Articles 35-2 to 35-4 with Decree Articles 42-2 onward: data subjects may ask controllers above decree criteria (for example average revenue over 180 billion won with 50,000 sensitive or identifier data subjects or one million data subjects, and public system operators) to transmit to them consent-based, contract-based or designated information about them that is processed electronically and not derived by analysis; they may also ask designated sector controllers (health, telecoms, energy and others under the decree) to transmit it to designated personal information management institutions or qualifying recipients; the controller transmits in a machine-processable form within reasonable time, cost and technology, notwithstanding tax secrecy rules, may refuse where identity is unverified, and the Commission runs a transmission support platform.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.