Article 24

Where personal information processors use personal information to make automatic decision, the transparency of decision-making and the fairness and justice of the results shall be ensured, and shall not impose unreasonable differential treatment on individuals in terms of transaction price and other transaction conditions.

Where business marketing and information push are carried out through automatic decision-making, options not based on his/her personal characteristics shall be provided at the same time, or a convenient way for individuals to reject shall be provided.

Where automatic decision-making has a significant impact on individual’s rights and interests, he/she has the right to require the personal information processor to give an explanation, and to reject the decision made by the personal information processor only through automatic decision-making.

Article 55

A personal information processor shall conduct personal information protection impact assessment of the following circumstances in advance and keep a record of the processing:

(I) processing sensitive personal information;

(II) making use of personal information to make automatic decisions;

(III) entrusting others to process personal information, providing other personal information processors with personal information, and disclosing personal information;

(IV) providing personal information to overseas parties; and

(V) other personal information processing activities that have a significant impact on individuals’ rights and interests.

Article 73

For the purposes of this Law, the following terms are defined as follows:

(I) A personal information processor refers to any organization or individual that independently determines the purpose and method of processing in personal information processing activities.

(II) An automatic decision-making refers to an activity to automatically analyze and evaluate a person’s behavior habits, hobbies or economic, health or credit status through computer programs and make decisions.

(III) De-identification refers to the process in which personal information is processed so that it is impossible to identify certain natural persons without the use of additional information.

(IV) Anonymization refers to the process in which the personal information is processed so that it is impossible to identify a certain natural person and unable to be recovered.