Which personal information processors must secure their damages liability by insurance, mutual aid or a reserve, and which of them are let out?
General information · Not legal advice
Material to check
In practice material of this kind, we read the records showing the processor's revenue and the scale of the personal information it holds, because the Presidential Decree standard is applied to those figures; we also read the insurance or mutual aid policy, the reserve records, and, where the processor claims an exemption, the entrustment contract with a small business or the papers showing public institution or non-profit status.
These are types of material to look for, not evidence already verified by PRO SE.
Where readings differ
One reading takes the first paragraph as it stands: a personal information processor to whom a standard set by Presidential Decree applies, a standard fixed by reference to revenue, the scale of personal information held and other considerations, must take the necessary measures — joining insurance or a mutual aid scheme, setting aside a reserve fund, or the like — so that the damages liability the provision names is performed.
Another reading looks at the second paragraph, which lets certain persons do nothing: public institutions, non-profit corporations and groups as the Presidential Decree designates, a person who entrusted processing to a small business under the Small Business Act as designated by the Presidential Decree, and a processor already covered by insurance, mutual aid or a reserve arranged under another law for that same liability. The provision itself identifies the three exemption categories, with Presidential Decree designations and references to other statutes further defining their scope.
Your judgment
If a small business entrusted processing to more than one party, what in the file would show whether the recipient is the one the Decree designates?
PRO SE does not make this decision or keep a case record on this public site.When to reconsider
We look at this again if the Presidential Decree standard or the designated categories are amended, or if an authority clarifies whether security arranged under another law covers the whole of the liability secured here.