In the financial sector, high-quality data is readily available, making its utilization highly valuable. As the era of artificial intelligence advances, the importance of utilizing financial data, including credit information, is becoming increasingly significant.

The amended Credit Information Use and Protection Act (“Credit Information Act”), which took effect on August 5, 2020, introduced several measures to foster the financial data industry, including the introduction of the MyData business, the advancement of regulatory frameworks for credit information businesses, the establishment of the right to request the transfer of personal credit information, and the regulation of procedures for data combination.

At the same time, to prevent misuse or leakage of data resulting from the growth of the data industry, enforcement under the Credit Information Act has also been strengthened—allowing, for instance, the imposition of administrative fines of up to 3% of a company’s total sales in the event of a violation. Furthermore, with the 2023 amendment to the Personal Information Protection Act, the right to data portability has been extended to non-financial sectors, and data subjects’ rights regarding automated decision-making using AI have been explicitly established. As the legal framework for credit information and personal information increasingly converge—while still retaining distinctions—legal advisory on the Credit Information Act has become a specialized field that requires an integrated understanding of both the Personal Information Protection Act and financial regulations.

Due to the unique nature of credit information regulations and the increasingly stringent enforcement environment, businesses subject to the Credit Information Act—including not only financial institutions, credit information companies, and MyData operators, but also credit information providers and users in non-financial sectors—face a significantly heightened need to establish compliance systems and obtain ongoing legal counsel from professionals. Moreover, as the Personal Information Protection Commission is now conducting investigations into violations of personal (credit) information laws and regulations, it has become more critical than ever to seek support from experts with broad and in-depth experience in both personal and credit information matters.

Lee & Ko’s Credit Information Team provides tailored, one-stop legal solutions related to credit information regulations. Our professionals have a broad and in-depth understanding not only of the relevant laws and regulations, but also of the practical business challenges, from the perspective of companies engaged in credit information-related services. They are also highly responsive to changes in the credit information regulatory landscape.

Our Credit Information Team is composed of one of the most experienced and well-rounded groups of professionals in the industry, with extensive expertise across various fields—including personal information, finance, data security, data, Tech & AI, and legislative consulting—as well as experts with long-standing experience at major regulatory authorities such as the Financial Services Commission, the Financial Supervisory Service, and the PIPC. Based on our unparalleled capabilities and years of hands-on experience, the team provides the highest level of legal services through seamless collaboration across all stages of credit information-related matters, including legal advisory, responses to regulatory investigations, incident response for credit information breaches, licensing and approvals, legislative consulting, statutory interpretation, and representation in civil, criminal, and administrative proceedings.

관련 분야

Data Privacy & Cybersecurity Data Protection Regulatory Response & Litigation

주요업무분야

[Response to Regulatory Investigations and Data Breach Incidents, and Civil/Criminal Proceedings]

Provide legal advice in connection with examinations and sanctions, including proceedings before the sanctions review committee of credit information regulatory authorities.
Assist clients in responding to investigations by regulatory authorities and handling related civil and criminal proceedings involving credit information-related incidents, such as hacking or data breaches.

[Legal Advice on Credit Information and Credit Information Business]

Provide regular legal advice covering the entire life cycle of credit information—including collection, use, provision, outsourcing, and protection—for both financial and non-financial institutions.
Provide comprehensive legal advice on regulatory and operational issues related to businesses handling credit information, including credit information and MyData businesses.
Provide comprehensive compliance consulting services to ensure adherence to credit information-related laws and regulations.
Advise on data utilization issues, including compliance and internal control measures related to the processing of pseudonymized and anonymized information.

[Licensing and Registration Support for Credit Information Businesses]

Review licensing requirements and regulatory standards applicable to credit information and MyData businesses, and provide legal advice accordingly.
Provide support in communications with the Financial Services Commission and the Financial Supervisory Service, including assistance with the licensing and registration procedures for credit information and MyData businesses.

[Legislative Consulting in the Credit Information Sector]

Provide legislative consulting services and legal responses related to credit information system reform, including legislative responses to address developments in the AI era.

더보기

대표사례

[Response to Regulatory Investigations and Data Breach Incidents, and Civil/Criminal Proceedings]

Represented credit card companies in responding to sanctions imposed by financial regulatory authorities and in civil litigation arising from a major personal information breach incident.
Advised a commercial bank in responding to a regular inspection by financial authorities concerning credit information.
Provided legal support to a securities firm in responding to a personal credit information breach incident.
Represented L Life Insurance in a criminal case involving a large retail chain’s violation of credit information laws and regulations.
Reviewed legal issues concerning court orders for the disclosure of financial information.
Advised on the provision of personal credit information to investigative agencies.
Assisted financial institutions in responding to supervisory inspections by regulatory authorities.
Advised a major Korean payment gateway service provider in connection with a criminal investigation related to personal credit information.
Provided strategic legal counsel in response to a significant hacking incident affecting Korea’s largest online marketplace.
Advised on regulatory responses to a personal information breach involving prepaid phone users of Korea’s largest mobile carrier.

[Legal Advice on Credit Information and Credit Information Business]

Provided legal advice on matters related to MyData businesses.
Reviewed legal issues related to the launch of new services by a credit bureau.
Advised a credit information company on the legality of investments in SPCs and the acquisition of asset management services.
Reviewed legal compliance of big data analysis and corporate credit information sales under the Credit Information Act.
Provided legal analysis on a mobile carrier’s provision of credit rating services using its telecommunications data.
Advised on customer information updates required for dormant account inquiries.
Provided compliance advice during ISMS (Information Security Management System) implementation projects.
Reviewed reporting obligations to the FSC or FSS regarding outsourcing of credit information processing.

[Licensing and Registration Support for Credit Information Businesses]

Provided legal advice and representation in obtaining regulatory approvals for MyData and credit information businesses, and supported communication with financial regulatory authorities.

[Legislative Consulting in the Credit Information Sector]

Provided legislative consulting on amendments to the Data 3 Act and related subordinate regulations for the introduction of financial MyData services.