Customer Credit Information Leaked in Affiliate Reports... Court Rules "Fines Must Be Canceled"

Violation of Law Acknowledged

Yonhap News

The court has ruled that while the savings banks did violate the law by sharing customer credit information without authorization during inter-affiliate work support processes, the fines imposed by the financial authorities were excessive and the penalties should be canceled.

According to the legal community on April 13, the Seoul Administrative Court's Administrative Division 3 (presiding judge Choi Sujin) ruled in favor of the plaintiffs last February in a lawsuit filed by A and B Savings Banks, affiliates of Taekwang Group, seeking to cancel the fine imposed by the Financial Services Commission.

A and B Savings Banks had received work support through a “council” operated by dispatched staff from group affiliates since 2014. In the course of this, between December 2019 and November 2021, A Savings Bank provided 77 pieces of personal credit information belonging to 63 customers to employees of related-party companies without the customers’ consent. Similarly, from April 2018 to November 2021, B Savings Bank transferred 71 pieces of information regarding 71 customers to a lawyer affiliated with a related company for the purpose of loan agreement legal review.

The Financial Services Commission determined that these actions constituted “provision of information to third parties without prior consent” under the Credit Information Act. Accordingly, in December 2024, it imposed fines of 1,034 million won on A Savings Bank and 948 million won on B Savings Bank, respectively.

The savings banks argued in the lawsuit that the information was provided solely for legal consultation purposes and was not used in determining individuals’ creditworthiness, and therefore did not constitute “personal credit information” under the Credit Information Act.

The court acknowledged that the savings banks had violated the law. The court noted, “If the objective nature of the information is such that it is necessary for credit assessment, it must be considered personal credit information regardless of the intended use,” adding, “Since the plaintiffs did not follow legal procedures such as entering into an outsourcing contract or reporting to the Financial Services Commission, these cases cannot be considered as outsourcing of personal information processing.”

However, the court found the financial authorities’ decision regarding the amount of the fines to be unlawful. The court cited the following reasons: the primary purpose of providing the information was for internal legal consultation; there was no evidence that a fee was received for providing the information or that customers suffered substantial secondary harm; and there was no clear precedent at the time regarding provision to third parties and outsourcing of personal credit information.

This content was produced with the assistance of AI translation services.