In accordance with the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. and its Enforcement Decree, the Korean Society of Echocardiography has established and operates the following guidelines for the safe handling of Connecting Information (CI) as an institution using Connecting Information.
These guidelines take effect on August 1, 2026.
Chapter 1 General Provisions
Article 1 (Purpose)
The purpose of these guidelines is to prescribe the matters necessary for the safe handling of Connecting Information by the Korean Society of Echocardiography (hereinafter referred to as "the Society") as an institution using Connecting Information, in accordance with the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. (hereinafter referred to as the "Network Act") and its Enforcement Decree.
Article 2 (Scope of Application)
These guidelines apply to the following persons.
1. Officers, employees, and secretariat staff of the Society who operate and manage the Connecting Information processing system
2. Persons who are not officers or employees of the Society but who handle Connecting Information for the construction, development, operation, and maintenance of the Connecting Information processing system (hereinafter referred to as "external staff"), and persons entrusted with the processing of Connecting Information
Article 3 (Definitions)
The definitions of terms used in these guidelines are as follows.
1. "Connecting Information" means information (CI) obtained by irreversibly encrypting a user's resident registration number for the purpose of service linkage by an information and communications service provider.
2. "Connecting Information processing system" means an information system that processes Connecting Information.
3. "Processing" means the generation, provision, use, comparison, or linkage of Connecting Information, and other similar acts.
4. "Data subject" means a person who can be identified by the information processed and who is the subject of that information (such as a member).
5. "Person responsible for Connecting Information safety measures" means the person responsible for deciding on, applying, and managing matters relating to the Society's Connecting Information safety measures.
6. "Connecting Information manager" means the person who manages the practical work relating to the Society's processing of Connecting Information and supports the duties of the person responsible for Connecting Information safety measures prescribed in these guidelines.
7. "Connecting Information handler" means a person in charge of processing the Society's Connecting Information, including any person who directly performs work relating to Connecting Information and any person who accesses and processes Connecting Information as required for their duties.
Chapter 2 Organization and Operation of the Connecting Information Protection Body
Article 4 (Connecting Information Protection Body)
(1) The final approver of the Society's Connecting Information safety measures shall be the Chairman of the Board, and the person responsible for Connecting Information safety measures shall be the Director of Information (Chair of the Information Committee), who shall oversee the following duties.
1. Overall supervision of work relating to Connecting Information safety measures
2. Investigation and inspection of Connecting Information infringement incidents
3. Inspection and supervision of the status of Connecting Information processing
4. Establishment and implementation of training plans for the protection of Connecting Information
5. Other major matters relating to the protection of Connecting Information
(2) The Connecting Information manager shall be the Secretary General of the Society and shall perform the following practical duties in order to protect the Connecting Information handled within the relevant area of management.
1. Protection and practical management of Connecting Information handled by the secretariat
2. Management and supervision of Connecting Information handlers belonging to the secretariat and of outsourced consignees
3. Granting, management, and supervision of access rights to the Connecting Information processing system
4. Receipt and handling of requests for access to, correction or deletion of, suspension of processing of, and withdrawal of consent to Connecting Information
5. Execution of the destruction of Connecting Information and management of related records
(3) Connecting Information handlers shall be the persons in charge of processing Connecting Information within the secretariat and the administrators of the consigned website operation, and shall comply with the following obligations and responsibilities.
1. Compliance with and implementation of the safety measure standards for Connecting Information
2. Prohibition of disclosure to third parties and unauthorized provision of Connecting Information learned in the course of duties
3. Completion of training on the protection of Connecting Information
4. Implementation of other matters necessary for the protection of Connecting Information
Article 5 (Training)
The person responsible for Connecting Information safety measures shall provide training on the protection of Connecting Information at least once a year to Connecting Information managers, Connecting Information handlers, and consignees of external contractors.
Chapter 3 Handling and Management of Connecting Information
Article 6 (Management of Access Rights to Connecting Information)
(1) The Society shall grant access rights to the Connecting Information processing system only to Connecting Information handlers, differentiated to the minimum scope necessary for the performance of their duties.
(2) Where a change of position, retirement, or the like occurs with respect to a Connecting Information handler, the Society shall without delay change or revoke that person's access rights to the Connecting Information processing system.
(3) The Society shall issue an independent account to each Connecting Information handler and manage such accounts so that they are not shared with others.
(4) The Society shall take measures to restrict access after a certain number of authentication failures so that only duly authorized persons may access the Connecting Information processing system.
Article 7 (Retention of Connecting Information)
(1) The retention period of Connecting Information shall be calculated as the minimum period consistent with the purpose of retention, such as from the time of membership registration until withdrawal.
(2) Where a specific retention period is stipulated in individual statutes, the relevant statute shall apply; otherwise, the person responsible for Connecting Information safety measures shall determine the retention period.
Article 8 (Protective Measures upon Collection and Provision of Connecting Information)
(1) Where Connecting Information is received from an external identity verification agency or transmitted externally, a secured dedicated line, a virtual private network (VPN), or a safe encryption protocol of TLS 1.2 or higher shall be used.
(2) A Connecting Information handler shall report in advance to the person responsible for Connecting Information safety measures when providing Connecting Information externally. However, the following cases are exceptions.
1. Where the prior consent of the data subject (member) has been obtained
2. Where identity verification is compared through the official administrator system of the Society's website
3. Where required by a court order for submission or a warrant issued by a judge
Article 9 (Storage and Safekeeping of Connecting Information)
(1) Printed materials and storage media containing Connecting Information shall be kept in a safe place with a locking device.
(2) The Connecting Information processing system, including servers storing Connecting Information, shall be located in a controlled area subject to access control.
(3) Connecting Information may not be stored on personal computers (PCs) used for business purposes. However, this shall not apply where it is unavoidable for business purposes and the approval of the person responsible for Connecting Information safety measures has been obtained.
(4) Related record logs, such as the source, time, and purpose of the collection of Connecting Information, shall be stored and managed for at least one year.
Article 10 (Destruction of Printed Materials Containing Connecting Information)
Printed materials containing Connecting Information shall not be reused and, once the purpose of printing has been achieved, shall be destroyed without delay by shredding with a shredder or by incineration.
Article 11 (Destruction of Connecting Information)
Connecting Information for which grounds for destruction have arisen, such as the expiry of the retention period or the withdrawal of a member, shall be destroyed without delay using technical methods that make recovery and reproduction impossible.
Article 12 (Separate Storage from Resident Registration Numbers)
(1) Where resident registration numbers are stored together in the Connecting Information processing system, physical or logical separation and storage measures shall be taken.
(2) However, the Society does not directly collect or retain the resident registration numbers of members and users, and this Article shall apply if the Society comes to process resident registration numbers in the future on statutory grounds.
Chapter 4 Safe Storage and Transmission of Connecting Information
Article 13 (Storage and Transmission of Connecting Information)
(1) Where the Society transmits or receives Connecting Information over an information and communications network, it shall apply transport layer security (TLS 1.2 or higher) protocols or a safe encryption algorithm such as an encrypted virtual private network (VPN).
(2) Where the Society stores Connecting Information in a database (DB) or on storage media, it shall encrypt and store it using a safe encryption algorithm.
Chapter 5 Vulnerability Inspection
Article 14 (Vulnerability Inspection)
(1) The Connecting Information manager shall regularly perform security vulnerability inspections of the Connecting Information processing system at least once a year and remedy any defects found.
(2) The results of vulnerability inspections and remedial actions shall be reported to the person responsible for Connecting Information safety measures.
Chapter 6 Incident Response and Protection of Data Subject Rights
Article 15 (Disclosure of Matters Concerning the Processing of Connecting Information)
The Society shall disclose the items collected, the purpose, the retention period, and other such matters in its external privacy handling policy so that data subjects may be aware of the status of Connecting Information processing.
Article 16 (Response Procedures in the Event of a Connecting Information Infringement Incident)
In the event of an incident such as hacking or leakage, the Society's response procedures for personal information leakage incidents shall apply mutatis mutandis, and measures to minimize damage and reporting shall be carried out immediately under the direction of the person responsible for Connecting Information safety measures (the Director of Information).
Article 17 (Access to, Correction or Deletion of, Suspension of Processing of, and Withdrawal of Consent to Connecting Information)
(1) A data subject may at any time request access to, correction or deletion of, suspension of the processing of, or withdrawal of consent to matters concerning the processing of his or her Connecting Information.
(2) A data subject may request the exercise of such rights through the official e-mail address of the Korean Society of Echocardiography (kse0930@ksecho.org) without a separate form, and the secretariat shall take action without delay after verifying the identity of the requester.
Addenda
Article 1 (Effective Date) These guidelines shall take effect on August 1, 2026.
