Credit Information Act Fine Criteria to Be Revised... Differential Imposition Based on Information Type and Damage Scale

Financial Authorities Launch Task Force to Improve Fine Calculation Criteria
Toward a More Detailed Structure for the 50%, 75%, and 100% Standard Rates
Lowering the Burden for Minor Violations, Imposing Stricter Sanctions for Serious Breaches

The financial authorities will subdivide the criteria for imposing fines when financial companies violate the Credit Information Act, by reflecting the nature and type of personal credit information and the scale of damages. The aim is to lower the burden of fines for minor violations while imposing stricter sanctions for serious violations.

On September 16, the Financial Services Commission, presided over by Director Yoo Youngjun of the Digital Finance Policy Office, held a meeting of the Task Force (TF) to improve the criteria for calculating fines under the Act on the Use and Protection of Credit Information (Credit Information Act). The meeting discussed the current system's problems and possible improvements with the Financial Supervisory Service and financial industry associations.

The current Credit Information Act was amended in 2020 to expand the targets of fines from just the disclosure or leakage of personal credit information to also include the improper provision and use of such information, and the misuse of pseudonymized information. The upper limit for fines was also raised significantly from "3% of the relevant sales" to "3% of total sales."

The issue is that, despite violations of the Credit Information Act, the "Regulations on the Inspection and Sanctions of Financial Institutions" are still applied uniformly to all financial sectors. As a result, there have been criticisms that the characteristics of violations—such as the type of personal credit information or the harm to data subjects—have not been properly reflected in the process of calculating fines.

In particular, the current system sets 3% of total sales as the statutory upper limit for fines and calculates fines by applying a three-tier standard rate of 50%, 75%, or 100% based on the seriousness of the violation. Unlike the Banking Act or Insurance Business Act, where fines are calculated based on the amount directly related to the violation, the Credit Information Act uses total sales as the standard. The financial authorities believe this makes it difficult to impose fines proportional to the specific violation.

In contrast, the domestic Personal Information Protection Act (PIPA) and the European Union's General Data Protection Regulation (GDPR) apply more detailed standards. PIPA excludes revenue unrelated to the violation from the total sales when calculating fines and applies a standard rate of 1–30% for minor violations. The EU GDPR calculates fines based on global revenue but applies a 0–10% standard rate for less serious breaches.

Accordingly, the Financial Services Commission and Financial Supervisory Service have decided to establish separate criteria for calculating fines specifically tailored to the Credit Information Act. When assessing the seriousness of a violation, they will consider the nature and type of personal credit information, the scale of the data subjects affected, and the damages incurred. They are also reviewing ways to further subdivide the existing three-tier system of 50%, 75%, and 100% standard rates.

It was also discussed that very serious violations with significant social impact should result in strict fines, while proactive efforts by financial companies to protect personal credit information and measures to recover consumer damages should be reflected as mitigating or aggravating factors in the calculation of fines.

An official from the Financial Services Commission stated, "After gathering a wide range of opinions from the financial sector and others, the Financial Services Commission and the Financial Supervisory Service plan to quickly amend the relevant regulations once transparent and reasonable criteria for calculating fines are established."

This content was produced with the assistance of AI translation services.