NongHyup's Poor Management of 19 Million Cases of 'Personal Credit Information'

FSS Imposes 30 Million KRW Fine and 'Warning' Sanction on Related Executives
Violation of 'Separate Storage Obligation' for Information After Termination of Commercial Relationship
Failure to Comply with Obligation to Retain Records of Anonymization Measures for Personal Credit Information

NongHyup Central Association Building Exterior

The National Agricultural Cooperative Federation (Nonghyup) has been found to have retained over 19.55 million pieces of personal credit information past their retention period without deletion. Additionally, it was confirmed that Nonghyup violated related regulations by failing to separate and store over 19.64 million pieces of customer personal credit information, whose commercial relationships had ended, from those of customers whose commercial relationships had not ended.

According to the Financial Supervisory Service (FSS) on the 10th, the Small and Medium Finance Inspection Division 2 uncovered these regulatory violations during an inspection of Nonghyup. Based on these inspection findings, the FSS imposed a fine of 30 million KRW on Nonghyup and issued a 'warning' to one related executive. Furthermore, two additional executives received disciplinary actions equivalent to warnings for 'retired personnel violations and improper matters.'

The inspection revealed that Nonghyup had managed personal credit information of commercial customers in a significantly negligent manner. Under the current Credit Information Act, providers and users of credit information must delete such personal credit information within five years from the date the commercial relationship, such as a financial transaction, ends. An exception allows retention for up to ten years only if certain obligations under the Commercial Act must be fulfilled.

However, from November 24, 2018, to April 28, 2023, Nonghyup failed to delete 19,556,276 pieces of personal credit information despite the five-year retention period having elapsed since the end of the commercial relationship or the ten-year retention period required to fulfill obligations under the Commercial Act.

Nonghyup also violated regulations requiring the separate storage of large volumes of personal credit information for which the commercial relationship has ended. According to Article 20 of the Credit Information Act, providers and users of credit information must manage such personal credit information safely according to regulations prescribed by Presidential Decree, until the legally prescribed retention period expires. The Presidential Decree mandates that personal credit information essential for establishing and maintaining commercial relationships must be managed separately from information of customers whose commercial relationships have not ended.

The FSS inspection confirmed that from November 24, 2018, to April 28, 2023, Nonghyup did not separately store 19,646,188 pieces of personal credit information necessary for establishing and maintaining commercial relationships, mixing them with information of customers whose commercial relationships had not ended.

Seoul Yeouido Financial Supervisory Service building. Photo by Heo Younghan younghan@

Moreover, Nonghyup failed to fulfill its obligation to retain records of anonymization measures applied to personal credit information. Article 40 of the Credit Information Act requires institutions handling personal credit information to retain records of anonymization measures?including the date of anonymization, information items, reasons, and grounds?for three years.

Nevertheless, from April 21, 2022, to March 28, 2023, Nonghyup anonymized credit and economic business usage data of cooperative customers containing customer numbers by integrating data by cooperative and customer and then deleting customer numbers before aggregation. While allowing two affiliated companies to access the anonymized data through a big data analysis platform, Nonghyup failed to create and retain records of these anonymization measures.

Meanwhile, based on these violations of laws and enforcement decrees, the FSS imposed institutional and executive sanctions and additionally issued one 'self-correction required' disciplinary action against related staff members.

This content was produced with the assistance of AI translation services.