The financial authorities are revising the penalty assessment criteria for violations of the Credit Information Act. The new structure will differentiate penalties based on the severity of the violation, reducing the burden for minor infractions while allowing for fines to be increased by up to 100% for serious breaches, such as large-scale personal data leaks.
The Financial Services Commission announced on October 21 during its 18th regular meeting that it has approved amendments to the 'Regulations on the Supervision of Credit Information Businesses.' The revised regulations will take effect on October 23.
A key aspect of this amendment is the shift from the existing three-tiered penalty system to a differentiated assessment based on severity. Currently, penalties are set at 50%, 75%, or 100% of the statutory maximum based on the seriousness of the violation. Under the new system, minor violations will incur penalties ranging from 1% to 30%, serious violations from 30% to 65%, and very serious violations from 65% to 100%.
As a result, the financial burden for minor violations could be significantly reduced. According to examples provided by the Financial Services Commission, a financial company with annual sales of 7 trillion won and a net profit of 700 billion won that commits a minor violation would see its base penalty decrease from 1.05 billion won to 210 million won. This would lower the penalty's proportion relative to net profit from 15% to 3%.
Conversely, penalties for serious violations will be strengthened. If a company repeats the same violation or causes significant social impact, such as a large-scale personal credit information leak, the base penalty can be increased by up to 100%. This includes cases where the same violation occurs within three years or affects over 10 million victims. However, the final penalty cannot exceed the statutory maximum.
The criteria for assessing the severity of violations have also been adjusted to align with the characteristics of the Credit Information Act. The previous evaluation item of 'unjust gains' has been replaced with 'types and nature of personal credit information,' and 'scale of damage' has been specified as 'scale and impact on affected individuals.' This change acknowledges the difficulty in accurately assessing unjust gains in cases of personal data breaches or improper use and provision.
Additionally, the grounds for reducing penalties have been expanded for financial companies that voluntarily enhance personal data protection or quickly implement consumer protection measures after a breach.
The revised regulations will apply to penalties imposed after their implementation. For violations occurring before the new regulations take effect, the previous rules will generally apply, although the new criteria may be used if they are more favorable to the violator.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.