Even if Credit Information Leaks at Financial Firms Like Shinhan, Fine Capped at 5 Billion Won... Calls Grow for Tougher Sanctions

[Cracks in Financial Security] ④

Financial Services Commission Announces Finer Guidelines for Fine Assessment

New Standards May Apply to Shinhan Bank Data Breach

Fine Cap for Hacking-Related Leaks Remains at 5 Billion Won

Bill

Amid a series of recent customer data leaks in the financial sector, there is a possibility that the new standards for calculating fines under the revised Credit Information Act, currently being prepared by the financial authorities, may be applied to ongoing cases, including the incident at Shinhan Bank. However, the statutory cap on fines for personal credit information leaks caused by hacking remains unchanged at up to 5 billion won. The introduction of punitive fines, a measure that the authorities have been pursuing since last year, is still pending in the National Assembly. Even if the law is amended, it is expected to be difficult to retroactively apply it to incidents that have already occurred.

According to the financial authorities on October 6, the Financial Services Commission announced on October 1 a proposed revision to the "Supervisory Regulations on Credit Information Businesses," which includes new criteria for calculating fines under the Credit Information Act. The authorities believe that the new standards could be applied in the future sanctioning process for customer data leaks currently under investigation at Shinhan Bank and other institutions. Under the Framework Act on Administrative Regulations, if the standard for sanctions changes after a violation occurs and the new standard is more lenient, the revised standard should be applied unless otherwise stipulated.

The core of this revision is the establishment of separate fine criteria that reflect the unique nature of the Credit Information Act. Previously, the seriousness of violations was classified into three levels, with the fine rate set at 50% for minor violations, 75% for serious violations, and 100% for very serious violations.

To address concerns that fines could be excessively high even for minor violations, the authorities have subdivided the fine rates. Under the revision, violations of low seriousness will be subject to a rate between 1% and less than 30%, serious violations will be between 30% and less than 65%, and very serious violations will be at or above 65% up to 100%. The type and nature of personal credit information, the scale and impact of damages, and the method and duration of the violation will also be reflected in the assessment of seriousness.

However, this revision only reorganizes the method for calculating fines and does not increase the cap on fines for personal credit information leaks resulting from hacking. Under the current Credit Information Act, if a financial institution violates its security obligations and loses, steals, leaks, forges, or damages personal credit information, the fine is set at up to 5 billion won.

Accordingly, in the Shinhan Bank incident, where not only personal information but also credit information such as annual income and loan limits were leaked, if it is classified as a "very serious" violation and the revision is finalized and applied, the baseline fine could range from 3.25 billion won to 5 billion won. After considering aggravating and mitigating circumstances, the final amount would be determined, but under the law, it cannot exceed the statutory maximum of 5 billion won.

The authorities expect that the Credit Information Act will primarily be applied in sanctioning the Shinhan Bank incident. It is also possible to apply the Electronic Financial Transactions Act, which imposes obligations on financial companies to follow IT and security standards for safe electronic financial transactions. However, the current cap on administrative fines for security obligation violations under this law is about 50 million won. The authorities also plan to review the possibility of further sanctions, such as business suspension, based on the results of the Financial Supervisory Service's investigation and the applicability of the Banking Act and other industry-specific laws.

Separate sanctions through the Personal Information Protection Act are also possible. The Personal Information Protection Act allows fines of up to 3% of total revenue. However, according to the authorities, it is difficult to simultaneously apply both the Credit Information Act and the Personal Information Protection Act to personal credit information leaks, as the Credit Information Act, being a special law, takes precedence in cases where both personal and credit information are leaked together. For additional sanctions under the Personal Information Protection Act, there would need to be a separate violation of the handling of personal information that is not covered by the Credit Information Act.

The case of Lotte Card is a representative example. Last year, the financial authorities imposed a fine of 5 billion won and suspended operations for 1.5 months on Lotte Card in July this year, in accordance with the Credit Information Act, after the personal credit information of 2.97 million customers was leaked. Separately, the Personal Information Protection Commission in March this year fined Lotte Card 9.62 billion won for recording resident registration numbers in online payment logs without legal grounds and failing to sufficiently encrypt the information.

Punitive Fines Pushed Forward, But Bill Remains Stalled in National Assembly

The government, prompted by a series of hacking incidents in the financial sector last year, announced its intention to toughen penalties for data breaches and introduce punitive fines. The financial authorities are taking steps to amend the Electronic Financial Transactions Act, which sets out obligations for securing the safety of electronic financial systems, with the aim of strengthening sanctions against hacking incidents.

The proposed amendment to the Electronic Financial Transactions Act, sponsored by Assemblyman Yoo Dongsoo of the Democratic Party of Korea, would allow fines of up to 3% of total sales to be imposed in cases where electronic financial transaction data or personal credit information is leaked due to security breaches.

This amendment sets more stringent criteria for calculating fines than the current Personal Information Protection Act. While the Personal Information Protection Act also sets a cap at 3% of total revenue, it excludes revenue unrelated to the violation when calculating the final amount. In contrast, the proposed amendment to the Electronic Financial Transactions Act does not contain any such exclusion for unrelated sales.

A financial authority official explained, "Since the proposed amendment does not provide for the exclusion of revenue unrelated to the violation as the Personal Information Protection Act does, it is stricter." The official further noted, "In actual data breach cases, the fact of hacking is usually revealed first, and the scope of the breach and the extent of damage to credit information are determined later through investigation. Amending the Electronic Financial Transactions Act, rather than the Credit Information Act, would allow for a more systematic approach."

However, this amendment to the Electronic Financial Transactions Act, which contains these provisions, is currently stalled in the National Assembly. Even if the law is revised, it will be difficult to retroactively apply the strengthened punitive fines to recent cases of financial sector data leaks, such as the Shinhan Bank incident.

A financial industry insider commented, "The regulations, such as fines for personal credit information leaks related to financial transactions, are still too weak compared to the actual damage, which can be more significant than the leakage of other types of personal information." The insider added, "As AI-enabled hacking becomes more sophisticated, institutional improvements that can provide tangible disincentives for such leaks should be implemented as soon as possible."

This content was produced with the assistance of AI translation services.