2. Where laws and regulations require, or permit, the processing of sensitive data. Article 24 (Limitation to Processing Unique Identifier) (1) The personal information processor shall not, except the cases stated in the following Subparagraphs, process the identifier assigned so as to identify an individual in accordance with laws and regulations, as stated by the Presidential Decree (hereinafter referred to as the “Unique Identifier”): 1. Where the personal information processor informs data subjects of each Subparagraph of Articles 15(2) or 17(2), and obtains the consent from data subjects apart from the consent to other personal information processing; or 2. Where laws and regulations require, or permit, the processing of the Unique Identifier in a concrete manner. (2) The personal information processor, that satisfies the criteria specified by the Presidential Decree, shall provide an alternative method to be admitted to its member without using the resident registration number when data subjects intend to get its membership through its Internet homepage. (3) In case the personal information processor processes the Unique Identifiers pursuant to each Subparagraph of Paragraph (1), the personal information processor shall take necessary measures to ensure the safety including encryption, as stated by the Presidential Decree, so that such Unique Identifiers may not be lost, stolen, leaked, altered or damaged. (4) The Minister of Public Administration and Security may prepare various measures such as legislative arrangements, policy making, necessary facilities and system build-up in order to support the provision of methods pursuant to Paragraph (2) Article 25 (Limitation to Installation and Operation of Visual Data Processing Devices) (1) No one shall install and operate visual data processing devices at open places except in the cases as stated in the following Subparagraphs: 1. Where laws and regulations allow it in a concrete manner; 2. Where it is necessary for the prevention and investigation of crimes; 3. Where it is necessary for the safety of facilities and prevention of fire; 4. Where it is necessary for regulatory control of traffic; or 5. Where it is necessary for the collection, analysis and provision of traffic information. (2) No one shall install and operate visual data processing devices so as to look into the places which likely threat individual privacy noticeably, such as a bathroom open to the public, toilet, sweating room and dressing room; provided, however, that the same shall not apply to the facilities, which detain or protect persons pursuant to laws and regulations, such as a penitentiary, mental health center stated by the Presidential Decree. (3) The head of public institutions who intends to install and operate visual data processing - 12 -