Introduction to the Importance of Personal Information and Personal Credit Information Protection, and Information Protection Measures Examined Through the Toss Case

Recently, the Financial Supervisory Service imposed a large-scale penalty and fine on Vibarepublic, the operator of the financial platform ‘Toss,’ demonstrating the seriousness of violations of corporate obligations regarding personal and credit information management. The main violations of this sanction are as follows.

Firstly, Toss illegally combined external electronic receipt data and its own card transaction information without going through a data specialized agency, using it without the consent of the information subject, thereby illegally using personal credit information through the unfair combination of information sets. Additionally, it misrepresented non-essential information that customers could selectively consent to as a mandatory consent item, forcing consent and operating the personal information provision and utilization consent procedure unfairly.

Secondly, regarding the safe protection of the credit information computer system, it violated legal obligations by failing to back up access logs separately, excessively granting access permissions, and inadequately operating administrative security measures. Additionally, it was pointed out that it neglected to report concurrent business, failing to fulfill its reporting obligations.

Furthermore, regarding the insurance inquiry service, it was also a violation of unfair collection and utilization of personal credit information to illegally collect sensitive information of customers who did not consent and provide numerous insurance inquiry services. Along with this, the lack of control over the insurance service program changes hampered the transparency and security of the service's operation, and essential security procedures were omitted in the information processing system construction project, failing to comply with related legal obligations.

These violations underscore the importance of personal and credit information protection. As the legal responsibility of corporations regarding personal information protection is increasingly emphasized, Law firm Veat’s personal information protection lawyers have explained the key violations of this case one by one, along with the information protection measures that companies must know.

Q1. One of the key issues in this case was the illegal use of personal credit information through unfair combination of information sets. What are your thoughts on this?

 

In this case, the consent procedures in the combination and use of personal information and the data combination method were problematic. Toss used external electronic receipt data and its own card transaction information by combining them without going through a data specialized agency, resulting in unauthorized information combination and utilization. According to Article 33 of the Credit Information Use and Protection Act (hereinafter “Credit Information Act”), personal credit information of customers must only be utilized for other purposes with the clear consent of the information subject, and according to Article 17(2) of the same Act, data specialized agency combination is mandatory.

 

Q2. The unfair operation of personal credit information provision and utilization consent procedures was also problematic. What is the legal standard for this?

 

Toss had instances where personal information designated as optional items in the personal information collection and utilization consent form was designated as a 'mandatory consent item.' Article 64(4) of the Credit Information Act clearly distinguishes between essential consent related to service provision and optional consent, and clearly stipulates that optional consent must inform customers that they can refuse information provision, emphasizing the importance of a consent system that guarantees the customer’s choice.

 

Q3. The failure to back up access logs of the credit information computer system has also been pointed out. What legal obligation is this related to?

 

Backing up access logs is an important method of safely protecting customer information from external sources. Toss did not back up access logs of the computer system where personal credit information was stored to a separate device, which violated the access log management and retention obligations stipulated in Article 19(1) and Article 16(2) of the Enforcement Decree of the Credit Information Act. Credit information companies, etc. must store personal credit information processing system access logs for more than one year and back them up to a separate storage device that is not altered to prepare for illegal access, input of information modification/damage and destruction by third parties, etc.

 

Q4. Could you explain the legal obligation violations in the information processing system construction project?

 

When constructing an information processing system, you must strictly comply with legal regulations. In this case, Toss did not properly implement the requirement to conduct a prior feasibility study and obtain approval from an independent organization regarding the results, and omitted essential security procedures.

 

Q5. So, what advice does Law firm Veat provide regarding personal and credit information protection?

 

Law firm Veat, led by partner Baek Seung-cheol and partner Jo Eun-byeol, provides legal advice in various aspects, including ISMS-P (Information Security Management System) construction and certification consulting, personal information leakage response, GDPR, HIPAA, personal information protection education, and credit information location advisory.

Partner Jo Eun-byeol serves as a legal advisor to the Personal Information Protection Committee and provides legal support for strengthening the data protection system of corporations. Recognizing Jo’s outstanding contribution in the personal information protection field, she received an award for outstanding lawyer from the Personal Information Protection Committee, and as a member of the Artificial Intelligence and Legal Tech Special Committee of the Seoul Bar Association, she provides legal support so that corporations can comply with the Personal Information Protection Act and Credit Information Act while providing innovative services.

Partner Baek Seung-cheol is an expert in IT and personal information protection law, holding the IT specialist lawyer qualification from the Korea Bar Association. He is particularly assisting corporations in establishing robust information security systems through ISMS-P (Information Security Management System) construction and personal information protection lectures.

The Law firm Veat personal information protection team provides legal advice to ensure that corporations comply with legal requirements regarding personal and credit information and to support them in establishing a reliable information security system.

 

Q6. Finally, what advice would you like to give to companies regarding personal information protection?

 

It is essential for companies handling such information to proactively establish and maintain a management system that meets the legal requirements.

Strengthening personal and credit information protection is now more than just regulatory compliance; it is linked to corporate trustworthiness. As legal requirements for information protection continue to strengthen, systematic response is essential.

Law firm Veat provides thorough prior review and legal advice to help companies minimize legal risks and establish a stable and reliable data operation environment. We hope that through Law firm Veat’s advice, companies will be able to establish a risk-free and reliable data operation environment and enhance customer trust.

Law firm Veat will continue to do its best to reflect the legal requirements for information protection and help customers comply with legal requirements.

For legal advice regarding information protection systems, the Credit Information Act, and the Personal Information Protection Act, please contact Law firm Veat.

Thank you.

Law firm Veat