CREDIT INFORMATION USE AND PROTECTION ACT

영문법령 불러오는 중…

CREDIT INFORMATION USE AND PROTECTION ACT — 법갈피

Article 5(Those qualified for permission for credit information business) #

(1) A person eligible to obtain permission for a personal credit rating business, credit investigation business, or claims collection business shall be limited to the following persons; provided, this shall not apply to a personal credit rating business (hereinafter referred to as "specialized personal credit rating business") that processes information, other than personal credit information on financial transactions prescribed by Presidential Decree and personal credit information intensively managed and used by a centralized credit information collection agency: <Amended on Apr. 5, 2010; Mar. 29, 2016; Feb. 4, 2020>

1. A corporation, at least 50/100 of the capital of which is invested by financial institutions, etc. prescribed by Presidential Decree;

2. The Korea Credit Guarantee Fund established pursuant to the Credit Guarantee Fund Act;

3. The Korea Technology Finance Corporation established pursuant to the Korea Technology Finance Corporation Act;

4. A credit guarantee foundation established pursuant to the Regional Credit Guarantee Foundation Act;

5. The Korea Trade Insurance Corporation established pursuant the Trade Insurance Act;

6. A corporation, at least 50/100 of the capital of which is invested by a person who has obtained permission for all or some of a credit information business or claims collection business; provided, cases where an investor engages in the same kind of business as the corporation invested, shall be excluded.

(2) Any of the following persons shall be eligible to obtain permission for a sole proprietor credit rating business: <Added on Feb. 4, 2020>

1. A personal credit rating company (excluding a specialized personal credit rating company);

2. A corporate credit inquiry company engaged in providing corporate credit ratings;

3. A credit card business operator under the Specialized Credit Finance Business Act;

4. A person provided in paragraph (1) 1;

5. A person provided in paragraph (1) 6.

(3) Any of the following persons shall be eligible for obtaining permission for a corporate credit inquiry business; provided, a person who intends to engage in the business affairs of providing corporate credit ratings or technology credit ratings shall be limited to a person falling under subparagraph 1, 2, or 4: <Added on Feb. 4, 2020>

1. A person provided in paragraph (1) 1;

2. A person provided in paragraph (1) 2 through 6;

3. A stock company established under the Commercial Act;

4. Corporations prescribed by Presidential Decree in consideration of the characteristics of the business affairs of providing technology credit ratings, the purpose of incorporation, etc.

(4) Notwithstanding paragraph (3), none of the following persons shall be eligible to obtain permission for business affairs under subparagraph 8-3 (b) and (c) of Article 2: <Added on Feb. 4, 2020; Dec. 29, 2020>

1. A corporation in which a member company of a business group subject to disclosure and business group subject to limitations on cross shareholding prescribed in Article 31 (1) of the Monopoly Regulation and Fair Trade Act has invested in excess of 10/100;

2. A corporation in which a person under Article 9 (17) 3-2 of the Financial Investment Services and Capital Markets Act (hereafter referred to as "credit rating company" in this Article) or a company engaged in a business similar to a credit rating company in a foreign country has invested in excess of 10/100;

3. A corporation, the largest shareholder of which is a company provided in subparagraph 1 or 2.

[Title Amended on Feb. 4, 2020]

Article 6(Requirements for permission) #

(1) Any person who intends to obtain permission for a credit information business, MyData business, or claims collection business shall meet the following requirements: <Amended on Feb. 4, 2020>

1. He or she shall have human resources and physical facilities, including computer equipment, sufficient to engage in a credit information business, MyData business, or claims collection business;

1-2. Where a person intends to engage in a sole proprietor credit rating business: At least five billion won;

1-3. Where a person intends to engage in a corporate credit inquiry business: At least the amount classified as follows for each business unit provided in the items of subparagraph 8-3 of Article 2:

(a) Business affairs of corporate information inquiry: 500 million won;

(b) Business affairs of providing corporate credit ratings: Two billion won;

1-4. Where a person intends to engage in a MyData business: At least 500 million won;

2. He or she shall have reasonable and sound business plans;

3. Large shareholders shall have sufficient investment capacity, sound financial standing, and social credibility;

3-2. His or her executive officers shall satisfy the requirements provided in Article 22 (1) and (2), 22-8 or 27 (1);

4. He or she shall have a sufficient level of expertise to perform a credit information business, MyData business, or claims collection business.

(2) Any person who intends to obtain permission to engage in a credit information business, MyData business, or claims collection business shall have capital or original properties in accordance with the following classifications: <Amended on May 28, 2013; Feb. 4, 2020>

1. He or she intends to engage in a personal credit rating business: At least five billion won; provided,, where he or she intends to engage only in a specialized personal credit rating business, his or her capital or original properties shall be at least the amounts assigned according to the following classifications;

(a) Where each of the following credit information providers or users intends to engage in a personal credit rating business which processes personal credit information on details of transactions collected or created in return for goods or service provided to a credit data subject: 2 billion won:

(i) A telecommunications business operator defined in the Telecommunications Business Act;

(ii) The Korea Electric Power Corporation incorporated under the Korea Electric Power Corporation Act;

(iii) The Korea Water Resources Corporation under the Korea Water Resources Corporation Act;

(iv) A credit information provider or user similar to those provided in (i) through (iii) and is prescribed by Presidential Decree;

(b) Where the person intends to operate a personal credit rating business that processes information other than personal credit information provided in item (a): 500 million won;

2. Not more than five billion won, but not less than the amount prescribed by Presidential Decree, where he or she intends to engage in credit investigation business and claims collection business, separately or jointly.

(3) Matters necessary for detailed requirements for obtaining permission under paragraph (1) shall be prescribed by Presidential Decree.

(4) Credit information companies, MyData companies, and claims collection companies shall continue to satisfy the requirements set forth in paragraph (1) 1 while conducting the relevant business. <Amended on Feb. 4, 2020>

Article 9(Approval for change in large shareholders) #

(1) A person, who intends to become a large shareholder (in cases of the largest shareholder, including shareholders in a special relationship with the largest shareholder; and where the largest shareholder is a corporation, including persons prescribed by Presidential Decree, who exercise de facto control over important managerial matters of the corporation; hereafter in this Article the same shall apply) in a credit information company, MyData company, or claims collection agency by acquiring or taking over (referring to acquiring de facto control over the relevant shares; hereinafter referred to as "acquisition, etc.") shares issued by the company, shall obtain approval from the Financial Services Commission after meeting requirements prescribed by Presidential Decree, such as not violating the Punishment of Tax Offenses Act or statutes prescribed by Presidential Decree in connection with finance, for purposes of sound management: Provided that this shall not apply to persons, such as the State and public institutions provided in Article 4 of the Act on the Management of Public Institutions, who are unlikely to disrupt a sound financial order.

(2) When the acquisition, etc. of shares under paragraph (1) is due to the death of an existing large shareholder or other reasons prescribed by Presidential Decree, he or she shall file an application for approval with the Financial Services Commission within a specified period prescribed by Presidential Decree not exceeding three months.

(3) The Financial Services Commission may order the disposal of shares obtained through acquisition, etc. without approval under paragraph (1) or those for which an application for approval has not been filed after acquisition, etc. thereof within a specified period not exceeding six months.

(4) A person who fails to obtain approval under paragraph (1) or a person who fails to apply for approval under paragraph (2) may not exercising voting rights on the shares obtained through acquisition, etc. without approval or those for which an application for approval after acquisition, etc. has not been filed.

(5) Details necessary for methods of and procedures for the matters under paragraphs (1) through (3) shall be prescribed by Presidential Decree.

[This Article Wholly Amended on Feb. 4, 2020]

Article 9-2(Qualification examination of largest shareholder) #

(1) The Financial Services Commission shall examine whether the largest investor (referring to the largest investor among the largest shareholders of a corporation, if the largest investor is a corporation; and if the largest investor selected is also a corporation, one private individual shall be selected as the largest investor by applying the same method repeatedly until a private individual is selected; provided, the largest investor specified by Presidential Decree among the largest shareholders of a corporation shall be deemed the largest investor of the corporation, if the corporation is involved in circular share-holding among corporations; hereafter referred to as "person subject to examination on eligibility") from among the largest shareholders of a financial company (limited to a financial company subject to the application of Article 31 (1); the same shall apply hereafter in this Article) does not violate the Monopoly Regulation and Fair Trade Act, the Punishment of Tax Evaders Act, or any finance-related statute specified by Presidential Decree, and whether the largest investor meets the requirements prescribed by Presidential Decree (hereafter referred to as "requirements for maintaining eligibility"), from among requirements for approval of changes, at an interval prescribed by Presidential Decree.

(2) When a financial company becomes aware that an event has occurred to make the person subject to examination on eligibility cease to meet the requirements for maintaining eligibility in respect to the financial company, it shall report such fact to the Financial Services Commission, without delay.

(3) If the Financial Services Commission finds it necessary for the examination under paragraph (1), it may request a financial company or a person subject to examination on eligibility to provide necessary data or information.

(4) If the Financial Services Commission finds, as a result of the examination under paragraph (1), that a person subject to examination on eligibility fails to meet the requirements for maintaining eligibility, it may order the person to take all or some of the following measures to secure soundness in the management of the relevant financial company within a specified period not exceeding six months:

1. Measures to meet the requirements for maintaining eligibility;

2. Measures for preventing a conflict of interest, including restrictions on transactions with the person subject to examination on eligibility;

3. Other measures prescribed by Presidential Decree as measures deemed necessary for soundness in the management of a financial company.

(5) If the Financial Services Commission finds, as a result of the examination under paragraph (1), that a person subject to examination on eligibility falls under either of the following subparagraphs and that it is impracticable to maintain sound financial order and the soundness of the relevant financial company in view of the degree of the violation of a statute, it may order the person subject to examination on eligibility not to exercise his or her voting right for at least 10/100 of the total number of outstanding voting shares of the financial company (referring to shares held by a corporation, out of outstanding voting shares of the relevant financial company, if the largest investor is a corporation), during the period specified by Presidential Decree within the maximum of five years, out of shares held by the person subject to examination of qualifications:

1. Where a sentence of imprisonment without labor for at least one year or any heavier punishment imposed upon the person subject to examination of qualifications for a violation of any of the statutes specified in paragraph (1) has become final and conclusive;

2. Any other case prescribed by Presidential Decree for maintaining sound financial order.

(6) Notwithstanding Article 38 of the Criminal Act, a crime committed by a person in violation of any of the statutes specified in paragraph (1) and another crime concurrently committed by the person shall be separately examined, and sentences for such crimes shall be pronounced separately.

(7) Details necessary for methods of and procedures for the matters under paragraphs (1) through (3) shall be prescribed by Presidential Decree.

[This Article Added on Feb. 4, 2020]

Article 10(Authorization of transfer or acquisition by transfer) #

(1) Where a credit information company, MyData company, or a claims collection agency intends to wholly or partially transfer, take over, or divide its business, or merge with another corporation (including division and merger under Article 530-2 of the Commercial Act; hereinafter the same shall apply), it shall obtain authorization from the Financial Services Commission, as prescribed by Presidential Decree. <Amended on Feb. 4, 2020>

(2) Where a credit information company, MyData company, or claims collection agency transfers or divides its business or merges with another corporation under authorization in accordance with paragraph (1), a transferee or a surviving or resulting corporation following merger or consolidation (except for cases where a credit information company, MyData company, or claims collection agency, which is a corporation, merges with another corporation which is not a MyData company or claims collection agency) shall succeed to the status of the transferor or the corporation before merger or division, as a credit information company, MyData company, or claims collection agency. In such cases, permission granted to the credit information company, MyData company, or claims collection agency existed prior to such event shall become null and void (in cases of the partial transfer or division under paragraph (1), it applies only to the transferred or divided business). <Amended on Feb. 4, 2020>

(3) The provisions of Articles 5, 6, 22, 22-8, and 27 (1) through (7) shall apply mutatis mutandis to the transferee or a surviving or resulting corporation following merger or consolidation. <Amended on May 28, 2013; Feb. 4, 2020>

(4) Where a credit information company, MyData company, or claims collection agency intends to temporarily suspend or close all or some of its business, it shall file a prior report with the Financial Services Commission, as prescribed by Prime Ministerial Decree. <Amended on Feb. 4, 2020>

(5) The Financial Services Commission shall review the details of the prior report under paragraph (4) and accept it if the Commission deems the report complies with this Act. <Added on Dec. 31, 2018>

[Title Amended on Feb. 4, 2020]

Article 11(Concurrent business) #

(1) A credit information company, MyData company, or claims collection agency may concurrently perform business affairs (hereinafter referred to as "concurrent business affairs") which are unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order after filing a prior report with the Financial Services Commission, as prescribed by Prime Ministerial Decree. In such cases, any concurrent business affairs, which require authorization, permission, registration, approval, etc. of an administrative agency in accordance with any applicable individual statute, may be subject to prior authorization, permission, registration, approval, etc. in accordance with such individual statute: <Amended on May 28, 2013; Mar. 11, 2015; Feb. 4, 2020>

1. Deleted; <Feb. 4, 2020>

2. Deleted; <Feb. 4, 2020>

3. Deleted; <Feb. 4, 2020>

4. Deleted. <Feb. 4, 2020>

(2) Concurrent business affairs of a personal credit rating company shall be as follows: <Amended on Feb. 4, 2020>

1. Credit information business other than personal credit rating business;

2. Claims collection business;

3. Business affairs of an identification service agency under Article 23-3 of the Act on Promotion of Information and Communications Network Utilization and Information Protection;

4. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(3) Concurrent business affairs of a sole proprietor credit rating company shall be as follows. <Added on Feb. 4, 2020>

1. Credit information business other than the sole proprietor credit rating business;

2. Claims collection business;

3. Business affairs of an identification service agency under Article 23-3 of the Act on Promotion of Information and Communications Network Utilization and Information Protection;

4. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(4) Concurrent business affairs of a corporate credit inquiry company shall be as follows. <Added on Feb. 4, 2020>

1. Credit information business other than corporate credit inquiry business;

2. Claims collection business;

3. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(5) Concurrent business affairs of a corporate credit inquiry company shall be as follows: <Added on Feb. 4, 2020>

1. Credit information business other than credit investigation business:

2. Business affairs of managing securitization assets under Article 10 of the Asset-Backed Securitization Act;

3. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(3) Concurrent business affairs of a MyData company shall be as follows: <Added on Feb. 4, 2020>

1. Investment advisory business or discretionary investment business (limited to cases which are unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order and are prescribed by Presidential Decree) under Article 6 (1) 4 or 5 of the Financial Investment Services and Capital Markets Act;

2. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(3) Concurrent business affairs of a claims collection agency shall be as follows: <Added on Feb. 4, 2020>

1. Credit information business;

2. Business affairs of managing securitization assets under Article 10 of the Asset-Backed Securitization Act;

3. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(8) The Financial Services Commission shall review the details of the prior report filed under the former part, with the exception of the subparagraphs, of paragraph (1) and accept it if it deems the report complies with this Act. <Added on Dec. 31, 2018; Feb. 4, 2020>

[Title Amended on Feb. 4, 2020]

Article 11-2(Incidental business) #

(1) A credit information company, MyData company, or claims collection agency may perform business affairs incidental to the business affairs it has obtained the relevant permission (hereinafter referred to as "incidental business affairs"). In such cases, a credit information company, MyData company, or claims collection agency shall file a report with the Financial Services Commission no later than seven days before the date it intends to commence its incidental business affairs.

(2) Incidental business affairs of a personal credit rating company shall be as follows:

1. Providing a credit data subject with a newly generated personal credit score or other results of personal credit rating;

2. Providing personal credit information or the information processed therefrom to the credit data subject or a third party;

3. Using or providing pseudonymized or anonymized information;

4. Analyzing data and providing consultations based on personal credit information and other information;

5. Developing and selling computerized processing systems, solutions, and software (including a model for personal credit rating and risk management) related to personal credit information;

6. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(3) Incidental business affairs of a sole proprietor credit rating company shall be as follows:

1. Providing a sole proprietor with the newly-generated results of evaluating the credit standing of the sole proprietor;

2. Providing a sole proprietor or a third party with credit information about the sole proprietor or information processed therefrom;

3. Using or providing pseudonymized or anonymized information;

4. Analyzing data and providing consultations based on credit information and other information regarding sole proprietors;

5. Business affairs of developing and selling computerized processing systems, solutions, and software (including a model for assessing the credit standings, and managing risks, of sole proprietors) in connection with the credit information of sole proprietors.

(4) Incidental business affairs of a corporate credit inquiry company shall be as follows; provided, the incidental business affairs provided in subparagraph 1 shall be limited to corporate credit inquiry companies engaged in the business affairs of providing corporate credit ratings or providing technology credit ratings:

1. Providing the data subject or a third party with credit information on an enterprise or corporation or information processed therefrom;

2. Using or providing pseudonymized or anonymized information;

3. Analyzing data and providing consultations based on credit information and other information about enterprises and corporations;

4. Developing and selling computerized processing systems, solutions, and software (including a model for corporate credit ratings and risk management) related to credit information on enterprises and corporations;

5. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(5) Incidental affairs of a credit investigation company shall be as follows:

1. Business affairs of surveying the current status of lease of real estate and movable properties and values thereof;

2. Business affairs of surveying the current status of enterprises and places of business;

3. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(6) Incidental business affairs of a MyData company shall be as follows:

1. Analyzing data and providing consultations to the credit data subject based on his or her personal credit information provided to him or her;

2. Providing an account to the credit data subject to manage and use his or her personal credit information;

3. Exercising the rights set forth in the subparagraphs of Article 39-3 (1) on behalf of the credit data subject;

4. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(7) Incidental business affairs of a claims collection agency shall be as follows:

1. Business affairs of establishing and providing a claims management system for creditors, etc.;

2. Business affairs of issuing debt certificates defined in Article 5 of the Fair Debt Collection Practices Act under entrustment by persons prescribed by Presidential Decree;

3. Other business affairs prescribed by Presidential Decree as being unlikely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(8) Where matters regarding incidental business affairs reported under paragraph (1) fall under any of the following, the Financial Services Commission may order the restriction of such incidental business affairs or the correction thereof:

1. Where they undermine the soundness of business management of a credit information company, MyData company, or claims collection agency;

2. Other cases prescribed by Presidential Decree as necessary for protecting credit data subjects and maintaining the sound credit order.

(9) An order for restriction or correction provided in paragraph (8) shall be issued in a document specifying the details and grounds thereof.

[This Article Added on Feb. 4, 2020]

Article 14(Revocation of permission and suspension of business) #

(1) The Financial Services Commission may revoke permission or authorization of a credit information company, MyData company, or claims collection agency in any of the following cases; provided, if any ground prescribed by Presidential Decree exists, despite the fact that a credit information company, MyData company, or claims collection agency falls under any of the following subparagraphs, the Financial Services Commission may issue, prior to such revocation, an order for correction within a specified period not exceeding six months: <Amended on May 28, 2013; Mar. 11, 2015; Feb. 4, 2020; Apr. 20, 2021; Feb. 13, 2024>

1. Where it has obtained permission under Article 4 (2) or authorization under Article 10 (1) by fraud or other improper means;

2. Where it has violated the investment requirements of financial institutions, etc. under Article 5 (1) 1, Article 5 (2) 4, or Article 5 (3) 1; provided, this shall not apply if the shares of a credit information company or a claims collection company are listed on a securities market pursuant to Article 8-2 (4) 1 of the Act on Capital Markets and Financial Investment Business (provided, in the case of a personal credit rating company, a personal business credit rating company, or a corporate credit inquiry company, this shall only apply where financial institutions under Article 5 (1) 1 have invested 33 percent or more);

3. Deleted; <May 28, 2013>

4. Where the equity capital (referring to the sum of total assets less total liabilities on the statement of financial position as at the end of the latest business year; hereinafter the same shall apply) of a credit information company, MyData company, or claims collection agency [excluding cases where three business years (five years if a personal credit rating business, a sole proprietor credit rating business, and a corporate credit inquiry business are included) have not elapsed since the credit information company, MyData company, or claims collection agency obtained permission] falls short of the capital or original property requirements referred to in Article 6 (2);

5. Where it, which has violated an order to suspend business or committed a violation that constitutes grounds for business suspension, had been imposed a disposition to suspend practice within three years from the date when such grounds for business suspension occurred;

6. Where it provides a client with false information, in violation of Article 22-7 (1) 1;

6-2. Where it forces a request for investigation of credit information, in violation of Article 22-7 (1) 2;

6-3. Where it forces a person subject to investigation of credit information to provide investigation data and answers;

6-4. Where it investigates privacy or the like, other than commercial transaction relationships including financial transactions, in violation of Article 22-7 (1) 4;

7. Deleted; <May 28, 2013>

8. If it has performed claims collection service, in violation of any subparagraph of Article 9 of the Fair Debt Collection Practices Act (applicable only to claims collection business);

9. If it has violated any of the terms or conditions of permission or authorization;

10. If it has failed to perform the permitted operations for at least one year consecutively without good cause;

11. If it has performed claims collection service, in violation of Article 41 (1) (applicable only to claims collection business).

(2) The Financial Services Commission may issue an order to fully or partially suspend business within a specified period not exceeding six months, if a credit information company, MyData company, or claims collection agency falls under any of the following subparagraphs: <Amended on May 28, 2013; Mar. 11, 2015; Dec. 31, 2018; Feb. 4, 2020>

1. If it has violated Article 6 (4);

2. If it has violated Article 11 or 11-2;

3. Deleted; <Feb. 4, 2020>

4. If any credit information has been lost, stolen, disclosed, altered or compromised, in violation of Article 17 (4) or 19;

5. If it has violated Articles 22 (1) and (2), 22-8, and 27 (1);

5-2. Where it collects credit information in violation of Article 22-9 (3) or transmits any personal credit information in violation of paragraph (4) of that Article;

5-3. It violates Article 33 (2);

6. Deleted; <Feb. 4, 2020>

7. If it has violated subparagraph 5 of Article 40;

8. If it has violated Article 42 (1), (3), or (4);

9. If a case constitutes grounds for a disposition provided for in Appendix;

10. If it has performed claims collection service, in violation of subparagraphs 2 and 5 of Article 12 of the Fair Debt Collection Practices Act (applicable only to claims collection business);

11. Any other case where it has violated any other statute or the articles of incorporation, or its management is unsound so that it will or is likely to severely harm public interests.

Article 17(Entrustment of processing) #

(1) A credit information company, etc. may entrust a third party with the business affairs of processing credit information. In such cases, Article 26 (1) through (3) of the Personal Information Protection Act shall apply mutatis mutandis to the entrusted processing of personal credit information. <Amended on Feb. 4, 2020>

(2) A credit information company, etc. may entrust the processing of credit information; and Articles 19 through 21, 22-4 through 22-7, 22-9, 40, 43, 43-2, 45, 45-2, and 45-3 (including penalty provisions and provisions regarding administrative fines in relation to such Articles) shall apply mutatis mutandis to the processing of entrusted business affairs by the entrusted person (hereinafter referred to as "trustee"). <Amended on Mar. 11, 2015; Feb. 4, 2020>

(3) A credit information company, etc. prescribed by Presidential Decree, which intends to entrust the processing of credit information under paragraph (2), shall notify the Financial Services Commission of the scope of the credit information provided, etc., as prescribed by Presidential Decree.

(4) In providing any personal credit information to an agent in order to entrust the processing of credit information under paragraph (2), a credit information company, etc. shall take measures to protect information that can uniquely identify an individual, such as encryption, as prescribed by Presidential Decree. <Added on Mar. 11, 2015>

(5) Where a credit information company, etc. has provided any credit information to a trustee, it shall educate the trustee as prescribed by Presidential Decree to prevent the credit information from being lost, stolen, disclosed, altered, or compromised and reflect matters for the safe processing of credit information by the trustee in the entrustment contract. <Added on Mar. 11, 2015; Feb. 4, 2020>

(6) Where the trustee uses personal credit information or provides it to a third party, Article 26 (5) of the Personal Information Protection Act shall apply. <Amended on Feb. 4, 2020>

(7) No agent shall further outsource any of the duties under paragraph (2) to any third party; provided, this shall not apply where the Financial Services Commission acknowledges within the scope not compromising the protection and safe processing of credit information. <Added on Mar. 11, 2015>

[Title Amended on Feb. 4, 2020]

Article 20(Clarification of accountability of credit information management and archiving of business processing records) #

(1) A credit information company, etc. shall comply with the standards for management of credit information determined by the Financial Services Commission with regard to collection, processing, use, protection, etc. of credit information. <Amended on Mar. 11, 2015>

(2) A credit information company, etc. shall retain the records concerning the following matters for three years according to the following classifications: <Amended on Feb. 4, 2020>

1. Where it collects or uses personal credit information:

(a) The date of collection and use;

(b) Items of information collected and used;

2. Where it provides or is provided with personal credit information:

(a) The date of provision or receipt;

(b) Items of information it provides or is provided with;

3. Where it destroys personal credit information:

(a) The date of destruction;

(b) Items of information destroyed;

4. Other matters prescribed by Presidential Decree.

(3) A credit information company, a MyData company, a claims collection agency, a credit information collection agency, and a credit information provider or user prescribed by Presidential Decree shall appoint at least one credit information administrator or guardian to perform the tasks prescribed in paragraph (4); provided, a person prescribed by Presidential Decree in consideration of total assets, the number of employees, etc. shall appoint a credit information administrator or guardian as his or her executive officer (including persons who hold a position that has general supervision and control of the management and protection of credit information, as prescribed by Presidential Decree). <Amended on Mar. 11, 2015; Feb. 4, 2020>

(4) A credit information administrator or guardian under paragraph (3) shall perform the following duties: <Added on Mar. 11, 2015; Feb. 4, 2020; Mar. 14, 2023>

1. The following duties in cases of personal credit information:

(a) Duties referred to in Article 31 (3) 1 through 5 of the Personal Information Protection Act;

(b) Inspection for compliance with the statutes and regulations related to the protection of credit information by its executive officers and employees, exclusive solicitors, etc.;

2. Regular inspection and improvement of the status and practice of the management of credit information, such as the collection, keeping, provision, and deletion thereof;

(a) Formulation and implementation of plans for the management and protection of credit information, such as the collection, keeping, provision, and deletion thereof;

(b) Regular inspection and improvement of the status and practice of the management of credit information, such as the collection, keeping, provision, and deletion thereof;

(c) Exercise of rights of credit data subjects, such as the access to and the request for correction of credit information, and damage relief;

(d) Establishment and operation of internal control system to prevent disclosure, etc. of credit information;

(e) Formulation and execution of a plan to protect credit information for its executive officers and employees, exclusive solicitors, etc.;

(f) Inspection for compliance with the statutes and regulations related to the protection of credit information by its executive officers and employees, exclusive solicitors, etc.;

(g) Other duties prescribed by Presidential Decree to manage and protect credit information;

3. Deleted; <Feb. 4, 2020>

4. Deleted. <Feb. 4, 2020>

5. Deleted; <Feb. 4, 2020>

6. Deleted; <Feb. 4, 2020>

7. Deleted. <Feb. 4, 2020>

(5) Article 31 (4) and (6) of the Personal Information Protection Act shall apply mutatis mutandis to the performance of the duties of a credit information administrator or guardian. <Amended on Feb. 4, 2020; Mar. 14, 2023>

(6) A credit information administrator or guardian of a credit information company, etc. shall regularly inspect the status of the management and protection of personal credit information processed by the credit information company, etc. in accordance with the procedures and methods prescribed by Presidential Decree and shall report the inspection results to the Financial Services Commission. <Added on Feb. 4, 2020>

(7) Qualifications for credit information administrators or guardians and other matters necessary for designation under paragraph (3) and methods of submission under paragraph (6) shall be prescribed by Presidential Decree. <Amended on Mar. 11, 2015; Feb. 4, 2020>

(8) Where a customer information officer appointed in accordance with Article 48-2 (6) of the Financial Holding Companies Act, meets the qualifications set forth in paragraph (6), he or she shall be deemed a credit information administrator or guardian designated under paragraph (3). <Amended on Mar. 11, 2015; Feb. 4, 2020>

Article 20-2(Retention period for personal credit information) #

(1) A credit information provider or user shall manage personal credit information of a credit data subject as prescribed by Presidential Decree, including ensuring the right to access thereto, in such a manner that the personal credit information of the relevant credit data subject can be safely protected from the date a commercial transaction relationship including financial transactions (excluding employment relationship; hereinafter the same shall apply) is terminated until the time limit determined and publicly notified by the Financial Services Commission.

(2) Notwithstanding Article 21 (1) of the Personal Information Protection Act, a credit information provider or user shall delete personal credit information of the relevant credit data subject from the management list within a maximum five year period from the date a commercial transaction relationship including financial transactions is terminated (where the purpose of the collection, provision, etc. of information is achieved before the lapse of the relevant period, within three months from the date such purpose is achieved); provided, this shall not apply in any of the following cases: <Amended on Feb. 4, 2020>

1. Where it is essential for performing any obligation under this Act or any other statute;

2. Where deemed necessary for the exigent interests of an individual's life, body, or property;

2-2. When a pseudonymized information is used and retained for a period prescribed by Presidential Decree in consideration of the purpose of use, technical features of pseudonymization, the attributes of information, etc.;

3. Any of the following cases, as prescribed by Presidential Decree:

(a) For the payment of deposits and insurance proceeds:

(b) For preventing insurance fraudsters from repurchasing insurance;

(c) Where it is necessary to retain personal credit information due to the characteristics of the technology used to process personal credit information;

(d) Cases similar to those provided in items (a) through (c) where it is necessary to retain personal credit information.

(3) Where a credit information provider or user keeps personal credit information without deletion under the proviso of paragraph (2), he or she shall manage it as prescribed by Presidential Decree, such as separating it from the personal credit information of credit data subjects with whom he or she currently deals.

(4) When a credit information provider or user utilizes any personal credit information he or she keeps separately under paragraph (3), he or she shall notify such fact to the credit data subject.

(5) Types of personal credit information, period of management, methods and procedures for deletion, the criterion of the date a commercial transaction relationship including financial transactions is terminated, etc. under paragraphs (1) and (2) shall be prescribed by Presidential Decree.

[This Article Added on Mar. 11, 2015]

Article 22(Qualifications of executive officers of credit information companies) #

(1) Article 5 of the Act on Corporate Governance of Financial Companies shall apply mutatis mutandis to the executive officers of personal credit rating companies, sole proprietor credit rating companies, and corporate credit inquiry companies.

(2) No credit inquiry company shall appoint or hire any of the following persons as its executive officers or employees:

1. A minor; provided, cases where he or she is appointed or hired for operations determined and publicly notified by the Financial Services Commission shall be excluded;

2. A person under adult guardianship or person under limited guardianship;

3. A person who has yet to be reinstated after having been declared bankrupt;

4. A person in whose case three years have not elapsed since the completion of, or exemption from, a sentence of imprisonment without labor, or heavier punishment, as so declared by a court (including cases where such execution is deemed to have been completed);

5. A person who is under a suspended sentence of imprisonment without labor or a heavier punishment as declared by a court;

6. A person who has been dismissed or discharged from office under this Act or other statutes or regulations, and for whom five years have not since passed;

7. A person who had worked as an executive officer or employee of a corporation or company, the business permission, authorization, etc. of which was revoked under this Act or other statutes or regulations, and for whom five years have not passed after such revocation (applicable only to a person prescribed by Presidential Decree, who is directly responsible for the grounds for such revocation or who is in the position equivalent thereto);

8. A person who is a retired executive officer or employee and is notified that he or she would have received a measure of recommendation of dismissal (including demand for dismissal) or demand for removal from office pursuant to this Act or other statutes if he or she held his or her official position or were under employment, and for whom five years (seven years from the date of his or her retirement where the date on which five years has passed from the date of notification is later than the date on which seven years have passed from the date of his or her retirement) have not yet passed from the date of such notification.

[This Article Wholly Amended on Feb. 4, 2020]

Article 22-5(Code of conduct of sole proprietor credit rating companies) #

(1) In assessing the credit standing of a sole proprietor, a sole proprietor credit rating company shall comply with the following:

1. It shall also consider information that can advantage the sole proprietor in the assessment, in addition to information that can disadvantage the sole proprietor in the assessment;

2. It shall not discriminate between persons who have a commercial transaction relationship, including financial transactions, with a sole proprietor credit rating company and persons without such relationship.

(2) No sole proprietor credit rating company shall engage in any of the following acts:

1. Forcing to purchase or use goods or services of the sole proprietor credit rating company or its affiliates in the course of assessing the credit standing of a sole proprietor;

2. Other activities prescribed by Presidential Decree, which are likely to undermine the protection of credit data subjects or sound credit order.

(3) A sole proprietor credit rating company shall establish internal control standards, which are standards and procedures to be complied with by its executive officers and employees in performing their duties, including the following; provided, a sole proprietor credit rating company that conducts a sole proprietor credit rating business pursuant to Article 11 (2) need not include subparagraph 1 in its internal control standards if it assesses the credit standing of a sole proprietor by means of automated evaluation:

1. Matters regarding the separation of an assessment organization and a sales organization;

2. Matters regarding the prevention of conflicts of interests;

3. Matters concerning prevention on unfair practices;

4. Matters regarding the standards for assessing the credit standing, which are suitable for the characteristics of sole proprietors;

5. Other matters necessary for internal control standards, as prescribed by Presidential Decree.

[This Article Added on Feb. 4, 2020]

Article 22-6(Business conduct standards for corporate credit rating inquiry companies) #

(1) Where a corporate credit rating inquiry company (excluding corporate credit inquiry companies engaged only in the business affairs of corporate information inquiry; hereafter in paragraphs (2) and (3) the same shall apply) assesses the credit standing of an enterprise or corporation, it shall take into consideration information that can advantage the relevant enterprise or corporation in assessment as well as information that can disadvantage it.

(2) No corporate credit inquiry company shall engage in any of the following acts:

1. Generating corporate credit ratings and technology credit information related to persons prescribed by Presidential Decree, who are in a special relationship with the corporate credit inquiry company, such as an investment relationship of at least a certain ratio;

2. Compelling to purchase or use goods or services of the corporate credit inquiry company or its affiliates in the course of generating corporate credit ratings and technology credit information;

3. Other activities prescribed by Presidential Decree, which are likely to undermine the protection of credit data subjects or to disrupt the sound credit order.

(2) A corporate credit inquiry company shall establish internal control standards which are appropriate standards and procedures to be complied with by its executive officers or employees in performing their duties (hereinafter referred to as "internal control standards"), including the following:

1. Matters regarding the separation of an assessment organization and a sales organization;

2. Matters regarding the prevention of conflicts of interests;

3. Matters concerning prevention on unfair practices;

4. Matters regarding the criteria for the creation of corporate credit ratings or the criteria for technical credit ratings suitable for the characteristics of enterprises and corporations;

5. Other matters necessary for internal control standards, as prescribed by Presidential Decree.

(4) A corporate credit inquiry company engaged in the business affairs of corporate credit inquiry shall formulate regulations on the management of users, as prescribed by Presidential Decree, for the management of users of credit information.

[This Article Added on Feb. 4, 2020]

Article 22-9(Code of conduct for mydata companies) #

(1) No MyData company shall engage in any of the following conducts:

1. Forcing an individual credit data subject to transmit his or her personal credit information or improperly inducing him or her to transmit such information;

2. Other activities prescribed by Presidential Decree, which are likely to undermine the protection of credit data subjects or sound credit order.

(2) A MyData company shall prepare internal control standards to prevent conflicts of interest that may arise between an individual credit data subject and a MyData company in the course of performing the business affairs provided in Articles 11 (6) and 11-2 (6) 3.

(3) No MyData company shall collect credit information to be provided to a credit data subject by using or retaining any of the following means in a manner prescribed by Presidential Decree:

1. A means of access defined in subparagraph 10 of Article 2 of the Electronic Financial Transactions Act, which is a means regarding a credit data subject, selected and used or managed by a credit information provider or user prescribed by Presidential Decree, a public institution prescribed by Presidential Decree under the Personal Information Protection Act (hereafter in this Article and Article 33-2 referred to as "credit information provider or user, etc."), or a MyData company;

2. Means prescribed by Presidential Decree, including the presentation of identification verifying the person in question or the use of a telephone or website as a means to verify the identity of the person in question.

(4) Where an individual credit data subject requests the transmission of his or her personal credit information to a MyData company, the credit information provider or user, etc. shall transmit the personal credit information of the individual credit data subject directly to such company by any method prescribed by Presidential Decree, which can ensure the safety and reliability of the provision of information.

(5) Notwithstanding paragraph (4), a credit information provider or user, etc. may transmit personal credit information to a MyData company through an intermediary agency prescribed by Presidential Decree, in cases prescribed by Presidential Decree in consideration of the size of the credit information provider or user, the frequency of commercial transactions, including financial transactions, etc.

(6) Where a credit information provider or user, etc. regularly transmits personal credit information pursuant to Article 33-2 (4), he or she may have the MyData company bear the minimum necessary expenses.

(7) The procedures and methods for transmission under paragraphs (4) and (5) and the standards for the calculation of expenses under paragraph (6) shall be prescribed by Presidential Decree.

[This Article Added on Feb. 4, 2020]

Article 23(Requests for provision of credit information of public institutions) #

(1) Deleted. <Mar. 11, 2015>

(2) Where a credit information collection agency requests the head of the State, a local government, or a public organization prescribed by Presidential Decree (hereinafter referred to as "public institution") to provide credit information prescribed by Presidential Decree, which is necessary to determine creditworthiness, credit transaction capacity, etc. of the credit data subject, the head of a public institution requested thereof may, notwithstanding the Acts set forth in the following subparagraphs, provide credit information for the requesting credit information collection agency. In such cases, the standards, procedures, etc. for the head of public institutions to provide information shall be prescribed by Presidential Decree: <Amended on Mar. 29, 2011; Mar. 11, 2015>

1. The Official Information Disclosure Act;

2. The Personal Information Protection Act;

3. The National Health Insurance Act;

4. The National Pension Act;

5. The Korea Electric Power Corporation Act;

6. The Resident Registration Act.

(3) A credit information collection agency may supply credit information provided by public institutions in accordance with paragraph (2) to any credit information user prescribed by Presidential Decree. <Amended on Mar. 11, 2015>

(4) Where a credit information collection agency or a credit information user referred to in paragraph (3) provides any personal credit information obtained from a public institution under paragraphs (2) and (3), the person who intends to be provided with the information shall verify whether the credit information provider or user has obtained consent from the relevant individual in relation to the provision and use of credit information thereof in accordance with Article 32 (3); provided, this shall not apply to cases falling under any of the subparagraphs of Article 32 (6). <Amended on Mar. 11, 2015; Feb. 4, 2020>

(5) A person provided with personal credit information in accordance with paragraph (4) shall provide it to any other person. <Amended on Mar. 11, 2015; Feb. 4, 2020>

(6) Any person who requests provision of credit information in accordance with paragraph (2) shall pay fees or commissions for access in accordance with relevant statutes or regulations. <Amended on Mar. 11, 2015>

(7) Where the head of a public institution requests, in writing, the provision of credit information to use it for official duties prescribed by related statutes, the credit information company, etc., upon request, may provide such credit information.

[Title Amended on Mar. 11, 2015]

Article 25(Credit information collection agency) #

(1) A person who intends to centrally collect and store credit information to manage it in a systematic and comprehensive manner and exchange and utilize credit information between credit information companies, etc. (hereinafter referred to as "central management and utilization") shall obtain permission for an information collection agency from the Financial Services Commission. <Amended on Mar. 11, 2015>

(2) A credit information collection agency under paragraph (1) shall obtain permission according to the following classifications: <Amended on Mar. 11, 2015>

1. A centralized credit information collection agency: A credit information collection agency that centrally manages and utilizes the credit information obtained from all financial institutions prescribed by Presidential Decree;

2. An individual credit information collection agency: A credit information collection agency that centrally manages and utilizes the credit information in accordance with agreements, etc. made by associations, etc. established by the same type of business owners other than financial institutions referred to in subparagraph 1.

(3) A person who intends to obtain permission for a credit information collection agency pursuant to paragraph (1), shall satisfy the following requirements: <Amended on Mar. 11, 2015>

1. It shall be a non-profit corporation incorporated under article 32 of the Civil Act;

2. It shall maintain the character of public nature and neutrality, as prescribed by Presidential Decree, in centrally managing and utilizing the credit information;

3. The facility, equipment, and human resources prescribed by Presidential Decree shall be furnished.

(4) Matters necessary to obtain permission under paragraphs (1) and (2) and the revocation thereof, the details and scope of credit information subject to central management and utilization, and the persons with whom credit information is to be exchanged shall be prescribed by Presidential Decree; provided, the exchange and use of credit information between a credit information collection agency and a personal credit rating company, sole proprietor credit rating agency, or corporate credit inquiry company (excluding corporate credit inquiry companies engaged only in the business affairs of corporate information inquiry) shall be conducted in such a manner that the credit information collection agency provides the personal credit rating company, sole proprietor credit rating agency, or corporate credit inquiry company (excluding corporate credit inquiry companies engaged only in the business affairs of corporate information inquiry) with credit information at the request of the latter. <Amended on Mar. 11, 2015; Feb. 4, 2020>

(5) The centralized credit information collection agency subject to paragraph (2) 1 (hereinafter referred to as "centralized credit information collection agency"), for the purpose of ensuring the accuracy and timeliness of credit information centrally collected, may investigate as to whether a financial institution duly performs its obligations to provide credit information, as prescribed by the Committee for Intensive Management of Credit information under Article 26. <Amended on Mar. 11, 2015>

(6) A credit information collection agency may establish a common computer network for credit information (hereinafter referred to as "Common Computer Network"), as prescribed by Presidential Decree, and any person who participates in the Common Computer Network shall provide cooperation to maintain and manage it. In such cases, a credit information collection agency shall be a telecommunication business owner under Article 2 (1) 1 of the Telecommunications Business Act.

Article 27(Persons engaged in claims collection business and delegated claims collectors) #

(1) A claims collection agency shall not appoint or hire any of the following persons, as its executive officers or employees, and nor shall it delegate, or conduct in a manner equivalent to delegation, the claims collection service to such person: <Amended on Apr. 18, 2017; Feb. 4, 2020>

1. A minor; provided, cases where he or she is appointed or hired for operations determined and publicly notified by the Financial Services Commission shall be excluded;

2. A person under adult guardianship or person under limited guardianship;

3. A person who has yet to be reinstated after having been declared bankrupt;

5. A person who is under a suspended sentence of imprisonment without labor or a heavier punishment as declared by a court;

6. A person who has been dismissed or discharged from office under this Act or other statutes, and for whom five years have not passed after such incident;

7. A person who had worked as an executive officer or employee of a corporation or company, permission, authorization, etc. of which was revoked under this Act or other statutes, and for whom five years have not passed after such revocation (applicable only to a person prescribed by Presidential Decree, who is directly responsible for the grounds for such revocation, or any person in the position equivalent thereto);

8. A person whose registration as a delegated claims collector under paragraph (2) 2 has been revoked, and for whom five years have not passed after such revocation;

9. A person who is a retired executive officer or employee notified that he or she would receive a measure of recommendation of dismissal (including demand for dismissal) or demand for removal from office pursuant to this Act or other statutes if he or she held his or her official position or were under employment, and for whom five years (seven years from the date of his or her retirement where the date on which five years has passed from the date of notification is later than the date on which seven years have passed from the date of his or her retirement) have not yet passed from the date of such notification.

(2) A claims collection agency shall perform its claims collection service through any of the following persons:

1. Any executive officer or employee of a claims collection agency;

2. A person who has been delegated, or allowed in such a manner equivalent to delegation, to render claims collection service by a claims collection agency (hereinafter referred to as "delegated claims collector").

(3) A claims collection agency shall register a person who intends to serve as its delegated claims collector, with the Financial Services Commission.

(4) No delegated claims collector shall render any claims collection service for a claims collection agency where he or she is not employed.

(5) A claims collection agency shall neither collect claims that are not subject to collection, nor render claims collection service through a delegated claims collector falling under any of the following subparagraphs:

1. A delegated claims collector who is not registered under paragraph (3);

2. A delegated claims collector who has been registered with another claims collection agency;

3. A delegated claims collector who is suspended from his or her business under paragraph (7).

(6) The Financial Services Commission may cancel the registration of delegated claims collectors, if they:

1. Have been registered under paragraph (3) in a fraudulent or any other unlawful means;

2. Have violated an order for practice suspension or committed a violation subject to practice suspension under paragraph (7), after having received a disposition of practice suspension within one year from the date such violation occurred;

3. Deleted; <Feb. 4, 2020>

4. Have performed claims collection activities, in violation of any subparagraph of Article 9 of the Fair Debt Collection Practices Act;

5. Have violated any term or condition of registration;

6. Have failed to perform the registered business continuously for at least one year without good cause.

(7) The Financial Services Commission may order to fully or partially suspend the business within a specified period not exceeding six months, if delegated claims collectors: <Amended on Feb. 4, 2020>

1. Have violated paragraph (4);

2. Deleted; <Feb. 4, 2020>

3. Have violated Article 40 (1) 5;

4. Have violated subparagraphs 2 and 5 of Article 12 of the Fair Debt Collection Practices Act;

5. Have violated other statutes or regulations or the articles of association of their claims collection agency to severely harm or be likely to harm public interests.

(8) Where executive officers and employees who engage in claims collection business or delegated claims collectors intend to render claims collection service, they shall carry identification verifying their engagement in claims collection business and present it to debtors or the relevant persons defined in the Fair Debt Collection Practices Act. <Amended on Feb. 4, 2020>

(9) A claims collection agency shall faithfully manage its delegated claims collectors, so that they may observe the statutes and may not impair the sound transaction order in performing the claims collection service. In such case, it shall ensure that they do not commit a violation as classified in the following: <Added on Nov. 28, 2017>

1. Act of violating Article 8-3 (1), 9, or 10 (1) or subparagraph 1 or 2 of Article 11 of the Fair Debt Collection Practices Act;

2. Act of violating Article 8-3 (2), subparagraph 3 through 5 of Article 11, Article 12, 13, or 13-2 (2) of the Fair Debt Collection Practices Act.

(10) The qualification requirements and registration procedures for delegated claims collectors shall be prescribed by Presidential Decree. <Amended on Nov. 28, 2017>

(11) A person intending to be a delegated claims collector shall, when applying for registration as such, pay the fee, as prescribed by Prime Ministerial Decree. <Amended on Nov. 28, 2017>

[Title Amended on Feb. 4, 2020]

Article 32(Consent to provision and use of personal credit information) #

(1) If a credit information provider or user intends to provide any personal credit information to any other person, he or she shall obtain individual consent in advance from the relevant credit data subject each time he or she intends to provide personal credit information by using the following methods, as prescribed by Presidential Decree; provided, this shall not apply where such information is provided to maintain the accuracy and currency of personal credit information within the agreed scope of the purpose or use: <Amended on Mar. 11, 2015; Dec. 11, 2018; Jun. 9, 2020>

1. In writing;

2. Electronic documents bearing an electronic signature (referring to the one by which the real name of a signer can be authenticated) defined in subparagraph 3 of Article 2 of the Digital Signature Act (referring to electronic documents defined in subparagraph 1 of Article 2 of the Framework Act on Electronic Documents and Transactions);

3. Entering the personal identification number by wire or wireless communication that ensures stability and reliability of the consent to provide such information, in consideration of the details and purpose of the personal credit information to be provided;

4. Obtaining consent from an individual after notifying him or her of the consent by wire and wireless communication. In such cases, evidential material shall be obtained and maintained by, for instance, recording a verbal dialogue concerning identification of the individual, questions as to whether the individual consent and his or her answers thereto, etc., and post-notification procedures shall be conducted, as prescribed by Presidential Decree;

5. Other means prescribed by Presidential Decree.

(2) A person, who intends to obtain any personal credit information from a personal credit rating company, sole proprietor credit rating company, corporate credit inquiry company, or credit information collection agency, shall obtain individual consent from the relevant credit data subject whenever he or she intends to provide personal credit information (excluding where it is provided to maintain the accuracy and currency of personal credit information within the scope of the purpose or use already agreed) by any means set forth in subparagraph of paragraph (1), as prescribed by Presidential Decree. In such cases, the person who intends to obtain personal credit information shall notify the relevant credit data subject when his or her personal credit score may be degraded at the time of such inquiry. <Amended on Mar. 11, 2015; Feb. 4, 2020>

(3) Where a personal credit rating company, sole proprietor credit rating company, corporate credit inquiry company, or credit information collection agency provides personal credit information under paragraph (2), it shall verify whether the person who intends to obtain such personal credit information has obtained consent under paragraph (2), as prescribed by Presidential Decree. <Amended on Feb. 4, 2020>

(4) When a credit information company, etc. obtains consent to the provision and utilization of personal credit information, it shall explain the information subject to mandatory consent and information subject to optional consent to provide services by distinguishing them, and obtain consent thereto respectively, as prescribed by Presidential Decree. In such cases, as to the information subject to mandatory consent, explanation of their relationship with the provision of services shall be explained, and as to the information subject to optional consent, it shall be notified that the other party need not consent to the provision of information. <Added on Mar. 11, 2015>

(5) No credit information company, etc. may refuse to provide services to a credit data subject on the ground that he or she does not consent to information subject to optional consent. <Added on Mar. 11, 2015>

(6) Where any credit information company, etc. (including data agencies for purposes of applying subparagraph 9-3) provides personal credit information in any of the following cases, paragraphs (1) through (5) shall not apply: <Amended on Mar. 11, 2015; Feb. 4, 2020>

1. Where a credit information company or a claims collection agency provides such information for the purpose of performing centralized management and utilization thereof with another credit information company, claims collection agency, or credit information collection agency;

2. Where such information is required to entrust the processing of credit information under Article 17 (2);

3. Where the relevant personal credit information is provided as the rights and obligations are fully or partially transferred by business transfer, division, merger, etc.;

4. Where personal credit information is provided to a person who uses the information for purposes prescribed by Presidential Decree, including claims collection (applicable only to the credit which is an object of collection), purpose of authorization or permission, determination of a company's creditworthiness, and transfer of securities;

5. Where personal credit information is provided in accordance with a court order for submission thereof or a warrant issued by a judicial officer;

6. Where such information is provided upon request by a prosecutor or judicial police officer, in an emergency where a victim's life is in danger or he or she is expected to suffer bodily injury, etc., so that no time is available to issue a judicial warrant under subparagraph 5. In such cases, the prosecutor provided with personal credit information shall, without delay, seek a warrant from a judicial officer, and the judicial police officer shall apply to the prosecutor for a warrant, who, in turn, seeks it from a judicial officer. Where the warrant is not issued within 36 hours from receipt of the personal credit information, such personal credit information shall be scrapped without delay;

7. Where such information is provided upon written request by the head of a competent tax office for inquiry and examination in accordance with tax-related Acts, or upon request for the taxation data subject to mandatory submission in accordance with tax-related Acts;

8. Where personal credit information held by a financial institution is provided to a foreign financial supervisory body in accordance with international conventions, etc.;

9. Where information referred to in subparagraph 1-4 (b) of Article 2 is provided to or from a personal credit rating company, a sole proprietor credit rating company, a corporate credit inquiry company engaged in business affairs of providing corporate credit ratings or technology credit ratings, or a centralized credit information collection agency;

9-2. Where pseudonymized information is provided for the purpose of producing statistics, conducting research, and retaining records for the public interest; In such cases, the production of statistics shall include the production of statistics for commercial purposes, including market research, and research shall include industrial research;

9-3. Where personal credit information is provided to a data agency for the purpose of combining data sets under Article 17-2 (1);

9-4. Where any personal credit information is provided for a purpose that does not conflict with the purpose for which the personal credit information was initially collected in consideration of the following factors:

(a) Relevance between the purposes;

(b) Reasons and events leading to the collection of personal credit information from the credit data subject by the credit information company, etc.;

(d) Whether measures to protect personal credit information, such as pseudonymization, have been appropriately implemented;

10. When such information is provided in accordance with this Act and other statutes;

11. Other cases prescribed by Presidential Decree as equivalent to those stipulated in subparagraphs 1 through 10.

(7) Any person who intends to provide personal credit information to any other person or who obtains such information under any subparagraph of paragraph (6) shall notify, in advance, the relevant credit data subject of the fact of and reason for such provision, as prescribed by Presidential Decree; provided, where in extenuating circumstances prescribed by Presidential Decree, such circumstances may be notified or publicly announced later by posting them on his or her website or by similar means. <Amended on May 19, 2011; Mar. 11, 2015>

(8) Any credit information provider or user prescribed by Presidential Decree, who provides personal credit information to any other person subject to paragraph (6) 3, shall obtain approval from the Financial Services Commission with regard to any of the matters prescribed by Presidential Decree, including the scope of credit information provided. <Amended on Mar. 11, 2015>

(9) A person who has obtained personal credit information after obtaining approval under paragraph (8) shall manage it separately from the personal credit information of credit data subjects with whom he or she currently deals, as determined by the Financial Services Commission. <Added on Mar. 11, 2015>

(10) Where a credit information company, etc. provides personal credit information, it shall verify the identity of the person who obtains the personal credit information and purpose of use thereof, as determined and publicly notified by the Financial Services Commission. <Amended on Mar. 11, 2015>

(11) Where there is any dispute over whether individual prior consent has been obtained under paragraph (1), the credit information provider or user who has provided the personal credit information, shall prove such fact. <Amended on Mar. 11, 2015>

Article 33-2(Request for transmission of personal credit information) #

(1) An individual credit data subject may request a credit information provider or user, etc. to transmit personal credit information on himself or herself in its possession to any of the following persons:

1. The credit data subject himself or herself

2. MyData companies;

3. A credit information provider or user prescribed by Presidential Decree;

4. A personal credit rating company;

5. Such other persons similar to those provided in subparagraphs 1 through 4 as prescribed by Presidential Decree.

(2) The scope of personal credit information to be transmitted by an individual credit data subject pursuant to paragraph (1) shall be prescribed by Presidential Decree, in consideration of all the following factors:

1. It shall be credit information processed between the relevant credit data subject (including persons who process credit information on the credit data subject under statutes or regulations, etc.; hereafter in this subparagraph this shall apply) and a credit information provider or user, etc., and shall fall under any of the following items:

(a) Information collected by a credit information provider or user from a credit data subject;

(b) Information provided by a credit data subject to a credit information provider or user, etc.;

(c) Information generated from the relationship of rights and obligations between a credit data subject and a credit information provider or user, etc.;

2. It shall be credit information processed by a computer or other information processing device;

3. It shall not be credit information separately generated or processed by a credit information provider or user based on personal credit information.

(3) A credit information provider or user, etc. in receipt of a request to transmit personal credit information from the credit data subject in accordance with paragraph (1), shall without delay transmit the personal credit information about the credit data subject in a form that makes it possible for him or her to process it with a computer or any other information processing device, notwithstanding Article 32 and the related provisions of any of the following Acts:

1. Article 4 of the Act on Real Name Financial Transactions and Confidentiality;

2. Article 81-13 of the Framework Act on National Taxes;

3. Article 86 of the Framework Act on Local Taxes;

4. Article 18 of the Personal Information Protection Act;

5. Other relevant provisions prescribed by Presidential Decree which are similar to those referred to in subparagraphs 1 through 4.

(4) Where a credit data subject requests the transmission of his or her personal credit information pursuant to paragraph (1), he or she may request a credit information provider or user, etc. to regularly transmit his or her personal credit information in the same details so as to ensure the accuracy and up-to-dateness of the relevant personal credit information.

(5) Where an individual credit data subject makes a request for transmission under paragraph (1) to a person falling under any subparagraph of paragraph (1), he or she shall do so in the form of an electronic document or any other method ensuring safety and reliability by specifying all the following matters:

1. A credit information provider or user, etc. who receives a request for transmission;

2. Personal credit information requested to be transmitted;

3. A person who receives personal credit information upon a request for transmission;

4. Whether such information is requested on a regular basis, and the frequency of such transmission;

5. Matters similar to those prescribed in subparagraphs 1 through 4, which are prescribed by Presidential Decree.

(6) A credit information provider or user, etc. who has provided personal credit information under paragraph (3) need not notify the relevant credit data subject of the fact that personal credit information has been transmitted, notwithstanding Article 32 (7) and provisions of the following statutes:

1. Article 4-2 of the Act on Real Name Financial Transactions and Confidentiality;

2. Other provisions of statutes prescribed by Presidential Decree regarding the processing of personal credit information.

(7) An individual credit data subject may withdraw a request for transmission made under paragraph (1).

(8) A credit information provider or user, etc. in receipt of a request to transmit personal credit information from a credit data subject under paragraph (1) may refuse to comply with the request for transmission or may cease or suspend the transmission in cases prescribed by Presidential Decree, including where the identity of the credit data subject is not authenticated.

(9) The methods of requesting transmission under paragraphs (1) and (4), the deadline and methods of transmission under paragraph (3), the methods of withdrawing request for transmission under paragraph (7), and the methods of refusal, cessation, and suspension under paragraph (8) shall be prescribed by Presidential Decree.

[This Article Added on Feb. 4, 2020]

Article 34-2(Principle of consent to use of personal credit information) #

(1) Where a credit information company, etc. obtains consent from a credit data subject (hereinafter referred to as "consent to the use of information"; the same shall apply in this Article and Article 34-3) under Articles 15 (2), 32 (1) and (2), 33 (1) 2, and 34, it shall notify the credit data subject of the matters prescribed in the relevant provisions in accordance with Articles 15 (2), 17 (2), and 18 (3) of the Personal Information Protection Act (hereafter in this Article referred to as "matters requiring notification") and obtain consent to the use of information; provided, this shall not apply to cases prescribed by Presidential Decree in consideration of the method for consent or the characteristics of personal credit information.

(2) A credit information provider or user prescribed by Presidential Decree shall obtain consent from the individual credit data subject, in consideration of the following:

1. He or she shall use more easy terms or simple and audiovisual means of communication, etc. so that a credit data subject can understand the matters requiring consent to the use of information;

2. Matters requiring consent to the use of information and the establishment, maintenance, etc. of commercial transaction relationship, including financial transactions, shall be clearly separated;

3. He or she shall enable a credit data subject to give a respective consent by categorizing the matters requiring consent to the use of information by a credit information company, etc. or by the purpose of information use (limited to the matters subject to optional consent under Article 32 (4)).

(3) Notwithstanding paragraph (1), a credit information provider or user prescribed by Presidential Decree may notify a credit data subject of matters omitting part of the matters requiring notification or the extract of the important matters and obtain consent to the use of information; provided, this shall not apply where an individual credit data subject requests to be informed of all matters requiring notification.

(4) Where the consent to the use of information is obtained after omitting part of the matters requiring notification or by extracting only important matters pursuant to the main clause of paragraph (3), the credit data subject shall be notified of the fact that he or she may separately request the notification of all of the matters requiring notification.

(5) Matters regarding the omission or extract under the main clause of paragraph (3), methods for requests under the proviso of that paragraph and notification under paragraph (4) shall be prescribed by Presidential Decree.

[This Article Added on Feb. 4, 2020]

Article 36-2(Explanation of results of automated evaluation and raising objections thereto) #

(1) A credit data subject may request a personal credit rating company and a credit information provider or user prescribed by Presidential Decree (hereafter in this Article, referred to as "personal credit rating company, etc.") to explain the following:

1. Whether the following act is done by automated evaluation:

(a) Personal credit rating;

(b) Determination on whether to create and maintain financial transactions prescribed by Presidential Decree (limited to credit information providers and users prescribed by Presidential Decree);

(c) Other acts prescribed by Presidential Decree, which are likely to undermine the protection of personal credit information if handled only with a computer or other information processing device;

2. The following matters in cases of automated evaluation:

(a) Results of automation evaluation;

(b) Major criteria for automated evaluation;

(c) Outline of the underlying information used in automated evaluation (hereafter in this Article referred to as "underlying information");

(d) Other matters prescribed by Presidential Decree, which are similar to those referred to in items (a) through (c).

(2) An individual credit data subject may perform the following acts with respect to a private credit rating company, etc.:

1. Submission of information that is deemed advantageous to the relevant credit data subject in automated evaluation;

2. Any of the following activities, where the details of underlying information used in the automated evaluation are deemed incorrect or not up-to-date:

(a) Requesting correction or deletion of underlying information;

(b) Requesting for re-calculation of the results of automation evaluation.

(3) In any of the following cases, a personal credit rating company, etc. may reject a request from a credit data subject under paragraphs (1) and (2):

1. Where special provisions exist in this Act or other statues or it is unavoidable for performing any obligation under statutes or regulations;

2. Where complying with a request by the relevant credit data subject makes it impracticable to establish, maintain, etc. a commercial transaction relationship, including financial transactions;

3. Other cases prescribed by Presidential Decree, which are similar to those provided in subparagraphs 1 and 2.

(4) The procedures and methods for requests under paragraphs (1) and (2) and notice of rejection and other necessary matters shall be prescribed by Presidential Decree.

[This Article Added on Feb. 4, 2020]

Article 37(Rights to withdraw consent to provision of personal credit information) #

(1) An individual credit data subject may withdraw, as prescribed by Presidential Decree, the consent which has been provided to a credit information provider or user in ways prescribed in the subparagraphs of Article 32 (1) to provide his or her personal credit information for purposes other than assessing the individual's creditworthiness, etc. by forwarding such information to a personal credit rating company, sole proprietor credit rating company, or credit information collection agency; provided, where it becomes difficult to perform a contract or serve the purposes provided in Article 33 (1) 1, including failure to perform certain services agreed with the credit data subject, unless the relevant personal credit information is provided to another credit information provider or user that has not obtained his or her consent, if the customer intends to revoke consent, he or she shall clarify his or her intention not to be provided with the relevant services. <Amended on Feb. 4, 2020>

(2) An individual credit data subject may, as prescribed by Presidential Decree, request a credit information provider or user to stop contacting him/her for the purpose of introducing or soliciting goods or services.

(3) A credit information provider or user shall notify the individual who is a counterparty, of the details of the rights and means to exercise such rights under paragraphs (1) and (2), in writing, via electronic documents, or orally, and, if he or she makes a demand under paragraphs (1) and (2), it shall immediately comply with such demand. In such cases, if such notification has been made orally, the additional post-notification procedures prescribed by Presidential Decree shall be followed.

(4) A credit information provider or user shall have a procedure in place to perform the obligations under paragraph (3), as prescribed by Presidential Decree.

(5) A credit information provider or user shall take necessary measures, as prescribed by Presidential Decree, to prevent an individual credit data subject from bearing the monetary costs arising from such demand under paragraph (2), including telephone bills.

[Title Amended on Feb. 4, 2020]

Article 38(Demand for access to and correction of credit information) #

(1) A credit data subject may request a credit information company, etc. to provide him or her with such information regarding the credit data subject himself or herself as prescribed by Presidential Decree, which is retained by the credit information company, etc., or allow him or her to access the information by presenting a certificate identifying them or having their identity checked in ways prescribed by Presidential Decree, including telephone, the website, etc. <Amended on Feb. 4, 2020>

(2) A credit data subject who accesses his or her own credit information may request correction thereof if the credit information is incorrect, as determined and publicly notified by the Financial Services Commission. <Added on Feb. 4, 2020>

(3) Upon receiving a request for correction under paragraph (2), a credit information company, etc. shall, if it deems that there are good cause for such request, without delay cease the provision or use of the relevant credit information and shall erase or delete incorrect or unverifiable information after conducting a fact-finding investigation. <Amended on Feb. 4, 2020>

(4) A credit information company, etc. which corrects or erases credit information under paragraph (3), shall notify any person who has obtained such information within the last 6 months and any person who the credit data subject requests to be advised of the details of the erased or corrected credit information. <Amended on Feb. 4, 2020>

(5) A credit information company, etc. shall inform the relevant credit data subject of the results of processing under paragraphs (3) and (4) within 7 days; and if the credit data subject is dissatisfied with the processing results, he or she may file a request for correction with the Financial Services Commission, as prescribed by Presidential Decree; provided, if a credit data subject is dissatisfied with the processing of personal credit information by an enterprise or corporation involved in commercial transactions defined in Article 45-3 (1), he or she shall file a request for correction with the Personal Information Protection Commission (hereinafter referred to as "Protection Commission") under the Personal Information Protection Act. <Amended on Feb. 4, 2020>

(6) Upon the receipt of a request for correction under paragraph (5), the Financial Services Commission shall have the Governor of the Financial Supervisory Services established under Article 24 of the Act on the Establishment of Financial Services Commission (hereinafter referred to as the "Governor of the Financial Supervisory Service") conduct a fact-finding investigation and, according to its findings, may order the credit information company, etc. to make a correction or take other necessary measures; provided, if necessary, the Protection Commission may conduct the relevant duties on its own.. <Amended on Feb. 4, 2020>

(7) A person who examines factuality under paragraph (5) shall carry identification verifying his or her authority and present it to relevant persons. <Amended on Feb. 4, 2020>

(8) Where a credit information company, etc. has implemented corrective measures in accordance with a corrective order by the Financial Services Commission or the Protection Commission under paragraph (6), it shall report the results to the Financial Services Commission or the Protection Commission. <Amended on Feb. 4, 2020>

Article 39-4(Notification of divulgence of personal credit information) #

(1) Where a credit information company, etc. becomes aware that personal credit information has been divulged for purposes other than business purposes, it shall notify the relevant credit data subject without delay. In this case, the matters to be notified shall apply mutatis mutandis the matters prescribed in each subparagraph of Article 34 (1) of the Personal Information Protection Act: <Amended on Feb. 4, 2020>

1. Deleted; <Feb. 4, 2020>

2. Deleted; <Feb. 4, 2020>

3. Deleted; <Feb. 4, 2020>

4. Deleted. <Feb. 4, 2020>

5. Deleted. <Feb. 4, 2020>

(2) A credit information company, etc. shall prepare countermeasures to minimize the damage in the event that personal credit information is disclosed and take necessary measures. <Amended on Feb. 4, 2020>

(3) A credit information company, etc. shall report without delay to the Financial Services Commission or an institution prescribed by Presidential Decree (hereinafter referred to as the "Financial Services Commission, etc." in this Article) the notification under paragraph (1) and the results of measures taken under paragraph (2) when personal credit information of a scale prescribed by Presidential Decree or more has been divulged. In such cases, the Financial Services Commission, etc. may provide technical support for preventing the spread of damage and restoring the damage. <Amended on Feb. 4, 2020>

(4) Notwithstanding paragraph (3), commercial enterprises and corporations under Article 45-3 (1) shall report to the Protection Commission or an institution prescribed by Presidential Decree (hereinafter referred to as "Protection Commission, etc." in this Article). <Added on Feb. 4, 2020>

(5) When the Financial Services Commission, etc. receives a report pursuant to paragraph (3), it shall notify the Personal Information Protection Commission thereof. <Amended on Jul. 26, 2017, Feb. 4, 2020>

(6) The Financial Services Commission or the Protection Commission may investigate the measures taken by a credit information company, etc. pursuant to paragraph (2), and if it is determined that such measures are inadequate, the Financial Services Commission or the Protection Commission may request correction. <Amended on Feb. 4, 2020>

(7) Matters necessary for the timing, methods, and procedures of notification under paragraph (1) shall be prescribed by Presidential Decree. <Amended on Feb. 4, 2020>

[This Article Added on Mar. 11, 2015]

[Title Amended on Feb. 4, 2020]

[Moved from Article 39-2 <Feb. 4, 2020>]

Article 40-2(Rules of conduct regarding pseudonymization and anonymization) #

(1) A credit information company, etc. shall retain or erase additional information used for pseudonymization after separating it by means prescribed by Presidential Decree.

(2) A credit information company, etc. shall formulate and implement technical, physical, and managerial security measures, such as formulating an internal management plan and retaining access records, to protect pseudonymized personal credit information to protect such information from illegal access by a third party, change, damage, or destruction of entered data, and other risks, as prescribed by Presidential Decree.

(3) A credit information company, etc. may request the Financial Services Commission to examine whether the personal credit information is properly anonymized.

(4) Where the Financial Services Commission deems that the personal credit information is properly anonymized according to the results of an examination under paragraph (3), it shall be presumed that the relevant personal credit information is one that no longer uniquely identifies the relevant credit data subject.

(5) The Financial Services Commission may entrust the duty of examination under paragraph (3) and recognition under paragraph (4) to a data agency under Article 26-4, as prescribed by Presidential Decree.

(6) No credit information company, etc. shall process pseudonymized information to uniquely identify an individual for profit-making or improper purposes.

(7) Where it becomes possible to uniquely identify an individual in the process of using pseudonymized information, a credit information company, etc. shall immediately cease the processing of the information, and shall immediately erase the information that can uniquely identify an individual.

(8) Where a credit information company, etc. pseudonymizes or anonymizes personal credit information, it shall retain the records of measures for three years according to the following classifications:

1. Where it pseudonymizes personal credit information:

(a) Date of pseudonymization;

(b) Items of pseudonymized information;

2. Where it anonymized personal credit information:

(a) Date of anonymization;

(b) Items of anonymized information;

[This Article Added on Feb. 4, 2020]

Article 42-2(Imposition of penalty surcharges) #

(1) Where any of the following conducts are committed (referring to the Protection Commission where an enterprise or corporation involved in commercial transactions defined in Article 45-3 (1) commits such conduct), the Financial Services Commission may impose a penalty surcharge in an amount equivalent to up to 3/100 of the total sales; provided, where a conduct falling under subparagraph 1 is committed, it may impose a penalty surcharge not exceeding five billion won: <Amended on Feb. 4, 2020>

1. Where any personal credit information is lost, stolen, divulged, altered or compromised, in violation of Article 19 (1);

1-2. Where a person provides personal credit information to a third party without the consent of the credit data subject in violation of Article 32 (1) or (2) even in cases not falling under Article 32 (6) 9-2 and where a person knowingly receives such personal credit information for a profit-making or improper purposes;

1-3. Where personal credit information is used even in cases not falling under Article 32 (6) 9-2 or 33 (1) 4, in violation of Article 33 (1);

1-4. A person who processes pseudonymized information in ways to uniquely identifying an individual for profit-making or improper purposes, in violation of Article 40-2 (6);

2. Where it discloses or uses any personal confidential information for any purpose other than for business purpose, in violation of Article 42 (1);

3. Where it provides any personal confidential information to any other person or uses it knowing that it has been illegally divulged, in violation of Article 42 (3).

(2) In imposing penalty surcharges under paragraph (1), when a credit information company, etc. refuses to submit data for calculation of sales amount or submits false data, the sales amount may be estimated on the basis of the data, such as the financial statements or other financial data, of a credit information company, etc. the scale of which is similar to that of the relevant credit information company, etc.; provided, if no sales amount exists, or in cases prescribed by Presidential Decree where it is impractical to calculate sales amount, a penalty surcharge may be imposed not exceeding 20 billion won.

(3) In imposing a penalty surcharge under paragraph (1), the Financial Services Commission or the Protection Commission shall take the following matters into consideration: <Amended on Feb. 4, 2020>

1. Details and severity of the violation;

2. Duration and frequency of the violation;

3. Amount of gains acquired by committing the violation.

(4) A penalty surcharge under paragraph (1) shall be calculated based on matters prescribed in paragraph (3), and the detailed standards and procedures for calculation thereof shall be prescribed by Presidential Decree.

(5) If a person subject to payment of a penalty surcharge under paragraph (1) fails to pay it by the payment deadline, the Financial Services Commission or the Protection Commission shall collect the late payment penalty equivalent to 6/100 per annum of the unpaid penalty surcharge from the day following the payment deadline. In such cases, the period for collecting of the penalty surcharge shall not exceed 60 months. <Amended on Apr. 18, 2017; Feb. 4, 2020>

(6) If a person obligated to pay a penalty surcharge under paragraph (1) fails to pay it by the payment deadline, the Financial Services Commission or the Protection Commission shall demand the payment by a fixed deadline, and if the penalty surcharge and the late payment penalty referred to in paragraph (5) are not paid within the specified period, they shall be collected in the same manner as the delinquent national taxes. <Amended on Feb. 4, 2020>

(7) Where any penalty surcharge imposed under paragraph (1) is to be refunded in accordance with the judgment of the court, etc., an interest on the refund equivalent to 6/100 per annum shall be paid from the date the penalty surcharge is paid until the date of refund.

(8) If a person prescribed by Presidential Decree, such as a recruiter who deals with a financial information provider or user after entering into an entrustment contract (referring to a recruiter under subparagraph 2 of Article 14-2 of the Specialized Credit Finance Business Act) falls under any subparagraph of paragraph (1), he or she shall be deemed an employee of the relevant credit information provider or user to the extent of the relevant violation; provided, this shall not apply where the relevant credit information provider or user has taken reasonable care and supervision in order to prevent such violation of the recruiter, etc.

(9) Other matters necessary for the imposition and collection of penalty surcharges shall be prescribed by Presidential Decree.

[This Article Added on Mar. 11, 2015]

Article 43(Liability to compensate for damages) #

(1) Where a credit information company, etc., and other persons provided with credit information from the credit information company, etc. violate this Act and inflict damage to a credit data subject, they shall be held liable for such damage; provided, in cases where a credit information company, etc., and other persons provided with credit information from the credit information company, etc. have proven an absence of intention or negligence, this shall not apply. <Amended on Feb. 4, 2020>

(2) Where a credit information company, etc. or any other credit information user (including a consignee; hereafter the same shall apply in this Article) is responsible for divulging any personal credit information, in violation of this Act by intent or gross negligence, or inflict to a credit data subject any damage arising from the loss, stealth, divulgence, alteration or compromise thereof, it shall be responsible to compensate the damage within the limit not exceeding five times the damage; provided, this shall not apply where a credit information company, etc. or any other credit information user proves that it has had no such intention or has not committed gross negligence. <Added on Mar. 11, 2015; Feb. 4, 2020>

(3) In determining an amount to be compensated under paragraph (2), the court shall take the following matters into consideration: <Added on Mar. 11, 2015>

1. Degree of the knowledge of the possible intention or occurrence of loss;

2. Extent of damage suffered from the violation;

3. Economic gains acquired by the credit information company, etc. or any other credit information user by committing the violation;

4. Fines and penalty surcharges for the violation;

5. Duration, frequency, etc. of the violation;

6. Economic status of the credit information company, etc. or any other credit information user;

7. Degree of efforts exercised by the credit information company, etc. or any other credit information user in recollecting the relevant personal credit information after the loss, stealth, or leakage thereof;

8. Degree of efforts exercised by the credit information company, etc. or any other credit information user for damage relief.

(4) Where a claims collection agency or a delegated claims collector has inflicted damage to debtors and persons related therewith, he or she shall be held liable for such damage; provided, where he or she has proven an absence of intention or negligence on his or her part, this shall not apply. <Amended on Mar. 11, 2015; Feb. 4, 2020>

(5) Where a credit information company has inflicted damage to a client for reasons attributable to the credit information company, it shall be held liable for such damage. <Amended on Mar. 11, 2015; Feb. 4, 2020>

(6) Where a person entrusted with the processing of credit information under Article 17 (1) has inflicted damage to a credit data subject, in violation of this Act, the entrusting and entrusted persons shall be jointly and severally held liable for such damage. <Amended on Mar. 11, 2015; Feb. 4, 2020>

(7) Where a delegated claims collector has violated this Act or the Fair Debt Collection Practices Act and inflicted damage to debtors or persons related therewith under the Fair Debt Collection Practices Act, the claims collection agency and delegated claims collector shall be jointly and severally held liable for such damage; provided, where the claims collection agency has proven an absence of intention or negligence on its part in the appointment and management of the delegated claims collector, this shall not apply. <Amended on Mar. 11, 2015; Feb. 4, 2020>

Article 45(Supervision and inspection) #

(1) The Financial Services Commission shall supervise credit information companies, etc. (including data agencies and excluding persons prescribed by Presidential Decree who are other than the following persons; hereafter in this Article and Article 45-2, the same shall apply) about whether a credit information company, etc. complies with this Act or orders under this Act: <Amended on Feb. 4, 2020>

1. Credit information companies and claims collection agencies;

2. MyData companies;

3. Credit information collection agencies;

4. A credit information provider or use who falls under any of the subparagraphs of Article 38 of the Act on the Establishment of Financial Services Commission;

5. A person who runs financial business or insurance business prescribed by Presidential Decree, other than those provided in subparagraph 4.

(2) The Financial Services Commission may, if deemed necessary for the supervision under paragraph (1), order a credit information company, etc. to report in relation to its business, financial standing, etc.

(3) The Governor of the Financial Supervisory Service may have the personnel of the Financial Supervisory Service inspect the business and financial standing of a credit information company, etc. under this Act.

(4) The Governor of the Financial Supervisory Service may, if deemed necessary for an inspection under paragraph (3), request a credit information company, etc. to submit data and have persons concerned attend meetings and state their opinions.

(5) A person who conducts an inspection under paragraph (3) shall carry identification verifying his or her authority to present it to relevant persons.

(6) The Governor of the Financial Supervisory Service shall report the findings of an inspection under paragraph (3) to the Financial Services Commission, as determined by the Financial Services Commission.

(7) If a credit information company, etc. is deemed likely to undermine the sound management of industries related to credit information and the rights and interests of a credit data subject by violating this Act (including the Fair Debt Collection Practices Act in cases of claims collection agencies; hereafter in this paragraph the same shall apply) or orders under this Act, the Financial Services Commission shall take measures set forth in any of the following subparagraphs or request the Governor of the Financial Supervisory Service to take any of the measures set forth in subparagraphs 1 through 3: <Amended on Apr. 18, 2017; Feb. 4, 2020>

1. Caution or warning to a credit information company, etc.;

2. Caution or warning to executive officers;

3. Request for disciplinary action, including caution, suspension from office, reduction in salary, and official reprimand, against employees;

4. Recommendation for dismissal of executive officers or suspension from office or demand for dismissal from office of employees;

5. Corrective order against violations;

6. Suspension of provision of credit information.

(8) The Financial Services Commission shall take management responsibility for preventing serious disruption of credit order, including divulgence of personal credit information. <Added on Feb. 4, 2020>

Article 45-3(Request for submission of data and investigation by Protection Commission) #

(1) In any of the following cases, the Protection Commission may request a credit information provider or user (hereinafter referred to as "enterprise or corporation involved in commercial transactions") exempt from supervision by the Financial Services Commission to submit data, including relevant articles and documents, pursuant to Article 45:

1. Where an enterprise or corporation involved in commercial transactions becomes aware of any violation, or suspicion of violation, of any of the following regulations (hereinafter referred to as "regulations for protecting information in commercial transactions"):

(a) Articles 15 and 17;

(b) Articles 19 and 20-2;

2. Where the Protection Commission receives a report or petition about a violation of the regulations for protecting information in commercial transactions by an enterprise or corporation involved in commercial transactions;

3. Other cases prescribed by Presidential Decree as necessary for protecting personal credit information.

(2) If an enterprise or corporation involved in commercial transactions fails to submit data required under paragraph (1) or if it is deemed to have violated the regulations for protecting information in commercial transactions, the Protection Commission may require public officials of the Protection Commission to enter the office or place of business of the enterprise or corporation or a person related to such violation, and to investigate the current status of business affairs, books, documents, etc. In such cases, a public official who conducts an inspection shall carry identification indicating his or her authority and present it to relevant persons.

(3) The Protection Commission shall not provide any third party with the documents, data, etc. furnished or collected pursuant to paragraph (1), nor disclose them to the general public, except as provided in this Act.

(4) Where the Protection Commission receives data via information and communications networks or digitalizes the collected data, etc., it shall take systematic and technical security measures to prevent any leakage of personal information, trade secrets, etc.

[This Article Added on Feb. 4, 2020]

Article 50(Penalty provisions) #

(1) Any person who violates Article 42 (1) or (3) shall be punished by imprisonment for not more than 10 years or by a fine not exceeding 100 million won:

(2) Any of the following persons shall be punished by imprisonment for not more than five years or by a fine not exceeding 50 million won: <Amended on Nov. 28, 2017; Feb. 4, 2020>

1. Any person who engages in a credit information business, MyData business, or claims collection business without obtaining permission therefor;

2. Any person who obtains permission or authorization under Article 4 (2) or 10 (1) by fraud or other improper means;

3. Deleted; <Feb. 4, 2020>

4. Any person who violates Article 17 (6);

4-2. A person who combines data sets, in violation of Article 17-2 (1);

5. Any person who, without authorization, changes or deletes any information in a credit information computer system under Article 19 (1) or make it otherwise unusable, or a person who, without authorization, retrieves, duplicates or uses in other ways such credit information;

5-2. A person who provides the services of a credit information collection agency, without obtaining permission for a credit information collection agency, in violation of Article 25 (1);

5-3. A person who entrusts claims collection service to a person other than a claims collection agency, in violation of Article 27-2;

6. Any person who violates Article 32 (1) or (2) (including cases applied mutatis mutandis under Article 34) and a person who is provided with or uses personal credit information while knowing the circumstance;

7. Any person who violates Article 33 (including cases applied mutatis mutandis under Article 34);

7-2. A person who processes pseudonymized information for the purpose of uniquely identifying an individual for profit-making or improper purposes, in violation of Article 40-2 (6);

8. Any person who violates Article 42 (4).

(3) Any of the following persons shall be punished by imprisonment for not more than three years or by a fine not exceeding 30 million won: <Amended on Feb. 4, 2020>

1. Any person who conducts business during a period of business suspension under Article 14 (2);

1-2. A person who provides a client with false information, in violation of Article 22-7 (1) 1;

1-3. A person who forces a request for investigation of credit information, in violation of Article 22-7 (1) 2;

1-4. A person who forces a person subject to investigation of credit information to provide investigation data and answers;

1-5. A person who investigates privacy or the like, other than commercial transaction relationships including financial transactions, in violation of Article 22-7 (1) 4;

2. A person, not being a credit information collection agency, who establishes the Common Computer Network under Article 25 (6);

3. A person who finds out a certain person's whereabouts, etc., in violation of the main clause of Article 40 (1) 4;

3-2. A person who uses titles, including "intelligence service agent", "detective", or other titles similar thereto, in violation of Article 40 (1) 5;

4. Any person who violates Article 41 (1);

5. Any person who has failed to verify whether an agent of recruitment business has used illegally acquired credit information in the recruitment business, etc., in violation of Article 41-2 (1).

(4) Any of the following persons shall be punished by imprisonment for not more than one year or by a fine not exceeding 10 million won: <Amended on Feb. 4, 2020>

1. A person who becomes the largest shareholder through the acquisition, etc. of shares in a credit information company, MyData company, or claims collection agency, without obtaining approval from the Financial Services Commission, in violation of Article 9 (1);

1-2. Any person who fails to apply for approval, in violation of Article 9 (2);

2. Any person who fails to dispose of stocks obtained without approval, in violation of an order under Article 9 (3);

3. Deleted; <Feb. 4, 2020>

4. Any person who violates Article 18 (2);

5. Any person who violates Article 20 (2);

6. Any person who renders claims collection service without registering with the Financial Services Commission as a delegated claims collector, in violation of Article 27 (3);

7. Any person who violates Article 27 (4).

8. Any person who, in violation of Article 27 (5), collects claims that are not the object of collection, or who renders claims collection service through a delegated claims collector who is not registered, or who has been registered with another claims collection agency, or who is suspended from his or her business;

9. Any person who renders claims collection service during a period of business suspension under Article 27 (7).

[This Article Wholly Amended on Mar. 11, 2015]

Article 52(Administrative fines) #

(1) Any of the following persons shall be subject to an administrative fine not exceeding 100 million won: <Added on Feb. 4, 2020>

1. A person who fails to file a report or files a false report, in violation of Article 9-2 (2);

2. A person who fails to comply with a request from the Financial Services Commission to provide data or information under Article 9-2 (3) or provides false data or information.

(2) Any of the following persons shall be subject to an administrative fine not exceeding 50 million won: <Amended on Apr. 18, 2017; Nov. 28, 2017; Feb. 4, 2020>

1. A person who, even though he or she is not a permitted credit information company, MyData company, or claims collection agency, uses in his or her trade name or name, any expression containing credit information, credit investigation, personal credit rating, credit management, MyData, claims collection, or any other name similar thereto, in violation of Article 12;

2. A person who violates Article 15 (2);

2-2. A person who transfers information without pseudonymization or anonymization, in violation of Article 17-2 (2);

3. A person who violates Article 19;

4. A person who violates Article 20 (6);

4-2. A person who collects credit information, in violation of Article 22-9 (3);

4-3. A person who transmits personal credit information, in violation of Article 22-9 (4) or (5);

4-4. A claims collection agency where its delegated claims collector violates Article 27 (9) 1; provided, this shall not apply to cases where the claims collection agency does not neglect to pay due diligence to the management of the relevant services in order to prevent such violation;

5. A person who violates Article 32 (4) or (5) (including cases to which it applies mutatis mutandis under Article 34);

5-2. A person who fails to separately retain information, in violation of Article 39-2 (3);

6. A person who fails to terminate an entrustment contract with an agent of recruitment business, in violation of Article 41-2 (2);

7. A person who fails to comply with any order under Article 45 (2) through (4) or refuses, obstructs, or evades any inspection or request thereunder;

8. A person who fails to submit a report or submits an untruthful report in violation of Article 47.

(3) Any of the following persons shall be subject to an administrative fine not exceeding 30 million won: <Amended on Nov. 28, 2017; Feb. 4, 2020>

1. A person who violates Article 17 (4);

2. A person who violates Article 20 (1) or (3);

2-2. A person who fails to designate a credit information administrator or guardian, in violation of Article 20 (3) or (4);

3. A person who violates Article 20-2 (2);

4. A person who violates Article 21;

4-2. A person who performs a credit rating, in violation of Article 22-4 (1) or (2);

4-3. A person who commits an unfair practice, in violation of Article 22-4 (3);

4-4. A person who performs a credit rating, in violation of Articles 22-5 (1) and 22-6 (1);

4-5. A person who violates Article 22-5 (2);

4-6. A person who violates Article 22-5 (3);

4-7. A person who violates Article 22-6 (2);

4-8. A person who violates Article 22-6 (3);

4-9. A person who violates Article 22-9 (1);

4-10. A person who violates Article 22-9 (2);

5. Any person who violates Article 23 (5);

5-2. A claims collection agency where its delegated claims collector violates Article 27 (9) 2; provided, this shall not apply to cases where the claims collection agency does not neglect to pay due diligence to the management of the relevant services in order to prevent such violation;

6. A person who violates Article 32 (8) or (9) (including cases to which it applies mutatis mutandis under Article 34);

6-2. A person who fails to transmit personal credit information, in violation of Article 33-2 (3) and (4);

6-3. A person who fails to inform a credit data subject of the matters to be informed, in violation of Article 34-2 (1);

6-4. A person who fails to comply with a request made by a credit data subject, in violation of the proviso of Article 34-2 (3);

6-5. A person who fails to inform that separate requests may be made, in violation of Article 34-2 (4);

6-6. A person who fails to give a notice, in violation of Article 35-3 (1);

7. A person who violates Article 31 (1) or (3);

7-2. A person who fails to provide explanations, in violation of Article 36-2 (1);

8. Any person who violates Article 37 (3);

9. A person who violates Article 38 (3) through (6) or (8);

10. A person who violates Article 38-2;

11. A person who violates Article 38-3;

12. Any person who violates Article 39;

13. A person who fails to inform a credit data subject of the matters provided in the subparagraphs of Article 39-4 (1), in violation of that paragraph;

14. A person who fails to report the result of measures taken, in violation of Article 39-4 (3);

15. A person who uses information to transmit any advertising information for profit-making purposes, in violation of Article 40 (2);

16. A person who fails to separately retain or erase additional information used for pseudonymization, in violation of Article 40-2 (1);

17. A person who fails to formulate and implement technical, physical, and administrative security measures for pseudonymized personal credit information, in violation of Article 40-2 (2);

18. A person who fails to cease processing or to delete information immediately, in violation of Article 40-2 (7);

(4) A person who violates Article 10 (4) or 17 (7) shall be subject to an administrative fine not exceeding 20 million won: <Amended on Feb. 4, 2020>

(5) Any of the following persons shall be subject to an administrative fine not exceeding 10 million won: <Amended on Apr. 18, 2017; Dec. 31, 2018; Feb. 4, 2020>

1. A person who violates Article 8 (1);

2. A person who violates Article 11 (1) or (2) or Article 13;

2-2. A person who engages in incidental business affairs without filing a report with the Financial Services Commission, in violation of Article 11-2 (1);

2-3. A person who has failed to comply with an order for restriction or correction issued by the Financial Services Commission under Article under Article 11-12 (8);

2-4. A person who engages in ordinary course of business for another profit-making corporation without approval from the Financial Services Commission, in violation of Article 13;

3. Deleted; <Feb. 4, 2020>

4. A person who violates Article 17 (5);

5. A person who violates Article 18 (1);

6. A person who violates Article 20-2 (1), (3) or (4);

7. A person who fails to submit a report to the Financial Services Commission, in violation of Article 22-2;

7-2. A person who fails to formulate the regulations on the management of users, in violation of Article 22-6 (4);

8. A person who fails to present a certificate in conducting claims collection business, in violation of Article 27 (8);

9. Any person who violates Article 31;

10. A person who violates Article 32 (3), (7) or (10) (including cases to which it applies mutatis mutandis under Article 34);

11. A person who violates Article 35;

11-2. A person who fails to provide explanations to the relevant credit data subject, in violation of Article 35-2;

11-3. A person who fails to retain records regarding the pseudonymization or anonymization of personal credit information, in violation of Article 40-2 (8);

12. A person who fails to notify the termination of an entrustment contract, in violation of Article 41-2 (3);

13. Deleted; <Apr. 18, 2017>

14. Deleted. <Apr. 18, 2017>

(6) Administrative fines provided in paragraphs (1) through (5) shall be imposed and collected by the Financial Services Commission, as prescribed by Presidential Decree; provided, administrative fines under paragraphs (2) through (5) related to a violation of the regulations for protecting information in commercial transactions by an enterprise or corporation involved in commercial transactions shall be imposed and collected by the Protection Commission, as prescribed by Presidential Decree. <Amended on Feb. 4, 2020>

(7) Where a claims collection agency falling under the main clause of paragraph (2) 4-2 receives a criminal punishment pursuant to the Fair Debt Collection Practices Act, an administrative fine shall not be imposed on such agency, and where the claim collection agency receives a criminal punishment after an administrative fine has been imposed, the imposition of such administrative fine shall be revoked. <Added on Nov. 28, 2017; Feb. 4, 2020>

[This Article Wholly Amended on Mar. 11, 2015]

CREDIT INFORMATION USE AND PROTECTION ACT

Article 1(Purpose) #

Article 2(Definitions) #

Article 3(Fostering industries related to credit information) #

Article 3-2(Relationship to other statutes) #

Article 4(Permission for credit information business) #

Article 5(Those qualified for permission for credit information business) #

Article 6(Requirements for permission) #

Article 7(Public announcement on permission) #

Article 8(Matters to declare and report) #

Article 9(Approval for change in large shareholders) #

Article 9-2(Qualification examination of largest shareholder) #

Article 10(Authorization of transfer or acquisition by transfer) #

Article 11(Concurrent business) #

Article 11-2(Incidental business) #

Article 12(Prohibition of use of similar title) #

Article 13(Prohibition of concurrent offices by executive officers) #

Article 14(Revocation of permission and suspension of business) #

Article 15(Principles of collection and processing) #

Article 16 #

Article 17(Entrustment of processing) #

Article 17-2(Combination of data sets) #

Article 18(Keeping credit information accurate and up-to-date) #

Article 19(Security protection of credit information computer system) #

Article 20(Clarification of accountability of credit information management and archiving of business processing records) #

Article 20-2(Retention period for personal credit information) #

Article 21(Disposition of archived information upon closure of business) #

Article 22(Qualifications of executive officers of credit information companies) #

Article 22-2(Reporting on credit information) #

Article 22-3(Principles regarding personal credit rating) #

Article 22-4(Business conduct standards for personal credit rating companies) #

Article 22-5(Code of conduct of sole proprietor credit rating companies) #

Article 22-6(Business conduct standards for corporate credit rating inquiry companies) #

Article 22-7(Code of conduct for credit inquiry companies) #

Article 22-8(Qualifications for executive officers of mydata companies) #

Article 22-9(Code of conduct for mydata companies) #

Article 23(Requests for provision of credit information of public institutions) #

Article 24(Use of computer data of resident registration) #

Article 25(Credit information collection agency) #

Article 25-2(Duties of centralized credit information collection agency) #

Article 26(Committee for Intensive Management of Credit Information) #

Article 26-2(Composition and operation of Committee for Intensive Management of Credit Information) #

Article 26-3(Personal credit rating system verification committee) #

Article 26-4(Data agencies) #

Article 27(Persons engaged in claims collection business and delegated claims collectors) #

Article 27-2(Prohibition of entrustment of services to unlicensed claims collection business entity) #

Article 28 #

Article 29 #

Article 30 #

Article 31(Public notification of credit information utilization status) #

Article 32(Consent to provision and use of personal credit information) #

Article 33(Use of personal credit information) #

Article 33-2(Request for transmission of personal credit information) #

Article 34(Collection, use, and provision of personal identification information) #

Article 34-2(Principle of consent to use of personal credit information) #

Article 34-3(Consent rating for use of information) #

Article 35(Fact-finding inquiries into use and provision of credit information) #

Article 35-2(Duty to provide explanation about possible decline in personal credit scores) #

Article 35-3(Advance notice by credit information providers and users) #

Article 36(Notification of credit information giving rise to refusal of commercial transaction) #

Article 36-2(Explanation of results of automated evaluation and raising objections thereto) #

Article 37(Rights to withdraw consent to provision of personal credit information) #

Article 38(Demand for access to and correction of credit information) #

Article 38-2(Requests for notification of credit inquiry) #

Article 38-3(Request for deletion of personal credit information) #

Article 39(Right of access free of charge) #

Article 39-2(Access to information on changes in creditors) #

Article 39-3(Methods and procedures for credit data subjects to exercise rights) #

Article 39-4(Notification of divulgence of personal credit information) #

Article 40(Prohibitions for credit information company) #

Article 40-2(Rules of conduct regarding pseudonymization and anonymization) #

Article 40-3(Exceptions to application for pseudonymized data) #

Article 41(Prohibited matters for claims collection agency) #

Article 41-2(Verification of recruitment channels of agents of recruitment business) #

Article 42(Prohibition of divulgence for non-business purposes) #

Article 42-2(Imposition of penalty surcharges) #

Article 43(Liability to compensate for damages) #

Article 43-2(Claim for statutory damages) #

Article 43-3(Guarantee of compensation for damage) #

Article 44(Credit information companies association) #