An Era Opens for Combining Heterogeneous Data to Innovate Industries

Amendment to the Enforcement Decree of the Credit Information Act Passed at the Cabinet Meeting
Enabling Various Data Combinations Such as 'Insurance + Bio'

Reference Image

[Asia Economy Reporter Kim Hyo-jin] Starting next month, data held by financial companies and general enterprises can be combined and utilized.

The Financial Services Commission announced that the amendment to the Enforcement Decree of the Credit Information Protection Act (Credit Information Act), which includes this content, passed the Cabinet meeting on the 28th. The amendment will take effect from the 5th of next month, when the amended three data laws (Personal Information Protection Act, Credit Information Act, and Information and Communications Network Act) come into force.

The amendment allows data from financial companies and general enterprises to be combined through designated data specialized institutions under the Credit Information Act.

The financial authorities expect that enabling data combination across different industries will accelerate innovative growth through industrial convergence.

For example, combining location information with manufacturing data can be applied in fields such as autonomous vehicles, smart factories, and the Internet of Things (IoT), and combining insurance information with bio information can be applied to the smart healthcare industry.

However, the amendment requires that applications for data combination be submitted according to the format prescribed by the financial authorities, and identification values included in the data, such as phone numbers, must be replaced with a 'combination key' used for the combination.

Additionally, if personal credit information is included, it must be pseudonymized or anonymized, and measures such as encryption must be taken.

After data combination, the combination key used must be deleted or converted to a substitute key. The amendment stipulates that after delivering the combined data to the requesting institution, both the combined data and the original data must be immediately deleted.

The amendment also allows data subjects to request that their personal credit information held by financial companies, telecommunications operators, or public institutions be transmitted to MyData operators or financial companies.

This includes financial transaction information, national and local tax information, four major social insurance premiums, and telecommunications fee payment information. General personal information such as shopping information held by IT companies like Naver is excluded.

According to the amendment, regulations on entry into the credit information business (CB) will be eased. Previously, a minimum capital of 5 billion KRW and 10 specialized personnel were required, but going forward, the licensing units will be subdivided into individual CB, individual non-financial specialized CB, individual business CB, and corporate CB (corporate rating provision, technology credit evaluation, information inquiry business), with differentiated regulations.

Even when conducting multiple credit inquiry businesses, only up to 10 specialized personnel are required, and professionals such as engineers and patent attorneys will also be included as specialized personnel.

A 'profiling response right' will also be introduced, allowing individuals to request explanations and raise objections regarding automated credit evaluation results or loan rejections by credit inquiry companies.

Financial companies must inspect information management and protection status at least once a year, report the results to representatives and the board of directors, and submit them to the Financial Services Commission.

The Financial Services Commission plans to distribute the 'Financial Sector Personal Information Protection Guidelines' and the 'Financial Sector Pseudonymization and Anonymization Guide' next month to assist safe data processing.

This content was produced with the assistance of AI translation services.