Article 1 (Purpose)

• The purpose of these Regulations is to protect personal information and to regulate the use of CCTV installed and operated by Seoul Gallery for purposes other than its intended purposes, pursuant to the Act on the Protection of Personal Information Maintained by Public Institutions and the Public Institutions CCTV Management Guidelines, for the safety of visitors and facilities of Seoul Gallery and for fire prevention.

Article 2 (Definitions)

The definitions of terms used in these Regulations are as follows:

• 1. The term “CCTV” means a Closed Circuit Television system, which refers to a set of communications equipment that transmits personal video information collected by imaging devices installed in a certain space through a closed wired or wireless transmission line, making such information accessible only to designated persons;
• 2. The term “personal video information” means, among video information captured and processed by CCTV, information that can identify an individual, such as images related to an individual’s face, actions, etc.;
• 3. The term “data subject” means a person identified by personal video information, who is the subject of the relevant personal video information;
• 4. The term “processing” means inputting, storing, editing, deleting, and playing back personal video information collected by CCTV, as well as other similar acts.

Article 3 (Principles for Protecting Personal Video Information)

• ① Seoul Gallery shall collect personal video information only to the minimum extent consistent with the purpose of installing CCTV.
• ② The installation purpose under paragraph (1) shall be made clearly recognizable to data subjects, and personal video information shall not be used for purposes other than such purpose.
• ③ Efforts shall be made to ensure the accuracy and timeliness of personal video information and to manage it securely.
• ④ General matters regarding the handling of personal video information shall be disclosed, and data subjects’ rights regarding personal video information shall be guaranteed.

Article 4 (Scope and System of Management)

• ① The department that comprehensively oversees tasks such as CCTV installation and operation, receipt and handling of CCTV-related complaints, and collection and processing of personal video information shall be the Public Relations Division.
• ② The CCTV General Manager shall be the Public Relations Division; the CCTV Installation and Operation Management Officer shall be the officer in charge of facility management; and the CCTV General Manager may designate a CCTV Operations Officer.
• ③ The duties of each responsible person and the Operations Officer under paragraph (2) are as follows:
  • 1. The CCTV General Manager shall comprehensively oversee tasks such as CCTV installation and operation, and shall direct and supervise the work of the CCTV Installation and Operation Management Officer and the CCTV Operations Officer;
  • 2. The CCTV Installation and Operation Management Officer shall perform the following tasks related to CCTV installation and operation:
    • (a) The tasks set forth in each subparagraph of Article 37 (2) of the Standard Personal Information Protection Guidelines;
    • (b) Directing and supervising the CCTV Operations Officer’s work related to viewing and playback of personal video information, etc.;
  • 3. The CCTV Operations Officer shall, in the presence of or under the instructions of the CCTV Installation and Operation Management Officer, carry out tasks such as viewing, playback, and destruction of personal video information.

Article 5 (CCTV Installation and Operation)

• ① With respect to the installation and operation of CCTV at Seoul Gallery, the number of cameras, locations, performance, and recording ranges shall be as set forth in Annex Table; provided, however, that the number of cameras, their locations, and recording ranges may be increased, decreased, or changed depending on the internal circumstances of Seoul Gallery.
• ② In consideration of the performance of the Digital Video Recorder (DVR), the Seoul Gallery CCTV shall, in principle, record and store footage 24 hours a day; provided, however, that in consideration of storage capacity, it may be configured to record only when motion is detected.

Article 6 (Installation of Notice Boards)

Where multiple CCTV units are installed and operated within Seoul Gallery, notice boards containing the following information shall be installed in clearly visible places such as entrances to allow data subjects to easily recognize that the entire Seoul Gallery is a CCTV-installed area:

• 1. Purpose and location of CCTV installation;
• 2. Recording range and hours;
• 3. Responsible manager and contact information.

Article 7 (Outsourcing CCTV Installation and Management)

• ① The CCTV General Manager may outsource all or part of the tasks related to the installation and management of CCTV to another public institution or a specialized institution that meets the following requirements:
  • 1. Possess specialized equipment and technology necessary for personal information protection;
  • 2. Possess professional personnel necessary to perform the outsourced tasks.
• ② Where the CCTV General Manager intends to outsource tasks related to CCTV installation and management under paragraph (1), the CCTV General Manager shall specify in detail matters necessary for personal information protection, such as the scope of the tasks to be outsourced and restrictions on access to personal information, and shall clearly record such matters in the outsourcing agreement and other relevant documents.
• ③ Where tasks are outsourced pursuant to paragraphs (1) and (2), the notice boards shall state the name of the entrusted institution, the person in charge, and contact information.

Article 8 (Restrictions on Collection)

• ① When collecting personal video information by CCTV, the camera shall not be arbitrarily manipulated or directed outside the intended installation purpose.
• ② Audio recording functions shall not be used when collecting personal video information.

Article 9 (Restrictions on Processing)

• ① The CCTV General Manager shall not permit the use of, or provide, any personal video information file for purposes other than its intended retention purpose, except where its use or provision is permitted to persons inside or outside the holding institution under other applicable laws.
• ② Even when the CCTV General Manager permits the use of, or provides, personal video information files in accordance with their intended retention purpose, such use or provision shall be limited to the minimum scope necessary for the performance of duties.
• ③ Notwithstanding paragraph (1), the CCTV General Manager may permit the use of, or provide, personal video information files for purposes other than their intended retention purpose in the cases prescribed in Article 18 (2) and (3) of the Personal Information Protection Act, unless such use or provision is deemed likely to unjustly infringe the rights or interests of the data subject or a third party; provided, however, that even in cases of use or provision, the provisions of Article 18 (4) and (5) of the Personal Information Protection Act shall be complied with.

Article 10 (Use and Provision of Personal Video Information)

• ① Any person or institution wishing to use or receive personal video information shall specify the purpose and scope of use of processed information and shall submit a written request to the Director using Appendix Form No. 1.
• ② Where the CCTV General Manager permits an institution requesting the use or provision of processed information to use or receive such information, the CCTV General Manager shall record and manage the following matters in the Processed Information Use/Provision Log (Appendix Form No. 2), and shall retain access logs for collected and processed personal video information for at least three (3) months unless there is a special reason otherwise:
  • 1. Name of the personal video information file;
  • 2. Name of the user or recipient;
  • 3. Purpose of use or provision;
  • 4. Legal basis for use or provision, where such basis exists under laws and regulations;
  • 5. Period of use or provision, where such period is specified;
  • 6. Manner of use or provision;
  • 7. Details and results of any requested security measures.
• ③ Where the CCTV General Manager provides personal video information for purposes other than the intended purpose, the provision details (date, legal basis, purpose, items) shall be published in the Official Gazette or disclosed on the website for at least ten (10) days within thirty (30) days from the date of provision.

Article 11 (Requests for Access, etc., and Remedies)

• ① A data subject may request the Director to confirm the existence of, and to view or delete, personal video information in any of the following circumstances:
  • 1. Where the personal video information clearly contains only the data subject;
  • 2. Where it is clearly necessary for the urgent protection of the data subject’s life, body, or property interests.
• ② To request confirmation of existence, viewing, or deletion of personal video information under paragraph (1), the data subject shall submit an identification document (resident registration card, driver’s license, or passport) for verification. If the request is made through an agent, the agent shall submit the agent’s identification document together with the data subject’s power of attorney and certificate of seal impression (if required for the delegation).
• ③ The CCTV General Manager shall, without delay, take necessary measures in response to a request under paragraph (1); provided, however, that when allowing viewing, protective measures shall be taken to ensure that personal video information of persons other than the data subject cannot be identified.
• ④ The details, procedures, and methods for exercising rights and remedies related to requests under paragraph (1) shall follow, mutatis mutandis, the Official Information Disclosure Act.
• ⑤ Notwithstanding paragraph (1), the CCTV General Manager may refuse such request in any of the following circumstances. In such cases, the data subject shall be notified of the reason for refusal and the method of objection within ten (10) days, including by means of an information and communications network:
  • 1. Where it would cause a serious impediment to a criminal investigation, maintenance of prosecution, or performance of trial proceedings;
  • 2. Where it is technically extremely difficult to delete only the personal video information of a specific data subject;
  • 3. Where taking necessary measures for a request under paragraph (1) is highly likely to infringe another person’s right to privacy;
  • 4. Where the retention period of the personal video information has elapsed;
  • 5. Where viewing is prohibited or restricted under laws and regulations;
  • 6. Where other justifiable grounds exist to refuse a request for viewing, etc.

Article 12 (Retention Period and Deletion of Personal Video Information)

• ① The retention period of personal video information shall be within thirty (30) days from the time of collection, and the collected information shall be stored within the capacity of the DVR and automatically deleted thereafter; provided, however, that this shall not apply in any of the following circumstances:
  • 1. Where deletion would cause a serious impediment to criminal investigation, maintenance of prosecution, or performance of trial proceedings;
  • 2. Where retention is based on a request of the data subject;
  • 3. Where special provisions exist under other laws and regulations.

Article 13 (Storage Location; Methods of Storage, Management, and Deletion; and Protective Measures)

• ① The storage location of personal video information shall be the memory (HDD) of the DVR server at the Central Disaster Prevention Center.
• ② The Central Control Room, where personal video information transmitted by CCTV is actually viewed and played back, shall be designated as a restricted access area, and access shall be limited to persons with authorized access rights.
• ③ The CCTV General Manager may grant access authority to personal video information collected and processed by CCTV only to persons falling under any of the following categories, and such authority shall be limited to the minimum number of persons:
  • 1. Persons falling under Article 4 (2);
  • 2. Relevant persons in the cases falling under any subparagraph of Article 18 (2) or Article 18 (3) 1 of the Personal Information Protection Act, provided that lawful documents verifying such relevance are submitted;
  • 3. Persons authorized by the General Manager or the CCTV Installation and Operation Management Officer.
• ④ The General Manager shall regularly check whether the CCTV system is operating properly and shall accurately maintain the corresponding records.
• ⑤ The General Manager shall establish technical and administrative security measures to prevent unlawful access, alteration, leakage, or damage of personal video information.
• ⑥ When personal video information is processed or when personal video information files are transmitted or received through an information and communications network under Article 2 (10) of the Electronic Government Act, the CCTV General Manager shall take necessary measures to ensure that the personal video information is not lost, stolen, leaked, altered, or damaged.
• ⑦ Deletion of personal video information shall be carried out using the automatic deletion function of the DVR installed at the Central Disaster Prevention Center or by the Operations Officer, and the following matters shall be recorded and managed:
  • 1. Name of the personal video information file to be destroyed;
  • 2. Date and time of destruction (or, in the case of preset automatic deletion, the deletion cycle and the time of confirmation that automatic deletion has occurred);
  • 3. Person responsible for the destruction of personal video information.

Article 14 (Mutatis Mutandis Application)

• ① For the protection of personal video information, Articles 15, 18, and 19 of the Act on the Protection of Personal Information Maintained by Public Institutions shall apply mutatis mutandis to data subjects’ objections and the authority of the Ministry of the Interior and Safety to request submission of data or provide opinions.
• ② Matters not specified in these Regulations shall follow, mutatis mutandis, the Act on the Protection of Personal Information Maintained by Public Institutions, the Public Institutions CCTV Management Guidelines, the Standard Personal Information Protection Guidelines, and other relevant provisions.

Article 15 (Duty of Confidentiality)

• ① Any person who processes or has processed personal video information shall not disclose personal video information learned in the course of duties, process it without authority, provide it for another person’s use, or otherwise use it for any improper purpose.
• ② The CCTV Installation and Operation Management Officer shall ensure that any person requesting access to, or provision of, personal video information follows the procedures prescribed by laws and regulations or these Regulations, and where access or provision is not possible, shall inform the requester of the relevant provisions.
• ③ Where the CCTV Installation and Operation Management Officer discloses or provides to another person the personal details or purpose of request of a person requesting access or provision under paragraph (2), the Officer may take measures such as issuing a caution or warning.

Article 16 (Posting on the Website)

The regulations of Seoul Gallery regarding CCTV installation, operation, and management shall be posted on the Seoul Gallery website to allow users to view them.