Except for the personal data specified under paragraph 1 of Article 6, the collection or processing of personal data by government agencies shall be for specific purposes and on one of the following bases:
1. where it is within the necessary scope to perform its statutory duties;
2. where consent has been given by the data subject; or
3. where the rights and interests of the data subject will not be infringed upon.

Except for the personal data specified under paragraph 1 of Article 6, government agencies shall use personal data only within the necessary scope of their statutory duties and for the specific purpose of collection; the use of personal data for another purpose shall be only on any of the following bases:
1.where it is expressly required by law;
2.where it is necessary for ensuring national security or furthering public interests;
3.where it is to prevent harm to the life, body, freedom, or property of the data subject;
4.where it is to prevent material harm to the rights and interests of others;
5.where it is necessary for statistics gathering or academic research by a government agency or an academic institution for public interests; provided that such data, as processed by the data provider or as disclosed by the data collector, may not lead to the identification of a specific data subject;
6.where it is for the data subject's rights and interests; or
7.where consent has been given by the data subject.

Government agencies shall make public the following information online or allow the public to make inquiries thereof via other appropriate means; the foregoing also applies when any changes are made to the following information:
1. the names of the personal data files;
2. the name and contact information of the agency that is in possession of the personal data files;
3. the legal basis and purpose of keeping the personal data files; and
4. the category of the personal data.

Government agencies in possession of personal data files shall assign dedicated personnel to implement security and maintenance measures to prevent the personal data from being stolen, altered, damaged, destroyed or disclosed.