Image Information Processing Equipment Operation & Management Policy

1. 01. Grounds and Purpose of Image Information Processing Equipment Installation

   The Image Information Processing Equipment Operation & Management Policy (“the Policy”) sets forth the rules for Doosan Engineering & Construction (“Doosan E&C”) to comply with concerning the installation and operation of the image information processing equipment (IIPE), and personal image information protection requirement under Article 25 of the Personal Information Protection Act. The Policy aims to promote the adequate performance of work and to contribute to the protection of the rights and interests of the persons providing personal information.

2. 02. Protection Principles of Personal Image Information

   Doosan E&C will collect personal image information within the narrow scope in line with the purpose of installing the IIPE and will insure that persons providing personal information will be able to clearly recognize the installation purpose, and will not use the information for any purpose other than the aforementioned purpose. Doosan E&C will safely mange the personal image information, disclose the matters related to the processing of such information, and guarantee the rights of those persons on their personal image information.

3. 03. Appointment of an Administrator

   Doosan E&C has appointed the following administrator to manage the installation and operation of the personal IIPE

   • Administrator : Byun Woong-sub
   • Phone: 02-510-3058
   • Department-In-Charge: Management Support Team
   • Outsourcing Company: Doosan FM Business Department Corp.
4. 04. Installation of Image Information Processing Equipment Installation

   The number of the installed IIPE and their locations and viewing distances are as follows:

   • Number of the IIPE : 29 (26 secured-type and 3 rotating-type)
   • Locations of the IIPE : Outside the building, underground parking, and lobby
   • Viewing distances of the IIPE : Outside the building, underground parking, and lobby
5. 05. Information Sign Posting

   Doosan E&C will take a necessary action such as posting an information sign containing the following so that the persons providing their own person information can easily notice the installation and operation of the IIPE:

   • The purpose, location, shooting scope and time, controller’s name, position, and contact number.
   • In the case the installation and control is outsourced, the outsourced person/company’s name and contact number.

   The information sign shall be posted in a place where those who provide their own personal information can easily see it within the shooting scope. The size of the information sign shall be 40x30cm. However, the size is subject to change, according to the circumstances of the installation location.

6. 06. Request of the Persons Providing Their Own Personal Information, Such As Requesting to View/Inspect Their Personal Information

   A person providing their own personal information (“a person”) can request Doosan E&C to view/inspect and confirm the identification (”Viewing/Inspection”) regarding their own personal image information.

   Doosan E&C will take a necessary action upon receiving a request for veiwing/inspection. In doing so, Doosan E&C may check through a submitted ID including resident registration card or driver’s license to confirm whether the requesting person is the person concerned or a legitimate representative.

   Doosan E&C may reject such a request in the following cases and in such cases, Doosan E&C will give notice, in writing, to the requesting person or the representative of the reason for rejection or the method for appealing within 10 days of receiving the request:

   • When the personal image information was destroyed because of the expiration of the retention period.
   • When other legitimate reasons exist to reject such a viewing/inspection request.
7. 07. Image Information Control

   When the personal image information is used for the purpose other the intended purpose of the collection or when it is transferred to a third party pursuant to your consent or according to the provisions of laws and regulations, the following will be recorded in the Personal Image Information Log:

   • Name of the personal image information file
   • Name of the user or person to whom the transfer was made
   • Purpose of use or transfer
   • In the event it exists, the legal grounds of use or transfer
   • If it exists, period when the use or transfer occurred
   • Type of use or transfer

   When destroying personal image information, the following shall be recorded in the Personal Image Information Log:

   • Destroyed personal image information (items)
   • Date of destruction (destruction frequency, etc., when automatic deletion takes place preset destruction period)
   • Person in charge of personal image information destruction
8. 08. Retention and Destruction

   Doosan E&C will immediately destroy the collected personal image information upon the expiration of the retention period specified in the Policy. However, it will not do so if required by specific provisions in relevant laws and regulations. The methods of destroying personal image information are as follows:

   The methods of destroying personal image information are as follows:

   The hardcopy recordings (photo, etc.) of personal image information will be shredded or incinerated. Electronic file format information will be permanently deleted in the technical manner through which the deleted personal image information cannot be retrieved.

9. 09. Administrative, Technical, and Physical Actions

   The right to access personal image information collected and processed by the IIPE is limited to a minimum number of people, including the controller and the person in charge of the work. The place where the personal image information transmitted by the IIPE is viewed/inspected and retrieved is designated as being a restricted area, and only the authorized people are allowed to access and view/inspect the information.
   Doosan E&C immediately changes or withdraws the access rights of a person, whose access right changes, due to HR changes such as job transfer or retirement.
   We take necessary safeguards to ensure the safety of personal image information, including setting a password in the event that we process personal image information or send and receive such a file so that it cannot be lost, stolen, leaked, modified, or damaged.
   We regularly inspect the status of the operation of the IIPE to prevent the forgery or modification of personal image information.
   
   Date of Public Notification: September 26, 2013 (Version 2.0)
   Date of Enforcement: September 27, 2013 (Version 2.0)