The Personal Information Protection Commission announced on the 27th that it confirmed cases where social security numbers were processed without legal basis in the financial sector during a pre-inspection of personal information handling practices and that all such cases have been corrected.
Following its March sanction against credit card companies for violating the obligation to limit the processing of social security numbers, the Personal Information Protection Commission conducted a pre-inspection starting April 1 targeting 220 companies across six financial sectors: (△banks △life insurance △property and casualty insurance △credit cards △savings banks △securities). The inspection focused on whether social security numbers were being processed as a matter of routine in general operations not directly related to financial transactions, such as member information management and account management, unlike cases where processing is legally required during financial transactions.
Social security numbers uniquely identify individuals and are difficult to change arbitrarily; therefore, if leaked or misused, the resulting harm can persist for a long time, necessitating special protection. Accordingly, the Personal Information Protection Act generally prohibits the processing of social security numbers except in cases specifically permitted by law.
In the financial sector, there are many instances where social security numbers must be processed during financial transactions under relevant laws such as the Financial Real Name Transaction Act. However, a practice has emerged in which social security numbers are used as a basic means of identity verification, leaving some procedures that process social security numbers for general operations lacking legal basis.
Through this pre-inspection, the Personal Information Protection Commission enabled financial sector operators to reevaluate the necessity of processing social security numbers during online service processes and improve unnecessary processing procedures. This goes beyond post-facto sanctions by proactively examining and encouraging voluntary improvements in practices related to social security number processing in the financial sector closely tied to citizens' daily lives. It is particularly significant as it concretizes the purpose of preventive personal information protection that the Personal Information Protection Commission has been promoting across the entire financial sector.
The Personal Information Protection Commission stated that if operators complete necessary measures on their own during the inspection process, the inspection will be concluded without separate sanctions. Going forward, it plans to proactively identify and improve personal information infringement risk factors in areas closely related to citizens' daily lives through pre-inspections of actual conditions.
in TECH
