), shall be stated by the Presidential Decree in consideration of
collection media of personal information.
Section 2 Limitation to Processing Personal Information
Article 23 (Limitation to Processing Sensitive Data)
The personal information processor shall not process the personal information (hereinafter
referred to as the “sensitive data”) including ideology, belief, admission/exit to and from
trade unions or political parties, political mindset, health, sexual life, and other personal
information which is likely doing harm to privacy of data subjects, as stated by the
Presidential Decree; provided, however, that the same shall not apply where any of the
following Subparagraph is applicable:
1. Where the personal information processor informs data subjects of each Subparagraph of
Articles 15(2) or 17(2), and obtains the consent from data subjects apart from the
consent to other personal information processing; or
- 11 -