The FSC approved a revision proposal for the supervisory regulation of credit information business at its regular meeting held on July 6. The key revisions and improvements are aimed at facilitating data convergence and utilization between different industries as stated below.
a) Allow data utilizing institutions (“non-data holders”) to make request for data convergence to enable businesses and institutions that are “non-data holders” to easily converge and utilize data held by other businesses and institutions that are “data holders.”
b) Introduce a data convergence procedure on sample data that can be more efficient and safe for use as it extracts and uses a portion of data from a large data set.
c) Make data specializing institutions’ requirements for self-convergence of data more reasonable to facilitate data convergence and utilization by data specializing institutions.
d) Introduce a qualification verification system whereby the Financial Supervisory Service (FSS) will verify the qualification of data specializing institutions every three years to ensure the maintenance of expertise and security quality by these institutions.
To make additional designation of data specializing institutions, on Monday, July 11, authorities will take applications for preliminary designation from the institutions that have earlier submitted preliminary applications in February.
Overview
In order to make finance play a leading role in a data economy through promotion of data convergence and utilization between the financial and other various industries, the FSC introduced a revision proposal for the supervisory regulation of credit information business in January 2022, and on July 6, the FSC approved this revision proposal which will go into effect from the date of announcement on July 7.
In addition, to make additional designation of data specializing institutions, the FSC will accept applications for preliminary designation of data specializing institutions on Monday, July 11. As previously announced in February this year, the registration of applications for preliminary designation of data specializing institutions this time will take place for those that have already submitted preliminary applications.
Key Revision Details
I. Improving Rules for Data Convergence and Data Specializing Institutions
a) Allow data utilizing institutions (“non-data holders”) to make request for data convergence (Article 15-2 of the Regulation)
(As of Now) Currently, making a request for data convergence and other related tasks can be done only by “data holders,” so that there are difficulties for “non-data holders” to converge or utilize data held by other “data holders.”
(To be Improved) Data utilizing institutions that are “non-data holders” will be permitted to make a request for data convergence. As such, in the process of data convergence, the “data holder” will only be responsible for the pseudonymization and transfer of data to a data specializing institution and all other processes can be carried out by the data utilizing institution (“non-data holder”).
b) Introduce a data convergence procedure on sample data (Article 15-2 of the Regulation)
(As of Now) Unlike the ordinary data convergence process for pseudonymized data, data convergence on sample data requires consent from each data subject, which has precluded financial companies from carrying out data convergence on sample data through data specializing institutions. As a result, even when a business wishes to make use of a portion of the converged data by sampling, it is currently required to provide the whole data set to a data specializing institution for data convergence, which raises that problem of inefficiency in the work process and concern about personal data protection.
(To be Improved) A data convergence procedure for sample data will be introduced. When a data convergence on a sample data is needed, sending only sample data to a data specializing institution will be allowed without consent from data subjects, which makes the process of data convergence more efficient.
c) Ease rules on data specializing institutions’ self-convergence of data (Article 15-2 of the Regulation)
(As of Now) When a data specializing institution wishes to carry out self-convergence of data—converging its own data with data from a third party—it is allowed in principle only if the purpose of self-convergence of data is to provide the converged data to an external entity as there are concerns about conflict of interests such as data abuse or misuse. In this regard, it has been suggested that this difficulty in performing self-convergence of data by a data specializing institution for its own use has been acting as an impediment to the promotion of data convergence.
(To be Improved) Data specializing institutions will be allowed to perform self-convergence of data for the purpose of its own use if the converged data is certified to be appropriate for its data pseudonymization in an objective manner through an appropriateness test conducted by another data specializing institution.
d) Perform qualification test on data specializing institutions periodically (3 years) (Article 28-3 of the Regulation)
(As of Now) In order to ensure seamless operation of data specializing institutions, it is necessary to periodically test the qualification of data specializing institutions after their designation but currently there is no such procedure in place.
(To be Improved) After their designation as data specializing institutions, the FSS will perform a qualification test every three years and report to the FSC.
II. Other Revised Measures
a) Expand the scope of data sharing on deceased persons (Attached Table 6 of the Regulation)
(As of Now) Currently, the Korea Credit Information Services (KCIS) shares information about loan customers who have been deceased with financial companies after confirming their deaths with the Ministry of Interior and Safety in order to prevent financial transactions under the names of deceased persons. However, as financial companies currently provide the KCIS with information on loan customers only, they are unable to check with the KCIS the death of customers who have used deposit services only. As such, there have been concerns about the possibility of deceased persons’ bank accounts being used as fake accounts for fraudulent activities and calls for sharing and making use of information about deposit-only customers as well.
(To be Improved) Financial companies will be allowed to share information about their deposit-only customers with the KCIS for the purpose of receiving information on the death of their deposit-only customers.
b) Make the duty of issuing advance notification more reasonable when sharing disadvantageous information (Article 40-4 of the Regulation)
(As of Now) When financial companies provide their customer information on overdue payments, etc. to the KCIC or credit bureaus, financial companies are required to issue advance notification to data subjects seven days prior to providing such information. However, due to the limit in advance notification delivery options (can choose one of the following options—via writing, telephone, email or text message), the function of issuing advance notification has remained rather difficult.
(To be Improved) Financial companies will have an additional option of issuing advance notification through smartphone applications.
Application for Preliminary Designation of Data Specializing Institutions
The FSC will accept applications for the preliminary designation of data specializing institutions on Monday, July 11. As previously announced in February this year, the registration of preliminary designation applications for data specializing institutions this time will take place for those that have already submitted preliminary applications. Among the entities that have submitted their preliminary applications in February, those that wish to proceed for preliminary designation should submit preliminary designation applications by 10:00 am (Korea Standard Time) on July 11.
Further Plan
The revision proposal for the supervisory regulation of credit information business approved at today’s FSC meeting is expected to go into effect on the day of announcement on July 7, 2022.
Preliminary designation of data specializing institutions will be decided at an FSC meeting in the second half of 2022 after a review of applications (submitted on July 11) for preliminary designation by an external review committee of the Financial Supervisory Service.