The government approved the revisions to the enforcement decree of the Credit Information Use and Protection Act at a cabinet meeting on July 28, which marks the final legislative changes necessary for the promotion of a data-driven economy and digital new deal initiative.

KEY REVISIONS

I. ENSURING SAFETY IN DATA CONVERGENCE

Data convergence will be safely carried out by designated institutions specifically tasked with data convergence. Data specializing institutions shall provide pseudonymized and anonymized data to financial institutions.

Data specializing institutions are required to maintain an appropriate level of human resources and set up a risk management system and internal control mechanisms.

II. LOWERING ENTRY BARRIERS FOR NEW MYDATA & CREDIT BUREAU BUSINESSES

More fintech firms will be given opportunities to start their own credit bureau businesses as the revisions restrict the required number of data specialists to maximum 10 professionals even for business entities wishing to apply for multiple CB licenses.

In addition, new guidelines will be established to prohibit unfair practices by credit bureaus, such as discriminatory or preferential credit rating, etc.

III. REQUIRING MYDATA BUSINESSES TO SAFELY PROTECT PERSONAL FINANCIAL DATA AND STRENGTHENING DATA PRIVACY RIGHTS FOR CONSUMERS

New rules have been established to guarantee that MyData service providers are abiding by data privacy rights and data transfer rights of consumers.

IV. IMPROVING DATA PROTECTION IN FINANCIAL SECTOR

Financial companies will be required to inspect and report to the financial authority at least once every year the results of inspection for internal data management and protection status.

Individuals will be entitled to explanations and formal objections against automated personal credit assessment or personal credit ‘profiling,’ which will help boost transparency in financial transactions.

SCHEDULE

The revisions to the enforcement decree of the Credit Information Use and Protection Act will go into effect on August 5. The guidelines for personal data protection and for the use of pseudonymized and anonymized data processing will also be made available in August to facilitate clear understanding of safe data processing protocols.

The FSC plans to promptly implement other measures to promote data economy by designating data specializing institutions and licensing MyData businesses and new credit bureaus. The FSC will continue to maintain close communication with market experts on data-related issues, such as big data, MyData and AI.

EXPECTATION

The revisions are expected to help a) foster new industries, such as MyData and nonfinancial credit bureaus, and create quality jobs in the areas of data economy, b) improve access to financial services for many by introducing nonfinancial CBs and CBs for self-employed business owners, c) introduce more consumer-oriented financial services with the application of big data, and d) ensure higher accountability standards by carrying out regular inspection of data protection system.

* Please refer to the attached PDF for details.