POSCO E&C

As times change, companies must equally consider and generate both economic and
non-economic values, including environmental and social values.

CCTV Operation policy

CCTV Policy for the Protection of Personal Information

CHAPTER I GENERAL PROVISIONS

Article 1 (Purpose)

The purpose of this Policy is to fulfill appropriate duties and comply with applicable laws by setting matters POSCO E&C Ltd. (the “Company”) must comply with in relation to the installation and operation of closed-circuit televisions and protection of footages.

Article 2 (Definitions)

The terms used in this Policy shall be defined as follows:

1. The term closed-circuit television (“CCTV”) is a type of communication network, in which the footages recorded from the CCTVs located in specific sites are collected and transmitted to exclusive receivers through wired/wireless closed-circuit channels.
2. The term “footage” refers to CCTV recordings of which the recorded subject can be identified.
3. The term “data subject” refers to an individual who can be identified from the footage; that is, the subject of footage.
4. The term “processing” refers to the act of handling data collected through CCTVs, such as inputting, saving, editing, deleting, playing, and other similar acts, excluding the collection of such data.

Article 3 (Scope of Application)

(1) In relation to the installation and operation of CCTVs needed for crime prevention, facility security, and fire safety, as well as the protection of footages that are collected and processed by the aforementioned reasons, the provisions of this Policy shall be observed, unless special provisions are stipulated in other laws.
(2) Use of auxiliary cameras for CCTVs installed and operated by the Company shall also comply with this Policy, regardless of the fact whether their recordings are treated as actual footages or not.

Article 4 (Protection of Footages)

(1) The Company shall collect minimum scope of footages that meets the purpose of CCTV installation.
(2) The Company must have the data subject clearly aware of the installation purpose as mentioned in paragraph (1) of this Article. The footages shall not be used for other purposes than the said purpose.
(3) The Company shall secure accurate and the latest footages and manage them in a safe manner.
(4) The Company shall disclose general matters in relation to the handling of footages and protect the rights of data subjects.

CHAPTER II REQUIREMENTS FOR CCTV INSTALLATION

Article 5 (Notification of Installation Plans, etc.)

In the event of installing a CCTV, the Company shall prepare a CCTV installation and operation plan (“Plan”) that includes the following items:

1. Purpose of CCTV installation;
2. Division in charge of CCTV control: Handling officer and contact details;
3. Number of cameras, locations, performance, and scope of recording of the CCTV to be installed and operated;
4. Standard of the caution sign to be installed and the installation location in accordance with Article 7(1);
5. Contents, procedures, and methods regarding the data subject's exercise of rights and means of objection;
6. CCTV recording time, retention period of footages, methods of storage, management, and deletion of footages, and storage location of footages;
7. Actual location where footages transmitted from CCTVs are accessed and played, and access control to the said location;
8. Grounds, procedures, and methods of providing or granting access to footages to a third party; and
9. Other matters recognized to be necessary for the protection of footages

Article 6 (Designation of CCTV Managers)

(1) The head of the division in charge of the installation and operation of CCTVs shall be designated as the CCTV General Manager, while his or her staff shall be designated as CCTV Operation Manager(s) (“CCTV Manager(s)”).
(2) The CCTV Manager shall take charge of duties in relation to the installation and operation of CCTVs, reception and handling of complaints, and collection and processing of footages.
(3) The CCTV Manager shall designate and manage a separate Personal Information Handler and inform the CCTV General Manager of relevant information in the event of CCTV installation and/or other changes.

Article 7 (Installation of Caution Signs)

(1) In the event of installing a CCTV, the Company shall put up caution signs regarding CCTV operation and the collection of footages for the recognition of data subjects.
(2) The signs in relation to paragraph (1) of this Article shall mention the following items:
- 1. Purpose of CCTV installation;
- 2. Recording scope and time; and
- 3. Information on the CCTV handling division, CCTV Manager, and contact details
(3) The signs in relation to Paragraph (1) of this Article shall be installed within the recording scope where they are easily visible and understood by data subjects.
(4) Notwithstanding Paragraph (2), in the event of installing several CCTVs in the Company’s building, the sign that complies with Paragraph (1) may mention that the whole building is within the recording scope and can be attached only on the building exits.

CHAPTER III REQUIREMENTS FOR HANDLING FOOTAGES

Article 8 (Limitation on Collection)

(1) CCTVs shall not be arbitrarily manipulated or shoot other places beyond the purpose of their installation during collection of footages.
(2) Footage rotation and zooming features that have no relation to the purpose of CCTV installation may not be used during collection of footages.

Article 9 (Limitation on Processing)

Footages of a data subject may not be used for other purposes than the CCTV installation purpose or be granted access or provided to a person who has no access authority: Provided, That this shall not apply in any of the following circumstances:

1. Where consent is obtained from the data subject;
2. Where the data is given access or provided to the data subject;
3. Where special provisions exist in other laws;
4. Where the data is provided in a pseudonymized manner when it is required for the purposes of reporting by the media through newspapers or broadcasting;
5. Where there is an urgent reason for not obtaining the data subject's consent when the risk that the rights and interests of the data subject may be infringed is clear and present;
6. Where it is necessary for the investigation of a crime, indictment, and/or prosecution; or
7. Where it is necessary for the enforcement of punishment, probation, and custody.

Article 10 (Safeguards, etc.)

The Company shall designate a place where footages transmitted by CCTVs are actually accessed and played (“Control Center”) as a restricted zone and strictly limit the access of individuals apart from those who have been granted the authority.
(2) The Company shall limit the authority to access footages to CCTV Managers and the minimum number of designated personnel.
(3) The Company shall regularly inspect and check the normal operation of CCTVs and keep an accurate record regarding the matters.
(4) The Company shall seek for technical and managerial safety measures in response to illegal access, alteration, leakage, and damage of footages.
(5) The Company shall prepare a training course on the personal information protection of data subjects for those who are granted authority to access footages.

Article 11 (Request for Access, etc.)

(1) A data subject may request to confirm the existence, access, and/or delete footages to the Company.
(2) In relation to the request as mentioned in the paragraph (1) of this Article, the Company shall take immediate action in accordance with Article 5(5).
(3) Notwithstanding Paragraph (2) of this Article, the Company may refuse to take action in the event of any of the following circumstances. In this case, the grounds for refusal and objection method shall be informed (including information and communications networks) to the data subject within seven (7) days.
- 1. Where it may cause grave difficulties in performing investigation of crimes, prosecution, and conduct of trials;
- 2. Where deleting only the footages of a specific data subject is extremely difficult in technical manner;
- 3. Where taking appropriate action as prescribed in Paragraph (1) of this Article may infringe upon other's privacy rights; or
- 4. Where there are appropriate grounds to refuse the request for access, etc., that meet the public interest.

Article 12 (Retention and Deletion)

Footages collected through CCTVs shall be deleted without delay once the data retention period mentioned in the Plan expires: Provided, That when it is difficult to determine the minimum period of time required to achieve the purpose of data retention due to the nature of a division, the retention period shall be within thirty (30) days after the collection of footages.

CHAPTER IV SUPPLEMENTARY PROVISIONS

Article 13 (Consignment of Duties)

(1) In the event of consigning the duties in relation to the installation, operation, and management of CCTVs, the Company shall take necessary safety measures to prevent the abuse of footages and supervise the consignee.
(2) The consignee who is granted authority to access footages in relation to paragraph (1) of this Article shall undergo a training course as mentioned in Article 10(5).[lh1]

Article 14 (Confidentiality)

Those who handle or have handled footages shall not use the obtained data for inappropriate purposes, such as revealing, processing without authority, and/or providing for the use of another person.

Article 15 (Exclusion)

This Policy shall not be applied to CCTVs installed and operated to supervise the duties of individuals who are with the military regardless of their duties.

Personal Data Processing Policy Legal Disclaimer

CCTV Operation policy

CCTV Policy for the Protection of Personal Information