Article 1 - Purpose
This Guide for the Operation and Management of Image Data Processing Devices (the “Guide” hereafter) serves to define the operation and management of image data processing devices installed at the owned and leased premises (the “Offices” hereafter) of Samsung C&T’s Engineering & Construction Group (the “Company” hereafter), pursuant to Article 25 of the Personal Information Protection Act (the “Act” hereafter) and Article 25 of said act’s enforcement decree.
Article 2 – Terminology
Image data processing devices are security cameras, CCTV components, recording units (such as DVRs and NVRs), and other devices installed at the Offices of the Company for the purposes of recording images of individuals and objects and transmitting those recorded images to a remote location via either a closed-wireless or a closed-cable transmission circuit.
Image data refers to images that were recorded and/or processed by image data processing devices and depict the likeness, behavior, or any other identifying personal quality or trait of an individual.
Processing refers to the collection of image data using image data processing devices and to the logging in, storage, referencing, rendering, editing, deletion, destruction, recovery, playback, printing, publication, or any other similar use of the collected image data.
Image data processing device manager refers to an appointed or commissioned individual overseeing the installation, operation, and management of image data processing devices.
Subject of the data refers to a natural person who is identifiable in the concerned image data and is therefore its main subject.
Article 3 – Scope
The guidelines herein, unless specified otherwise under the law, dictate the protection of image data recorded and processed by image data processing devices installed inside and outside the Offices and apply to the Company, parties authorized by the Company, and all individuals involved in the operation and management of image data processing devices and the handling of image data thereof.
Article 4 – Installation Objective and Operational Status
Image data processing devices are installed inside and outside the Offices for the safety of the facility and customers and the preventions of fires, accidents, and crimes in accordance with Items 1 and 2 of Article 1 of the Act. The operational status of image data processing devices in use by the Company is as follows:
Image Data Processing Devices in Use
Leased Office
Scope of Image Data Recording
Scope of image data recording includes areas inside and outside the Offices requiring the installation of image data processing devices for the safety of the facility and the customer and/or the prevention of fires and crimes.
Image Resolution
Images recorded by image data processing devices are stored at a resolution high enough to satisfy the concerned installation objective.
Article 5 – Management Responsibilities
Individuals responsible for the installation of image data processing devices and the handling of image data thereof are as follows:
Image data processing device managers perform the following tasks as per the privacy-protection requirements stipulated in Article 31-2 of the Act:
ㆍEstablishment and implementation of a plan for the protection of private image data;
ㆍPeriodic review and improvement of private image data handling and related practices;
ㆍProcessing of complaints concerning the handling of private image data and arrangement of compensation for damages;
ㆍDeployment of an internal regulatory system for the prevention of unauthorized disclosure, misuse, and abuse of private image data;
ㆍEstablishment and implementation of a plan for education and training concerning the protection of private image data;
ㆍManagement and supervision of private image data protection and destruction;
ㆍSupervision of the service provide to ensure the secure and proper handling of image data and training of the service provider on the prevention of image data loss, theft, leakage, alteration, and damage; and
ㆍOther tasks related to the protection of private image data.
Image data processing device managers may delegate tasks related to the installation and operation of image data processing devices to individuals or a third party and are responsible for ensuring the secure handling of image data by the designated individual and/or third party. The approved third party to which said tasks may be delegated is S1 and, specifically, its TS team leads whose territories include the Offices. In delegating tasks to this third-party service provider, the image data processing device manager must do so in writing by including each of the following information:
ㆍPurpose and scope of the delegation;
ㆍExplicit prohibition of further delegation of the tasks to other parties;
ㆍAccess restriction to the image data and other security-related steps;
ㆍA description of data-management inspections; and
ㆍA description of indemnification and other liabilities in the event of the service provider’s failure to fulfill its responsibilities.
Article 6 – Management & Operation Standards
As a rule, image data processing devices installed at the Offices are to record continuously for 24 hours a day at the highest possible settings.
Image data processing devices may not be operated at one’s discretion, be used in areas beyond the scope of image data recording, or be used with the “record audio” function turned on. Image data collected using image data processing devices may not be stored for longer than one month and must be destroyed without delay upon expiration. The devices are to be set up and run so that the image data is destroyed (deleted) automatically.
Storage of the recorded data is restricted to the situation room where the recording device is located. Should it be necessary to relocate the data for storage at a different location, however, the image data processing device operator must first be informed before proceeding with the relocation. The new storage site is to then be noted in the inspection journal and managed accordingly.
Data collected and transmitted by image data processing devices may only be monitored from designated locations and must be protected so that only the image data processing device manager and the designated personnel of the service provider may monitor it when needed. This designated location where monitoring of the image data is permitted is to be noted in the security-facility-inspection journal and managed accordingly.
Image data processing devices are to be inspected for normal functionality at least once a day. Results of these inspections are to be noted in the security-facility-inspection journal and managed accordingly.
Article 7 – Image Data Handling
The image data processing device operator is prohibited from using the image data for any other purpose than collection and from providing the image data to an unauthorized third party, except in any one of the following circumstances:
ㆍWith the consent of the subject of the data;
ㆍDoing so is permitted under the Act or another law;
ㆍIf doing so is unquestionably necessary in the interest of the subject of the data or a third party’s life, wellbeing, or estate and consent could not be gained in advance due to the subject of the data or their legal representative not being able to express their intent or being unreachable; or
ㆍThe data is provided for a statistics-compilation or academic purpose and in a format where individuals cannot be identified.
Individuals wishing to view image data in which they are a subject may do so by contacting the image data processing device manager of the Office in question in advance, filling out the image data confirmation request form that’s available at the information desk, and presenting the form to the image data processing device manager.
Should the image data be used for a purpose other than collection or provided to a third party, the image data processing device operator must make note of each of the following and manage the event accordingly:
ㆍName of the image data file;
ㆍName of the organization or individual who used or received the data;
ㆍThe purpose of the data’s use or provision;
ㆍLegal basis for the data’s use or provision (if one exists);
ㆍPermitted duration of the data’s use or provision (if defined); and
ㆍThe manner of the data’s use or provision.
When destroying image data, the image data processing device operator must make note of each of the following and manage the event accordingly:
ㆍName of the image data file to be destroyed;
ㆍTime and date of the image data’s destruction (destruction cycle if being deleted automatically and auto-delete verification schedule); and
ㆍName of the person responsible for the data’s destruction.
Article 8 – Requests by a Subject of the Data
Individuals reserve the right to request access to or confirmation of the existence of image data processed by the Company (the “Requests” hereafter). Types of image data for which individuals may submit the Requests are limited to image data in which they are a subject of the data and image data that is unquestionably needed in the interest of the individual’s life, wellbeing, or estate.
When making the Requests, the principal needs to present their identification (resident registration card, driver’s license, or passport) and the legal representative of the principal needs to present their identification and a letter of attorney. Both the principal and the legal representative of the principal must also fill out and submit the data confirmation request form, which is available at the security desk of the Offices.
Upon receiving the Requests, the Company must immediately inform the relevant image data processing device manager and offer its full cooperation.
However, the Company may refuse the Requests by informing the principal of its reason in writing within ten days in any one of the following circumstances:
ㆍCompliance with the Requests may severely impede a criminal investigation, an arraignment, or a trial;
ㆍThe concerned image data has exceeded its duration of storage and has already been destroyed; or
ㆍThere exists a sufficient cause to deny the Requests.
When processing the Requests, the image data processing device operator is to make note of each of the following and manage the concerned Requests accordingly. The image data processing device operator is to report to the image data processing device manager prior to taking any action in response to the Requests or, if unable to do so, report to the image data processing device manager immediately after taking action in response to the Requests.
ㆍName and contact information of the principal behind the Requests;
ㆍName and content of the concerned image data file;
ㆍThe purpose of the Requests; and
ㆍThe reason for denying the Requests (if applicable).
The image data processing device operator is required to perform, under the supervision and management of the image data processing device manager, each of the following to secure and protect the image data against loss, theft, leakage, alteration, and damage:
ㆍRestriction of access to the image data and limitation of access privileges;
ㆍImplementation of technologies for the safe storage and transmission of the image data;
ㆍImplementation of measures for the storage of processing records and the prevention of forgery and alteration of processing records; and
ㆍFacilitation of facilities and apparatuses for the secure storage of the image data in physical form.
Article 9 – Signs
The Offices at which image data processing devices have been installed are required to inform the individuals at the Offices of the presence and use of the devices by posting signs that contain the following information:
ㆍInstallation purpose and locations;
ㆍScope of image data recording and hours; and
ㆍName and contact information of the image data processing device operator.
If multiple image data processing devices have been installed at the Office, a sign explaining the entire facility or scene is under surveillance may be used. For image data processing devices installed outdoors, a separate sign needs to be used for each device.
Article 10 – Revisions
The Guide was established on 1 September 2011 and is subject to additions, subtractions, and revisions along with new changes in the law, in policy, and/or security technologies. Changes to the Guide are announced, along with the reasons behind them, via the Company’s website at least seven days prior to taking effect.
- Announcement Date: 20 June 2016
- Enforcement Date: 20 June 2016
- Revision Date: 2 September 2017
- Revision: Image Data Processing Devices in Use
