Article 43(Processing of sensitive information and personally identifiable information) #
(1) If it is inevitable for conducting the following business affairs, the Minister of Health and Welfare (including persons to whom relevant authority or duty has been delegated or entrusted under Article 41 (1), (2), and (4)) or the Minister of Food and Drug Safety (including persons to whom relevant authority or duty has been delegated or entrusted under Article 41 (3) or (5)) may manage the health information referred to in Article 23 of the Personal Information Protection Act, information that constitutes criminal history records referred to in subparagraph 2 of Article 18 of Enforcement Decree of that Act, or resident registration number or alien registration number under subparagraph 1 or 4 of Article 19 of that Decree; provided, in the cases of conducting business affairs specified in subparagraph 1, 3, 14, and 15, the health information referred to in Article 23 of the Personal Information Protection Act and the information that constitutes criminal history records referred to in subparagraph 2 of Article 18 of Enforcement Decree of that Act shall be excluded herefrom: <Amended on Dec. 20, 2022; Feb. 18, 2025>
1. Business affairs regarding the designation of regenerative medical institutions under Article 10 of the Act;
2. Business affairs regarding deliberation and approval of research protocol for advanced regenerative medicine under Article 12 of the Act;
2-2. Business affairs regarding the deliberation of advanced regenerative medicine treatment plans under Article 12-2 of the Act;
3. Business affairs regarding permission and modified permission for cell processing facilities, and renewal of permits therefor under Article 15 of the Act;
4. Business affairs regarding the receipt of reports on the results of safety monitoring and measures necessary for public health under Article 20 (1) and (5) of the Act;
5. Business affairs regarding the receipt of reports on the results of long-term follow-up of clinical research for advanced regenerative medicine pursuant to Article 21 (3) and (4) of the Act and necessary measures for public health;
6. The following business affairs under Article 23 of the Act:
(a) Business affairs regarding the permission for manufacturing business of advanced biological products, permission for modification thereof, and renewal of permits;
(b) Business affairs regarding receipt of notification of the contract manufacturing business of advanced biological products, receipt of modified notification thereof, and renewal of certificates of notification;
7. Business affairs regarding acceptance of notification filed by a manufacturing manager of advanced biological products under Article 24 of the Act;
8. Any of the following affairs under Article 27 of the Act:
(a) Business affairs regarding acceptance of notification of import business of advanced biological products and receipt of modified notification;
(b) Business affairs regarding acceptance of notification of an import manager and renewal of a certificate of notification, which are applied mutatis mutandis pursuant to Article 27 (5) of the Act;
9. Business affairs regarding permission and modified permission for management business of human cells, and renewal of permits under Article 28 of the Act;
10. Business affairs regarding receipt of reports on the results of investigation and analysis of adverse events under Article 30 (3) of the Act;
11. Business affairs regarding measures necessary for public health under Article 30 (6) of the Act;
12. Business affairs regarding instructions for reporting, investigation, and collection under Article 39 of the Act;
13. Business affairs regarding administrative dispositions under Articles 40 through 42 of the Act;
14. Affairs for hearings under Article 43 of the Act;
15. Business affairs regarding imposition and collection of penalty surcharges prescribed in Article 45 of the Act;
16. Business affairs regarding succession to the status of manufacturers under Article 54 of the Act.
(2) Where it is inevitable for conducting the following business affairs, the head of a safety management institution may process data including health information prescribed in Article 23 (1) of the Personal Information Protection Act, and data including resident registration numbers and alien registration numbers prescribed in subparagraphs 1 and 4 of Article 19 of the Enforcement Decree of that Act: <Amended on Feb. 18, 2025>
1. Business affairs regarding receipt of reports on cell processing affairs prescribed in Article 15 (4) of the Act;
2. Business affairs regarding the collection and management of information on the implementation of advanced regenerative medicine under Article 19 (2) 4 of the Act;
3. Business affairs regarding safety monitoring and reports thereon under Article 20 (1) of the Act;
4. Business affairs regarding receipt of notification of and reporting on the occurrence of adverse reactions under Article 20 (2) of the Act;
5. Business affairs regarding investigation of details of the occurrence of adverse reactions and causes thereof under Article 20 (4) of the Act;
6. Business affairs regarding long-term follow-up of clinical research under Article 21 of the Act;
7. Business affairs regarding requests for providing data under Article 22 (1) of the Act and compilation of data under paragraph (3) of that Article.
(3) Where it is inevitable for conducting the following affairs, the head of the Regulatory Science Center may process data including health information referred to in Article 23 (1) of the Personal Information Protection Act, resident registration numbers and alien registration numbers referred to in subparagraphs 1 and 4 of Article 19 of the Enforcement Decree of that Act:
1. Business affairs regarding registration pursuant to Article 30 (4) of the Act;
2. Business affairs regarding requests for provision of data under Article 33 of the Act.
(4) The head of a cell processing facility (including a person entrusted with business affairs under Article 17 (1) of the Act), a management business entity of human cells (including a person entrusted with business affairs under Article 17 (1) of the Act, applied mutatis mutandis under Article 28 (5) of the Act) or medical personnel may process health information under Article 23 (1) of the Personal Information Protection Act, data containing resident registration numbers and alien registration numbers under subparagraphs 1 and 4 of Article 19 of the Enforcement Decree of that Act, if it is inevitable for conducting the following affairs:
1. Business affairs regarding the written consent (including cases applied mutatis mutandis pursuant to Article 28 (5) of the Act) under Article 16 (3) and (4) of the Act;
2. Business affairs regarding matters to be complied with by the head of a cell processing facility under Article 18 of the Act;
3. Business affairs regarding matters to be complied with by management entities of human cells referred to in Article 29 (1) of the Act;
4. Business affairs regarding preparation of management records of human cells under Article 29 (2) of the Act.
(5) A person who has obtained approval of a clinical trial protocol, a person who has obtained permission by item, or an importer may, if it is inevitable for implementing a plan for a long-term follow-up under Article 30 (3) of the Act and to report on the results of investigation and analysis of adverse events, process health information under Article 23 (1) of the Personal Information Protection Act, or resident registration numbers and alien registration numbers under subparagraphs 1 and 4 of Article 19 of the Enforcement Decree of that Act.
(6) Where it is inevitable for conducting affairs related to personal information of persons to be administered with advanced biological products and registration of records of administration history under Article 30 (4) of the Act, a doctor, dentist, and pharmacist who handles advanced biological products may process data that contain health information under Article 23 (1) of the Personal Information Protection Act, or data containing resident registration numbers or alien registration numbers under subparagraph 1 or 4 of Article 19 of the Enforcement Decree of that Act.