Law Viewer

Back Home

ENFORCEMENT DECREE OF THE CREDIT INFORMATION USE AND PROTECTION ACT

Wholly Amended by Presidential Decree No. 21765, Oct. 1, 2009

Amended by Presidential Decree No. 22151, May 4, 2010

Presidential Decree No. 22220, jun. 28, 2010

Presidential Decree No. 22467, Nov. 2, 2010

Presidential Decree No. 22493, Nov. 15, 2010

Presidential Decree No. 22626, Jan. 17, 2011

Presidential Decree No. 23076, Aug. 17, 2011

Presidential Decree No. 23488, Jan. 6, 2012

Presidential Decree No. 23535, Jan. 25, 2012

Presidential Decree No. 24076, Aug. 31, 2012

Presidential Decree No. 24697, Aug. 27, 2013

Presidential Decree No. 25155, Feb. 11, 2014

Presidential Decree No. 25532, Aug. 6, 2014

Presidential Decree No. 25945, Dec. 30, 2014

Presidential Decree No. 26369, jun. 30, 2015

Presidential Decree No. 26517, Sep. 11, 2015

Presidential Decree No. 27037, Mar. 11, 2016

Presidential Decree No. 27070, Mar. 29, 2016

Presidential Decree No. 27205, May 31, 2016

Presidential Decree No. 27322, Jul. 6, 2016

Presidential Decree No. 27511, Sep. 22, 2016

Presidential Decree No. 27556, Oct. 25, 2016

Presidential Decree No. 27786, Jan. 10, 2017

Presidential Decree No. 28150, jun. 27, 2017

Presidential Decree No. 28152, jun. 27, 2017

Presidential Decree No. 28283, Sep. 5, 2017

Presidential Decree No. 28387, Oct. 17, 2017

Presidential Decree No. 28918, May 28, 2018

Presidential Decree No. 29269, Oct. 30, 2018

 Article 1 (Purpose)
The purpose of this Decree is to provide for the matters delegated by the Credit Information Use and Protection Act and other matters necessary for its enforcement.
 Article 2 (Definitions)
(1) The term "information prescribed by Presidential Decree" in subparagraph 1, with the exception of its items of Article 2 of the Credit Information Use and Protection Act (hereinafter referred to as the "Act"), means any of the following information: Provided, That the information publicly notified or disclosed in accordance with other statutes, or publicly notified or disclosed through publications, broadcast media, or the Internet website, etc. of the State, local governments, or public institutions (referring to the institutions in subparagraph 3 of Article 2 of the Official Information Disclosure Act with the exception of State agencies and local governments; hereafter in this Article the same shall apply) in compliance with other statutes, shall be excluded: <Amended by Presidential Decree No. 23076, Aug. 17, 2011; Presidential Decree No. 25155, Feb. 11, 2014; Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 29269, Oct. 30, 2018>
1. Information by which a particular owner of credit information can be identified, as described in subparagraph 1 (a) of Article 2 of the Act: Information on a living person, including his/her name, contact information (referring to his/her address, telephone number, etc.; hereinafter the same shall apply), personal identification number (referring to the numbers referred to in subparagraphs of Article 29; hereinafter the same shall apply), gender, nationality, and other similar information, and the trade name and name, corporate registration number, business registration number and identification number of an enterprise (referring to an individual who runs business, a corporation and organizations thereof; hereinafter the same shall apply) and a corporation, locations of its head office, business places and agencies, date of incorporation, business type, name and personal identification number of the representative and other similar information (limited to cases where such information is combined with the information falling under any of subparagraphs 2 through 5);
2. Information by which the transaction details of an owner of credit information can be determined, as described in subparagraph 1 (b) of Article 2 of the Act: Information on the type, period and amount of and ceilings on commercial transactions, including loans, guarantees, provision of collateral, current account transactions (including household current account transactions), credit cards, installment financing, facility leases, and financial transactions;
3. Information by which the credit worthiness of an owner of credit information can be determined, as described in subparagraph 1 (c) of Article 2 of the Act: Information on delinquency, dishonor, payments by subrogation, substitute payments, and other acts of disrupting the order in credit transactions through falsehoods, fraud and other unlawful means, including the sum of money and the date of occurrence and resolution, in connection with financial transactions and other commercial transactions. In cases where an owner of credit information is a company, any of the following persons shall be included:
(a) Oligopolistic stockholder who is the largest investor, as prescribed in subparagraph 2 of Article 39 of the Framework Act on National Taxes;
(b) Oligopolistic stockholder prescribed in subparagraph 2 of Article 39 of the Framework Act on National Taxes, who is concurrently a director or auditor of the relevant company, and a joint guarantor thereof;
(c) The largest investor who holds at least 30/100 of the total number of issued stocks with voting rights or the total amount of equity of the relevant company;
(d) A partner with unlimited liability of the relevant company;
4. Information by which the credit transaction capacity of an owner of credit information can be determined, as described in subparagraph 1 (d) of Article 2 of the Act: Any of the following information by which the credit transaction capacity of an owner of credit information can be determined in connection with financial transactions and other commercial transactions:
(a) Occupation, total amount of assets, liabilities, and income, and the tax payment record of an individual;
(b) Overall information of a company or corporation, including its history, purpose, business status, and current status of stocks or shareholding ratio; matters concerning its representative and executive officers, its business details, including sales statements, orders received, or major contracts for management; matters concerning its finance, including financial statements (including the consolidated financial statements and combined financial statements; hereinafter the same shall apply); and the opinion of its auditor (referring to an auditor under subparagraph 7 of Article 2 of the Act on External Audit of Stock Companies; hereinafter the same shall apply) and tax payment records;
5. Any of the following information, as referred to in subparagraph 1 (e) of Article 2 of the Act:
(a) Information on court's rulings on adjudication of adult guardianship, limited guardianship, and specific guardianship, decisions on disappearance, adjudication on rehabilitation, simplified rehabilitation and individual rehabilitation, decisions on adjudication of bankruptcy, decisions related to exemption and reinstatement, decisions on entry in a register of defaulters or revocation thereof, and decisions related to auction, such as decisions on the commencement of auction and permission for a successful bid;
(b) Information on national taxes, local taxes, customs duties, or State credits in arrears;
(c) Information on fines, administrative fines, penalty surcharges, additional collection charges, etc. in arrears;
(d) Information on social insurance premiums, public utility charges, or fees;
(e) Information on government procurement records, amount of import or export, etc., which are related to the operation of enterprises;
(f) Information on the resident registration of individuals, such as information on birth, death, emigration or absence and information on changes in resident registration numbers and names;
(g) Information on the registration of companies, such as incorporation, suspension and discontinuance of business, transfer and acquisition, division and merger, and changes in stocks or equities;
(h) Information on commercial transactions, including financial transactions, among information on administrative disposition taken by the State, local governments or public institutions in accordance with other statutes;
(i) Information determined and publicly notified by the Financial Services Commission concerning the matters related to the records on provision of credit information by a credit bureau or credit rehabilitation of an owner of credit information, etc.;
(j) Information similar to the information referred to in subparagraph 1 (a) through (d) of Article 2 of the Act and the information similar to that referred to in items (a) through (i) of this subparagraph, determined and publicly notified by the Financial Services Commission.;
(k) Information newly generated by utilizing the information set forth in subparagraph 1 (a) through (d) of Article 2 of the Act and the information set forth in items (a) through (j) of this subparagraph to determine the credit status of an owner of credit information if it is an individual, determined and publicly notified by the Financial Services Commission;
(l) Information newly generated by utilizing the information set forth in subparagraph 1 (a) through (d) of Article 2 of the Act and the information set forth in item (a) through (k) of this subparagraph to determine the credit status of an owner of credit information if it is an enterprise or corporation, determined and publicly notified by the Financial Services Commission;
(m) Information newly generated by comprehensively appraising the technology (referring to the technology defined in subparagraph 1 of Article 2 of the Technology Transfer and Commercialization Promotion Act; hereinafter the same shall apply) of an owner of credit information and the technology level, marketability, feasibility, etc. related thereto and utilizing the information referred to in subparagraph 1 (a) through (d) of Article 2 of the Act and the information referred to in items (a) through (l) of this subparagraph to determine the credit status of the relevant owner of credit information if it is an enterprise or a corporation, as determined and publicly notified by the Financial Services Commission (hereinafter referred to as "technological credit information").
(2) The term "information prescribed by Presidential Decree" in subparagraph 2 of Article 2 of the Act means information (including the information alone with which the relevant individuals may not be identified; however, with which the relevant individuals may be identified in conjunction with other information on such individuals) on living individuals who can be identified by names, resident registration numbers, etc., among individuals’ credit information referred to in paragraph (1), but excluding information on a company and a corporation. <Amended by Presidential Decree No. 27786, Jan. 10, 2017>
(3) The term "person prescribed by Presidential Decree" in subparagraph 7 of Article 2 of the Act means any of the following persons: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. Any postal government agency under the Postal Savings and Insurance Act;
2. The National Federation of Mutual Savings Banks under the Mutual Savings Banks Act;
3. Any small and medium enterprise start-up investment company and any small and medium enterprise start-up investment cooperative under the Support for Small and Medium Enterprise Establishment Act;
4. Any bonds registrar under the Government Bond Act and the Registration of Bonds and Debentures Act;
5. Any cooperative, credit union, or any national federation or association thereof established under any Special Act;
6. Any corporation, public corporation, bank, guarantee fund, guarantee foundation, or any national federation or association thereof established under any Special Act;
6-2. Any of the following corporations or organizations, which is incorporated under a Special Act:
(a) A mutual aid cooperative;
(b) A mutual aid association;
(c) Any other similar corporation or organization that renders mutual aid services, which are organized by members engaging in the same workplace or same type of occupation, or residing in the same area for the purposes of mutual aid, promotion of welfare, etc.;
7. Any auditor;
8. Other persons determined and publicly notified by the Financial Services Commission.
(4) The term "claims prescribed by Presidential Decree" in subparagraph 11 of Article 2 of the Act means monetary claims that may be subject to compulsory execution under Article 24, 26 or 56 of the Civil Execution Act.
 Article 3 (Services Incidental to Credit Investigation Business and Claims Collection Business)
The services incidental to credit investigation business and claims collection business referred to in Article 4 (1) of the Act shall be any of the following services rendered in the course of running the relevant business:
1. Services to investigate the current status and prices of leasehold of immovables and movables;
2. Services to provide creditors, etc. with a claims management system and consultancy in relation to establishment of the claims management system (limited to the cases of claims collection business);
3. Other services determined and publicly notified by the Financial Services Commission.
[This Article Wholly Amended by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 4 (Application for Business Permission)
A person who intends to obtain permission to conduct credit information business referred to in Article 4 (2) of the Act, shall submit to the Financial Services Commission an application determined and publicly notified by the Financial Services Commission (including an application via electronic document) with the documents set forth in each of the following subparagraphs attached. In such cases, the Financial Services Commission shall verify the certificate of corporate registration by using shared administrative information in accordance with Article 36 (1) of the Electronic Government Act: <Amended by Presidential Decree No. 22151, May 4, 2010; Presidential Decree No. 23076, Aug. 17, 2011>
1. Articles of incorporation;
2. Documents stating the capital or the equity share of fundamental property;
3. Financial statements;
4. Business plans and a statement of forecast income and expenditure statement for two years;
5. Other documents determined by the Financial Services Commission.
 Article 5 (Those Qualified for Permission by Type of Credit Information Business)
(1) "Financial institutions prescribed by Presidential Decree" in Article 5 (1) 1 of the Act means any of the following institutions: Provided, That cases set forth in subparagraphs 9 through 14 means only the association or national federation thereof: <Amended by Presidential Decree No. 22220, Jun. 28, 2010; Presidential Decree No. 22493, Nov. 15, 2010; Presidential Decree No. 25945, Dec. 30, 2014; Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 27037, Mar. 11, 2016; Presidential Decree No. 27205, May 31, 2016; Presidential Decree No. 27556, Oct. 25, 2016; Presidential Decree No. 28152, Jun 27, 2017>
1. Any financial institution authorized and established by the Banking Act (including a person deemed a bank under Article 59 of the same Act);
2. Any financial holding company under the Financial Holding Companies Act;
3. The Korea Development Bank under the Korea Development Bank Act;
4. The Export-Import Bank of Korea under the Export-Import Bank of Korea Act;
5. The Nonghyup Bank under Article 161-11 of the Agricultural Cooperatives Act;
5-2. The Suhyup Bank under the Fisheries Cooperatives Act;
6. The Industrial Bank of Korea under the Industrial Bank of Korea Act;
7. The Korea Housing Finance Corporation under the Korea Housing Finance Corporation Act;
8. A financial investment business entity, a securities financial company, a merchant bank, a financial brokerage company, and a transfer agency under the Financial Investment Services and Capital Markets Act;
9. Mutual savings banks and the national federation thereof under the Mutual Savings Banks Act;
10. Agricultural cooperatives and the national federation thereof under the Agricultural Cooperatives Act;
11. Fisheries cooperatives and the national federation thereof under the Fisheries Cooperatives Act;
12. Forestry cooperatives and the national federation thereof under the Forestry Cooperatives Act;
13. Credit unions and the national federation thereof under the Credit Unions Act;
14. Community credit cooperatives and the federation thereof under the Community Credit Cooperatives Act;
15. Any insurance company under the Insurance Business Act;
16. Any specialized credit financial business company under the Specialized Credit Financial Business Act (including any person permitted or registered under Article 3 (3) 1 of the Specialized Credit Financial Business Act);
17. The Korea Technology Finance Corporation under the Korea Technology Finance Corporation Act;
18. The Credit Guarantee Fund under the Credit Guarantee Fund Act;
19. Credit guarantee foundations and the national federation thereof under the Regional Credit Guarantee Foundation Act;
20. The Korea Trade Insurance Corporation under the Trade Insurance Act;
21. The Korea Deposit Insurance Corporation and financial companies for resolution under the Depositor Protection Act;
22. Any financial institution that runs a financial business similar to such financial institutions as provided for in subparagraphs 1 through 20 in a foreign country;
23. Any person who has been established under a statute of a foreign country and engages in any of the business activities provided for in Article 4 (1) 1 through 3 of the Act.
(2) Deleted. <by Presidential Decree No. 26517, Sep. 11, 2015>
 Article 6 (Detailed Requirements, etc. for Permission)
(1) Any person who intends to obtain permission for credit information business referred to in Article 6 (1) and (3) of the Act, shall satisfy the following detailed requirements in relation to the personnel and physical facilities: <Amended by Presidential Decree No. 24697, Aug. 27, 2013; Presidential Decree No. 26517, Sep. 11, 2015>
1. Where engaging in credit inquiry business, the following detailed requirements shall be satisfied:
(a) The person shall employ regular employees including a certified public accountant or at least ten persons who have experiences in credit inquiry services (including credit information analysis services) or have worked at a credit information collection agency for not less than three years;
(b) The person shall furnish the information processing and communication facilities determined and publicly notified by the Financial Services Commission to be necessary to adequately process credit information;
2. Where credit investigation business and claims collection business are separately or jointly conducted, at least 20 regular employees shall be employed;
3. Deleted. <by Presidential Decree No. 24697, Aug. 27, 2013>
(2) The business plans referred to in Article 6 (1) 2 of the Act shall be in compliance with the following requirements:
1. Income and expense outlooks shall be reasonable and implementable;
2. The organizational structure, governance and management structure on the business plans shall be appropriate to proceed with the business plans and shall not hamper the sound credit information business through conflict of interests, unfair practices, etc.
(3) "Major investors prescribed by Presidential Decree" in Article 6 (1) 3 of the Act means any of the following persons: <Amended by Presidential Decree No. 28283, Sep. 5, 2017>
1. A principal where, on the basis of the total outstanding shares with voting rights or total equity investments, a principal and a person, with whom the principal has a relationship falling under any subparagraph of Article 3 (1) of the Enforcement Decree of the Act on Corporate Governance of Financial Companies (hereinafter referred to as "related person") hold, under anyone's name, the largest number of shares or the highest equity interest with his/her own funds (hereinafter referred to as "largest shareholder");
2. Any of the following persons where the largest shareholder is a corporation:
(a) The largest shareholder of the relevant corporation (if the actual controlling person of the relevant corporation is not the largest shareholder of the relevant corporation, the actual controlling person shall be also included);
(b) The representative of the corporation;
3. A shareholder or investor who is an related person of the largest shareholder;
4. A person who holds, under anyone's name, shares or equity interest with his/her own funds, and the total sum thereof amounts to 10/100 or greater of the total outstanding shares with voting rights or the total equity investments;
5. A shareholder or investor who exercises a de facto influence over key management matters of the relevant corporation, including dismissal of executive officers, and falls under any of the following items:
(a) A shareholder or investor who, individually or in accordance with an agreement or a contract with other shareholders or investors, has appointed a representative director or the majority of directors;
(b) A shareholder or an investor determined by the Financial Services Commission and deemed to exercise a controlling influence over the key decisions or business executions, including management strategy, organizational changes.
(4) The major investors under paragraph (3) shall fulfil the requirements set forth in attached Table 1.
 Article 7 (Capital)
"Amount determined by Presidential Decree" in Article 6 (2) 2 of the Act means three billion won.
 Article 8 (Matters to Declare and Report)
(1) "Any matter prescribed by Presidential Decree" in the main sentence of Article 8 of the Act means any of the following subparagraphs:
1. Reduction of capital or basic assets;
2. Changes in the articles of incorporation, including the trade name.
(2) "Insignificant matters prescribed by Presidential Decree" in the proviso to Article 8 of the Act means any of the following subparagraphs:
1. Changes in the representative and executive officers;
2. Reflecting any amendment of statutes or matters authorized or permitted pursuant to statutes;
3. Matters concerning changes in provisional structure, wording, etc. that do not entail any substantial change in the details of the articles of incorporation.
 Article 9 (Approval, etc. for Change in Controlling Shareholder, etc)
(1) "A controlling shareholder prescribed by Presidential Decree" in Article 9 (1) of the Act means any of the following persons: Provided, That the State, the Korea Deposit Insurance Corporation under the Depositor Protection Act, and a person who holds less than 1/100 of the shares with voting rights shall be excluded therefrom: <Amended by Presidential Decree No. 23076, Aug. 17, 2011>
1. In cases of a credit investigation company (referring to a person permitted to engage in credit investigation business referred to in Article 4 of the Act; hereinafter the same shall apply), a claims collection agency (referring to a person permitted to engage in claims collection business referred to in Article 4 of the Act; hereinafter the same shall apply), and credit bureau (referring to a person permitted to engage in credit inquiry business under Article 4 of the Act; hereinafter the same shall apply), any of the following persons:
(a) A major investor defined in Article 6 (3) 1 and 3, or 5;
(b) A person who holds, under anyone's name, shares or equity interest with his/her own funds, and the total sum thereof amounts to at least 30/100 of the total outstanding shares with voting rights or the total equity investments;
2. Deleted. <by Presidential Decree No. 24697, Aug. 27, 2013>
(2) "Requirements prescribed by Presidential Decree" in Article 9 (1) of the Act means the requirements for a major investor under attached Table 1.
(3) A person who intends to obtain approval referred to in Article 9 (1) of the Act, shall submit to the Financial Services Commission an application for approval determined and publicly notified by the Financial Services Commission with the following documents attached: <Amended by Presidential Decree No. 23076, Aug. 17, 2011; Presidential Decree No. 26517, Sep. 11, 2015>
1. Articles of incorporation (including the document corresponding thereto; applicable only to a corporation);
2. In cases of a foreign company, the document corresponding to the certificate of corporate registration;
3. The financial statements as at the end of the latest business year or an interim financial statement if a half term has elapsed after the end of the latest business year (applicable only to a corporation);
4. The audit report and review report prepared by an auditor with regard to the financial statements under subparagraph 3;
5. Other documents determined by the Financial Services Commission to be necessary for the review of the approval requirements.
(4) The Financial Services Commission shall, upon receipt of an application for approval referred to in paragraph (3), verify the following administrative information by using shared administrative information under Article 36 (1) of the Electronic Government Act: <Amended by Presidential Decree No. 22151, May 4, 2010; Presidential Decree No. 22467, Nov. 2, 2010; Presidential Decree No. 23076, Aug. 17, 2011>
1. A certificate of corporate registration (applicable only to a domestic corporation);
2. A certified transcript of the resident registration card or a business registration certificate;
3. A certificate of corporate registration of a credit information company, of which a person intends to become a controlling shareholder.
(5) Where the Financial Services Commission has received an application for approval referred to in paragraph (3), it shall review its details, determine whether to approve it within 60 days, and notify, in writing, the applicant of the result thereof and ground therefor. In such cases, if any error exists in the application for approval, it may request the applicant to redress it.
(6) When calculating the review period referred to in paragraph (5), the period determined by the Financial Services Commission, including the period to correct any error in the application for approval, shall not be counted in the review period.
(7) Where the Financial Services Commission orders the disposition of any share acquired without approval referred to in Article 9 (2) of the Act, it shall order in writing by stating the number of shares to be disposed of, due date of disposition, etc.
(8) Necessary matters, other than those provided for in paragraphs (1) through (7), with regard to the methods and procedures to apply for approval for modification, or detailed standards for the requirements under paragraph (2), etc. shall be determined and publicly notified by the Financial Services Commission.
 Article 10 (Authorization of Transfer, Acquisition by Transfer, etc. of Credit Information Business)
(1) Where the Financial Services Commission intends to authorize credit information business to conduct a transfer and/or acquisition by transfer, or division and/or merger referred to in Article 10 (1) of the Act, it shall review whether the following requirements are fulfilled:
1. For transfer:
(a) It shall be inevitable, given the management and financial standing, etc. of the credit information company concerned;
(b) It shall not hinder the protection of owners of credit information and the maintenance of sound practices in credit transaction;
(c) It shall not have any defect in implementing the procedures under the Commercial Act and other relevant statutes;
2. For acquisition by transfer, division and merger:
(a) It shall not hinder the efficiency of credit information business and the maintenance of sound practices in credit transaction;
(b) Business plans and organizational operation plans in connection with a transfer, division and merger shall be appropriate;
(c) Changes in the corporate ownership structure of a credit information company arising from transfer, division and merger shall comply with relevant statutes;
(d) It shall not hinder the performance of procedures under the Commercial Act and other relevant statutes.
(2) The Financial Services Commission may determine and publicly notify the detailed requirements, application documents, and other necessary matters for authorization under Article 10 (1) of the Act.
 Article 11 (Concurrent Operation of Business)
"Cases prescribed by Presidential Decree" in Article 11 (1) 2 of the Act means any of the following cases: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. Where allowed by relevant statutes, including cases where an asset manager commissions a claims collection agency to issue on his/her behalf a certificate of liability under Article 10 of the Asset-Backed Securitization Act;
2. Where a foreign creditor commissions a claims collection agency to issue on his/her behalf a certificate of liability.
 Article 11-2 (Scope of Public Organizations Entitled to Entrust Investigation, Analysis, etc. to Credit Bureau)
"Public organization prescribed by Presidential Decree" in the proviso to Article 11 (2) of the Act means any of the following institutions: <Amended by Presidential Decree No. 27511, Sep. 22, 2016>
1. A public institution defined in Article 4 of the Act on the Management of Public Institutions;
2. An institution to which the State or a local government invests, contributes or subsidizes its capital, funds or expenses, as determined and publicly notified by the Financial Services Commission;
3. A special-purpose corporation incorporated under a special Act;
4. A clearing-house designated under the Bills of Exchange and Promissory Notes Act and the Check Act and an electronic bill management agency designated under Article 3 of the Issuance and Distribution of Electronic Bills Act;
5. Schools of various levels established under the Elementary and Secondary Education Act, the Higher Education Act or other Acts, and an industry-academic cooperation foundation established under Article 25 of the Industrial Education Enhancement and Industry-Academia-Research Cooperation Promotion Act;
6. A premium rate calculation agency under the Insurance Business Act;
7. The Credit Counseling and Recovery Service under Article 56 of the Microfinance Support Act;
8. A credit information collection agency permitted by the Financial Services Commission pursuant to Article 25 of the Act;
9. Any other institution determined and publicly notified by the Financial Services Commission.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 12 (Deferment of Revocation of Permission, etc.)
"Ground prescribed by Presidential Decree" in the proviso to Article 14 (1) of the Act means the case amounting to a ground for revocation of permission or authorization referred to in Article 14 (1) 2 through 4 or 9 of the Act: Provided, That cases where a corrective order is deemed of little practical use as a ground for is highly likely to be unresolved or to harm the public interest, etc. shall be excluded.
 Article 13 (Restrictions on Collection, Investigation and Processing)
"Purposes prescribed by Presidential Decree" in Article 16 (2) of the Act means the use of information on an individual's disease by any of the following persons, where necessary to conduct the relevant business as follows: <Amended by Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 28918, May 28, 2018>
1. Insurance business conducted by an insurance company under the Insurance Business Act;
2. Incidental business affairs prescribed in Article 46 (1) 7 of the Specialized Credit Finance Business Act, conducted by a credit card company under said Act, upon receipt of fees from credit card holders, to exempt or delay the repayment of debts for which the credit card holders are (only referring to debts in regard to subparagraph 2 (b) of Article 2 of said Act) where the credit card holders have specific accidents arising from death or disease;
3. Insurance business conducted by a postal service agency under the Postal Savings and Insurance Act;
4. Mutual aid services rendered by any of the following corporations or organizations incorporated under special Acts:
(a) A mutual aid cooperative;
(b) A mutual aid association;
(c) Any other similar corporation or organization that renders mutual aid services, which is organized by members engaging in the same workplace or same type of occupation, or residing in the same area, for the purposes of mutual aid, promotion of welfare, etc.;
5. Any other business prescribed by Ordinance of the Prime Minister, other than business prescribed in subparagraphs 1 through 4, conducted by financial institutions prescribed in Article 21 (2) to economically benefit financial consumers or prevent damage to financial consumers.
 Article 14 (Outsourcing the Processing of Collected Information)
(1) "Another person who satisfies requirements prescribed by Presidential Decree, including a given amount of capital" in Article 17 (2) of the Act means a company which has capital or the total amount of capital (referring to the amount computed by the deduction of total deficit from total amount of assets in the balance sheet) of at least 100 million won and falls under any of the following subparagraphs: <Amended by Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 27070, Mar. 29, 2016>
1. A person who has designated a credit information administrator/guardian under the main sentence of Article 20 (3) of the Act;
2. A person who has designated a personal information manager under Article 31 of the Personal Information Protection Act;
3. A person who has designated a chief information security officer under Article 21-2 of the Electronic Financial Transactions Act;
4. A person who has designated a person responsible for management of personal information under Article 27 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.
(2) "A person prescribed by Presidential Decree" in Article 17 (3) of the Act means a credit information company, credit information collection agency, and financial institution determined and publicly notified by the Financial Services Commission under Article 5 (1).
(3) A person who intends to outsource the processing of credit information under Article 17 (3) of the Act, shall inform the Financial Services Commission of the scope of credit information provided, purpose and period of provision thereof, customer information management system, etc. in such format as determined and publicly notified by the Financial Services Commission, by no later than seven business days from the date when the outsourcing contract is expected to be executed: Provided, That where it is not particularly necessary to inform such matters in advance, as determined and publicly notified by the Financial Services Commission, they shall be informed by no later than a period determined and publicly notified by the Financial Services Commission commencing from the date of concluding an outsourcing contract. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(4) In providing any personal credit information under Article 17 (4) of the Act, a credit information company, etc. shall take protective measures classified as follows: <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
1. Where it is provided through an information and communications network or auxiliary storage medium: Construction of a security server or encryption in accordance with the procedures and methods determined and publicly notified by the Financial Services Commission, and other protective measures determined and publicly notified by the Financial Services Commission;
2. Where it is provided through any means, other than those referred to in subparagraph 1: Sealing and other protective measures determined and publicly notified by the Financial Services Commission.
(5) Where a credit information company, etc. enters into or renews an outsourcing contract with an agent, it shall, under Article 17 (5) of the Act, reflect in the outsourcing contract that it will conduct education for executive officers and/or employees of the agent on the prevention of loss, theft, disclosure, alteration and compromise of credit information, and safe processing of credit information at least once a year (where the period of outsourcing is shorter than one year, it means at least once during such period; hereafter the same shall apply in this paragraph), and shall conduct the education in accordance with the outsourcing contract. In such cases, if it is provided for in the outsourcing contract that the agent shall conduct such education for the executive officers and/or employees under his/her control at least once a year and if a credit information company, etc. confirms that the agent has conducted the relevant education in accordance with the outsourcing contract, the credit information company, etc. shall be deemed to have conducted the education for executive officers and/or employees of the agent. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
(6) Except as prescribed in paragraphs (3) through (5), details to be reflected in an outsourcing contract, and other necessary details to entrust the processing of collected credit information shall be determined and publicly notified by the Financial Services Commission. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
 Article 15 (Keeping Credit Information Accurate and Up-to-Date)
(1) Where a credit information provider/user intends to provide credit information for a credit information collection agency or a credit bureau, he/she shall verify accuracy thereof not to register inaccurate information in accordance with Article 18 (1) of the Act.
(2) A credit information collection agency and credit bureau shall formulate the standards and procedures to examine the accuracy of credit information to be registered, to accordingly verify and manage the accuracy of credit information to be registered.
(3) A credit information company, credit information collection agency and credit information provider/user (hereinafter referred to as "credit information company, etc.") shall register, modify and manage credit information in accordance with the standards and procedures determined and publicly notified by the Financial Services Commission so as to keep credit information accurate and up-to-date.
(4) Types of credit information that must be deleted from the list of information to be registered and managed in accordance with Article 18 (2) of the Act shall be as follows: <Amended by Presidential Decree No. 23076, Aug. 17, 2011; Presidential Decree No. 26517, Sep. 11, 2015>
1. Information on delinquency, dishonor, payments by subrogation and substitute payments, among the credit information under Article 2 (1) 3;
2. Information on acts of disrupting sound practices in credit transaction among the credit information under Article 2 (1) 3;
3. Information on a court's decisions on adjudication of bankruptcy, decisions related to exemption and reinstatement, and decisions on rehabilitation, simplified rehabilitation, and individual rehabilitation, among the credit information under Article 2 (1) 5 (a);
4. Information on arrears under Article 2 (1) 5 (b) and (c);
5. Information on arrears among the credit information under Article 2 (1) 5 (d);
6. Other credit information on disadvantages that is comparable to the information referred to in subparagraphs 1 through 5, as determined and publicly notified by the Financial Services Commission.
(5) The period of use and preservation of credit information under each subparagraph of paragraph (4) shall be determined and publicly notified by the Financial Services Commission within the scope of three to five years: Provided, That the Financial Services Commission may shorten the period of use and preservation, taking into consideration the characteristics and the purpose, frequency, etc. of use of the credit information. <Newly Inserted by Presidential Decree No. 23076, Aug. 17, 2011>
(6) Necessary details concerning the methods, standards, procedures, etc. for deleting credit information under each subparagraph of paragraph (4) shall be determined and publicly notified by the Financial Services Commission. <Newly Inserted by Presidential Decree No. 23076, Aug. 17, 2011>
 Article 16 (Formulation of Technological, Physical, and Administrative Security Measures)
(1) Pursuant to Article 19 (1) of the Act, a credit information company, etc. shall formulate technological, physical and administrative security measures that include the following in order to protect the security of the credit information computer system:
1. Matters concerning installation and operation of the access control equipment to block illegal access to credit information by a third party, including intrusion prevention system;
2. Matters concerning prevention of alteration, tampering, and destruction of the information entered in the credit information computer system;
3. Matters concerning granting of various kinds of permission for credit information treatment and inquiry depending on user positions and roles, and matters concerning periodic examination of logs of credit information inquiries;
4. Other matters required to ensure the security of credit information.
(2) The Financial Services Commission may determine and publicly notify the details of the matters under each subparagraph of paragraph (1).
 Article 16-2 (Obligation of Credit Information Companies, etc. to Maintain Records)
A credit information company, etc. shall archive the records concerning the matters classified as follows for three years pursuant to Article 20 (2) of the Act:
1. Where any personal credit information is collected and used: The person who has collected and used the relevant information, date the information is collected and used, details of the information collected and used, and reasons and grounds for collecting and using the same;
2. Where any personal credit information is provided: The person who has provided the relevant information, date the information is provided, details of the information provided, and reasons and grounds for the provision thereof;
3. Where any personal credit information is discarded: The person who has discarded the relevant information, date the information is discarded, details of information discarded, and reasons and grounds for the discarding thereof.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 17 (Appointment, etc. of Credit Information Administrator/Guardian)
(1) "A credit information provider/user prescribed by Presidential Decree" in the main sentence of Article 20 (3) of the Act means a person who falls under Articles 5 (1) 1 through 21 and 21 (2) 1 through 21. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(2) "Person prescribed by Presidential Decree taking into consideration total assets, number of employees, etc." in the proviso to Article 20 (3) of the Act means any of the following persons: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. A centralized credit information collection agency defined in Article 25 (2) 1 of the Act (hereinafter referred to as "centralized credit information collection agency");
2. A credit bureau;
3. A credit investigation company, a claims collection company, and a person prescribed in paragraph (1), whose total assets as at the end of the immediately preceding business year is at least two trillion won and the number of employees at ordinary times is at least 300 persons. In such cases, the method of calculating the number of employees at ordinary times shall be determined and publicly notified by the Financial Services Commission.
(3) A credit information administrator/guardian appointed pursuant to the main sentence of Article 20 (3) of the Act shall fall under any of the following subparagraphs: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. An internal director;
2. An executive director (limited to where it has an executive director under Article 408-2 of the Commercial Act);
3. A person who falls under Article 401-2 (1) 3 of the Commercial Act and is authorized to execute affairs related to the provision, utilization, protection, management, etc. of credit information;
4. Any third person in a position generally managing the provision, utilization, protection, management, etc. of credit information.
(4) A credit information administrator/guardian to be designated pursuant tothe proviso to Article 20 (3) of the Act, shall be a person who falls under any of paragraph (3) 1 through 3. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(5) Notwithstanding paragraphs (3) and (4), if a credit information company, etc. has a compliance officer appointed under other statutes, it may designate him/her as a credit information administrator/guardian: Provided, That in cases falling under the proviso to Article 20 (3) of the Act, a compliance officer who can be designated as a credit information administrator/guardian shall fall under any of paragraph (2) 1 through 3. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(6) In case of designating a compliance officer as a credit information administrator/guardian pursuant to paragraph (5), matters concerning duties in each subparagraph of Article 20 (4) of the Act shall be reflected in the internal control standards prescribed in the statute according to which such compliance officer has been appointed. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
 Article 17-2 (Methods of Managing Personal Credit Information, etc.)
(1) A credit information provider/user shall, pursuant to Article 20-2 (1) of the Act, manage personal credit information of the owner of credit information with whom a commercial transaction relationship, including financial transactions, is terminated (excluding employment relationship; hereinafter the same shall apply), in the manner classified as follows:
1. In cases of personal credit information which is essential to establish, maintain, etc. a commercial transaction relationship including financial transactions: Any of the following methods:
(a) Separating personal credit information from the information of other owners of credit information with whom a commercial transaction relationship is not terminated;
(b) Designating a person entitled to access the relevant personal credit information, from among the executive officers and/or employees of the credit information provider/user, in accordance with the procedures determined and publicly notified by the Financial Services Commission;
(c) Other methods to ensure safe protection of personal credit information of the relevant owners of credit information, which are determined and publicly notified by the Financial Services Commission;
2. In cases of any personal credit information, other than that falling under subparagraph 1: Deleting all the relevant information.
(2) A credit information provider/user shall, upon termination of a commercial transaction relationship, including financial transactions, etc., take the following matters, etc. into consideration when he/she divides personal credit information into essential personal credit information classified in subparagraphs of paragraph (1) and other personal credit information:
1. Whether the terminated a commercial transaction relationship might not have been established or maintained without the relevant personal credit information;
2. Whether the relevant personal credit information is directly related to the goods or services provided to the owner of credit information in accordance with the terminated a commercial transaction relationship (including where a third party who entered into a separate contract, agreement, etc. with the credit information provider/user has provided goods or services as agreed to be provided in the commercial transaction relationship that the owner of credit information requested to the credit information provider/user);
3. Whether it is impractical to perform any obligation under the Act or any other statutes, if the relevant personal credit information is deleted.
(3) "Cases prescribed by Presidential Decree" in Article 20-2 (2) 3 of the Act means any of the following cases: <Amended by Presidential Decree No. 27511, Sep. 22, 2016>
1. Where necessary for the payment of dormant deposits (referring to dormant deposits defined in subparagraph 3 of Article 2 of the Microfinance Support Act);
2. Where the personal credit information of an owner of credit information involved in a transaction conducted by using any other person's credit card information acquired by loan fraud, insurance fraud, or fraudulent or other wrongful means, is necessary to prevent such transaction and other acts that impede sound practices in credit transactions;
3. Where necessary for constructing a risk management system and the development of credit evaluation models and risk management models referred to in Article 4 (1) 1 (b) of the Act. In such cases, measures shall be taken to make unidentifiable the individual owner of credit information, except where it is essential for performing obligations under other Acts;
4. Where necessary to achieve the legitimate interests of a credit information provider/user or a third party and such cause takes obvious precedence over the rights of the owner of credit information. In such cases, it shall be limited to where the legitimate interests of the credit information provider/user or a third party are considerably involved, not exceeding the reasonable scope;
5. Where the owner of credit information clearly expresses his/her intent not to have his/her personal credit information (excluding personal credit information provided for in subparagraphs of Article 15 (4)) deleted, before deletion.
(4) The date a commercial transaction relationship, including financial transactions, referred to in Article 20-2 (1) or (2) of the Act, is terminated shall be the date the commercial transaction relationship between a credit information provider/user and an owner of credit information is terminated due to the extinguishment of obligation, exercise of right to termination, right to rescission or right to revoke, the completion of extinctive prescription, repayment, etc., or due to any other cause.
(5) When a credit information provider/user obtains consent pursuant to the main sentence of Article 15 (2) of the Act or the forepart of Article 32 (2) of the Act, he/she shall notify the owner of credit information of the date commercial transaction relationship, including financial transactions, is terminated under paragraph (4).
(6) In deleting the personal credit information of an owner of credit information pursuant to paragraph (1) 2 or the main sentence of Article 20-2 (2) of the Act, the credit information provider/user shall take measures to ensure that the deleted personal credit information is not restored or recovered.
(7) Where a credit information provider/user manages personal credit information pursuant to Article 20-2 (3) of the Act, he/she shall adopt methods prescribed in subparagraphs of paragraph (1) 1.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 18 (Disqualifications of Persons Engaged in Credit Inquiry Business)
"A person prescribed by Presidential Decree" in Article 22 (1) 7 of the Act means a person who was an executive officer and/or employee at the time any ground for revocation of permission, authorization, etc. occurred (the executive officer and/or employee at the time any ground for prompt corrective measures occurred under Article 10 of the same Act, in cases of a corporation or company, the permission, the authorization, etc. of which has been revoked under Article 14 of the Act on the Structural Improvement of the Financial Industry), and falls under any of the following subparagraphs: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. An auditor or a member of the Audit Committee;
2. An executive officer who has been subject to caution, warning, reprimand, suspension of performance of his/her duties, demand for dismissal, or any other measure taken by the Financial Services Commission or the Governor of the Financial Supervisory Service (referring to the Financial Supervisory Service under the Act on the Establishment, etc. of Financial Services Commission; hereinafter the same shall apply) on grounds of unlawful or wrongful practices in connection with the occurrence of a ground for revocation of permission, authorization, etc.;
3. An employee who has been subject to suspension of performance of his/her duties or severer measures taken by the Financial Services Commission or the Governor of the Financial Supervisory Service (hereinafter referred to as “FSS Governor") on the grounds of unlawful or wrongful practices in connection with the occurrence of a ground for revocation of permission, authorization, etc.;
4. A person who has resigned from office or retired before the disciplinary measure referred to in subparagraph 2 or 3 is duly taken against him/her.
 Article 18-2 (Reporting on Credit Information, etc.)
(1) A credit bureau shall, pursuant to Article 22-2 of the Act, submit to the Financial Services Commission a report on the business matters of the following subparagraphs carried out during the previous year, not later than January 31 of the next year:
1. Matters relating to those subject to the collection and investigation of credit information, the types of information collected, investigated, and processed, etc.;
2. Matters relating to those who are provided with credit information, the scope of such provision, etc.;
3. Matters relating to the period of use and preservation of credit information, etc.
(2) Where the report made pursuant to paragraph (1) is deemed to be contrary to sound practices in credit transaction or financial consumers' rights and interests, the Financial Services Commission may recommend the relevant credit bureau to improve business processes, etc. related to such report.
[This Article Newly Inserted by Presidential Decree No. 23076, Aug. 17, 2011]
 Article 19 (Requests, etc. for Provision of Credit Information to Public Institutions)
(1) "Public organization prescribed by Presidential Decree" in the forepart of the main sentence of Article 23 (2) of the Act means any of the following institutions: <Amended by Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 27511, Sep. 22, 2016>
1. A public institution determined and publicly notified by the Financial Services Commission under Article 4 of the Act on the Management of Public Institutions;
2. An institution determined and publicly notified by the Financial Services Commission, the capital, funds or expenses of which are invested, contributed, or subsidized by the State or local governments;
3. A special corporation determined and publicly notified by the Financial Services Commission, which is established under a Special Act;
4. A clearing house designated under the Bills of Exchange and Promissory Notes Act and the Check Act and an electronic bill management institution designated under Article 3 of the Issuance and Distribution of Electronic Bills Act;
5. Various levels of schools established pursuant to the Elementary and Secondary Education Act, the Higher Education Act and other Acts;
6. A premium rate calculating institution under the Insurance Business Act;
7. The Credit Counseling and Recovery Service under Article 56 of the Microfinance Support Act.
(2) "Credit information prescribed by Presidential Decree" in the forepart of the main sentence of Article 23 (2) of the Act means credit information defined in the following subparagraphs. In such cases, the specific scope of provision of credit information shall be determined in consultation with the heads of public institutions (referring to the State, a local government or a public organization under paragraph (1); hereafter the same shall apply in this Article) and a credit information collection agency: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. Information on the payment of premiums for employment insurance, industrial accident compensation insurance, national health insurance, and national pension;
2. Information on electric power consumption and payment of electric bills;
3. Information on the delivery of goods or services to the Government and the amount delivered;
4. Information on the deceased, resident registration number, and name changes;
5. Information on the declaration of foreign emigration and renunciation of emigration;
6. Credit information kept by a public institution, which may be provided to a credit information collection agency in accordance with the related statutes.
(3) A credit information collection agency which intends receive the information defined in each subparagraph of paragraph (2) pursuant to Article 23 (2) of the Act, shall request in writing, the head of a public institution to provide such credit information, and the head of a public institution which intends to provide the credit information concerned, shall provide it in the form of documents or periodic files, or through the Administrative Information-Sharing Center, etc. under Article 37 (1) of the Electronic Government Act. <Amended by Presidential Decree No. 22151, May 4, 2010; Presidential Decree No. 26517, Sep. 11, 2015>
(4) The Financial Services Commission shall determine and publicly announce the registration of and standards for use of the relevant information in consideration of the necessity to use the information provided by the heads of public institutions.
(5) "Credit information user prescribed by Presidential Decree" in Article 23 (3) of the Act means any of the following persons: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. A financial institution defined in any of Article 5 (1) 1 through 20;
2. A person defined in any subparagraph of Article 21 (2);
3. A credit bureau.
 Article 20 (Use of Computer Data of Resident Registration)
"Any credit information provider/user prescribed by Presidential Decree" in Article 24 (1) of the Act means a person falling under any subparagraph of Article 5 (1).
 Article 21 (Central Management and Utilization of Credit Information)
(1) A person who intends to be permitted as a credit information collection agency under Article 25 (1) of the Act, shall complete the application form determined and publicly notified by the Financial Services Commission (including an electronic application) with the following items; attach the articles of incorporation thereto, and submit it to the Financial Services Commission. In such cases, the Financial Services Commission shall verify the certificate of corporate registration by using shared administrative information under Article 36 (1) of the Electronic Government Act: <Amended by Presidential Decree No. 22151, May 4, 2010; Presidential Decree No. 23076, Aug. 17, 2011; Presidential Decree No. 26517, Sep. 11, 2015>
1. The name and address of the institution and name of the representative thereof;
2. The scope of credit information for central management and utilization and the person with whom to exchange the credit information;
3. The necessity for central management and utilization.
(2) "Financial institutions prescribed by Presidential Decree" in Article 25 (2) 1 of the Act means the financial institutions in Article 5 (1) 1 through 20 and any of the financial institutions: <Amended by Presidential Decree No. 22626, Jan. 17, 2011; Presidential Decree No. 23535, Jan. 25, 2012; Presidential Decree No. 26369, Jun. 30, 2015; Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 27037, Mar. 11, 2016; Presidential Decree No. 27322, Jul. 6, 2016; Presidential Decree No. 27511, Sep. 22, 2016; Presidential Decree No. 28918, May 28, 2018>
1. A mutual aid association under the Framework Act on the Construction Industry;
2. A claims registration institution under the Government Bond Act and the Registration of Bonds and Debentures Act;
3. The Korea Agro-Fisheries and Food Trade Corporation under the Korea Agro-Fisheries and Food Trade Corporation Act;
4. Credit Counseling and Recovery Service under Article 56 of the Microfinance Support Act;
5. Korea Labor Welfare Corporation under the Industrial Accident Compensation Insurance Act;
6. Korea Software Financial Cooperative under the Software Industry Promotion Act;
7. Engineering Financial Cooperative under the Engineering Industry Promotion Act;
8. A financial companies for resolution under the Depositor Protection Act;
9. A postal agency under the Postal Savings and Insurance Act;
10. Electric Contractors' Financial Cooperative under the Electric Constructors' Financial Cooperative Act;
11. Korea Housing and Urban Guarantee Corporation under the Housing and Urban Fund Act;
12. Small and Medium Business Corporation under the Small and Medium Enterprises Promotion Act;
13. A venture capital and a venture capital cooperative under the Support for Small and Medium Enterprise Establishment Act;
14. Korea Federation of Small and Medium Business under the Small and Medium Enterprise Cooperatives Act;
15. Korea Student Aid Foundation under the Act on the Establishment, etc. of Korea Student Aid Foundation;
16. Korea Asset Management Corporation under the Act on the Efficient Disposal of Non-Performing Assets, etc. of Financial Companies and the Establishment of Korea Asset Management Corporation;
17. National Happiness Fund, Co., Ltd. incorporated under the Commercial Act;
18. Korea Inclusive Finance Agency under Article 3 of the Microfinance Support Act;
19. A credit service provider registered with the Financial Services Commission pursuant to Article 3 (2) of the Act on Registration of Credit Business, etc. and Protection of Finance Users;
20. Machinery Financial Cooperative under Article 40 (1) 1 of the Industrial Development Act;
21. Small Enterprise and Market Service under Article 17 (1) of the Act on the Protection of and Support for Micro Enterprises;
22. A special purpose company which has registered its asset-backed securitization plan with the Financial Services Commission under the Asset-Backed Securitization Act;
23. An asset management company for agricultural cooperatives under Article 29 of the Act on the Structural Improvement of Agricultural Cooperatives.
(3) The scope of the credit information centrally managed and utilized by a centralized credit information collection agency shall be specified in attached Table 2: Provided, That the Financial Services Commission may, if deemed necessary, determine and publicly notify any additional information that shall be centrally managed and utilized, other than the information in attached Table 2. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(4) An individual credit information collection agency under Article 25 (2) 2 of the Act shall determine the scope of information subject to central management and utilization by agreement, etc. among business owners of the same type and reflect it to its articles of incorporation. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(5) A person who intends to be permitted as a credit information collection agency shall meet all of the requirements classified as follows to ensure the public nature and neutrality under Article 25 (3) 2 of the Act: <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
1. In cases of a centralized credit information collection agency: The following requirements:
(a) It shall have a risk management system to prevent disclosure, etc. of credit information and an internal control system to protect the rights and interests of owners of credit information;
(b) Where it performs any duties, other than those prescribed in subparagraphs of Article 25-2 of the Act (hereafter referred to as "duties of the collection agency" in this Article), it shall establish a system to prevent conflicts of interests, such as distinguishing the duties of the collection agency from any other duties;
(c) It shall not violate any statute and not be likely to impede sound practices in credit transactions;
(d) It shall prepare a plan to organize its employees and business process methods so as to guarantee the neutrality of business performance among financial institutions in Article 5 (1) 1 through 20 and institutions in subparagraphs of Article 21 (2) or among groups of such institutions classified by type, characteristics of business, etc. and to secure the representativeness of such groups;
2. In cases of an individual credit information collection agency: Requirements prescribed in subparagraph 1 (a) through (c).
(6) A person who intends to be permitted as a credit information collection agency under Article 25 (3) 3 of the Act shall meet the following specific requirements for physical facilities and personnel: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. He/she shall furnish the information processing and information communication facilities determined and publicly notified by the Financial Services Commission, as necessary to adequately perform the central management and utilization of credit information;
2. He/she shall employ regular employees, including at least five persons, who have at least three years’ experiences in credit information-related business at institutions in Article 2 (3) 1,3, and 4, and any subparagraph of Article 5 (1), or any of the following financial organizations:
(a) A credit bureau;
(b) A credit information collection agency;
(c) Korea Financial Telecommunications and Clearings Institute established under permission of the Minister of Strategy and Finance under Article 32 of the Civil Act;
(d) A premium rate calculating institution under the Insurance Business Act.
(7) Specific criteria necessary for the requirements for permission in paragraphs (5) and (6) shall be determined and publicly notified by the Financial Services Commission. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
(8) Where a credit information collection agency falls under any of the following cases, the Financial Services Commission may revoke its permission pursuant to Article 25 (4) of the Act: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. Where it obtains permission under Article 25 (1) of the Act by fraudulent or other wrongful means;
2. Where it fails to maintain any of the requirements for permission in Article 25 (3) of the Act;
3. Where it violates any condition of the permission;
4. Where any cause occurs, making it impractical to conduct centralized management and use of credit information, such as failure to reach an agreement between the same type of enterprises or restriction on centralization under any other statute;
5. Where it violates its duty to protect credit information, such as exchanging or using credit information centrally managed and used without consent;
6. Where it causes serious damage to public interests by violating the Act or any other statute.
(9) Pursuant to Article 25 (4) of the Act, a person who may exchange the owner of credit information to central management and utilization with any other person shall be as follows: Provided, That the specific scope of the owner of credit information to central management and utilization between the following persons and the person who may exchange such information shall be determined and publicly notified by the Financial Services Commission:
1. Between a credit information provider/user and a credit information collection agency that the credit information provider/user provides credit information;
2. Between a credit information collection agency and a credit information company;
3. Between credit information collection agency companies.
(10) In exchanging credit information centrally managed and used between a credit collection agency and a credit bureau under paragraph (9), measures classified in subparagraphs of Article 14 (4) shall be prepared to provide any information by which an individual owner of credit information can be identified. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
(11) A common computer network for credit information under Article 25 (6) of the Act, shall be established so as to distinguish the credit information collection agency that centrally manages and utilizes the credit information provided by the financial institutions defined in paragraph (2) from the credit information collection agency that centrally manages and utilizes the credit information provided by business owners in the same industry, other than the financial institutions defined in paragraph (2).
 Article 21-2 (Duties of Centralized Credit Information Collection Agency)
(1) "Affairs prescribed by Presidential Decree" in subparagraph 3 of Article 25-2 of the Act means the following affairs:
1. Provision of any credit information in a form by which it is impractical to identify a particular owner of credit information by utilizing centrally managed credit information;
2. Investigation and analysis outsourced by a person with whom the credit information is to be exchanged under Article 21 (9);
3. Consulting on the use of credit information.
(2) "Affairs prescribed by Presidential Decree" in subparagraph 6 of Article 25-2 of the Act means the following affairs:
1. Education, public relation, and publishing related to credit information;
2. Collection, survey and processing of information concerning technology as necessary to generate the technical credit information;
3. Other affairs determined and publicly notified by the Financial Services Commission.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 22 (Duties, etc. of Committee for Intensive Management of Credit Information)
(1) "Imposition of sanctions, as prescribed by Presidential Decree" in Article 26 (1) 3 of the Act means the imposition of penalties depending on the degree and type of violations committed by financial institutions and institutions under Article 21 (2), including ommission and delay of provision of credit information and fraudulent registration. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(2) Specific criteria and procedures for imposition of penalties under paragraph (1) shall be determined by the Committee for Intensive Management of Credit Information under Article 26 (1) of the Act (hereinafter referred to as the "Committee for Intensive Management of Credit Information"). <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(3) The Committee for Intensive Management of Credit Information shall perform the following duties in addition to the duties prescribed in Article 26 (1) 1 through 4 of the Act: <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
1. Deliberation on budget and settlement of accounts related to centralized management and use of credit information;
2. Deliberation on personnel affairs of executive officers of a credit information collection agency.
(4) The Financial Services Commission may recommend changes in decisions of the Committee for Intensive Management of Credit Information, if any content of a report made thereby under Article 26 (3) of the Act is deemed contradictory to sound practices in credit transaction or the public interests of banking consumers. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
 Article 22-2 (Organization and Operation of the Committee for Intensive Management of Credit Information)
(1) The Committee for Intensive Management of Credit Information shall be comprised of the following members:
1. The head of the centralized credit information collection agency;
2. Persons commissioned by the head of the centralized credit information collection agency, from among persons recommended by the heads of associations, national federations, federations, etc. prescribed by the articles of incorporation of the centralized credit information collection agency, taking into consideration the scale of credit information, expense sharing ratio, representativeness by business category, etc.
3. Persons commissioned by the centralized credit information collection agency taking into consideration the publicness, professionalism, and neutrality of centralized management and use of credit information, gender, etc.
(2) The Committee for Intensive Management of Credit Information may, in order to handle its duties efficiently, establish subcommittees, taking into consideration the characteristics, etc. of credit information centrally managed and used.
(3) Except as otherwise expressly provided for in paragraphs (1) and (2), necessary matters for the organization, operation, etc. of the Committee for Intensive Management of Credit Information shall be prescribed by the articles of incorporation of the centralized credit information collection agency.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 23 (Persons who are Engaged in Credit Investigation Company and Claims Collection Agency)
"Any person prescribed by Presidential Decree" in Article 27 (1) 7 of the Act means any person who falls under any of the subparagraphs of Article 18.
 Article 24 (Qualifications and Registration Procedures for Delegated Claims Collectors)
(1) Any of the following persons may be registered as a delegated claims collector under Article 27 (10) of the Act: <Amended by Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 28918, May 28, 2018>
1. A person who has completed education courses on claims collection business at any of the following institutions:
(a) Credit Information Companies Association in Article 44 of the Act (hereinafter referred to as the "Credit Information Companies Association");
(b) Claims collection agency designated by the Credit Information Companies Association;
(c) Other institutions determined and publicly notified by the Financial Services Commission;
2. Deleted; <by Presidential Decree No. 26517, Sep. 11, 2015>
3. Other persons who the Financial Services Commission deems to have qualifications equivalent to subparagraph 1.
(2) A claims collection agency that intends to register a person intending to serve as its delegated claims collector shall submit an application determined and publicly notified by the Financial Services Commission to the Financial Services Commission, accompanied by the documents certifying the qualifications of the delegated claims collector in paragraph (1). <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
 Article 24-2 (Institutions Prohibited from Entrusting Services to Unlicensed Claims Collection Business Entities)
"A credit information provider/user prescribed by Presidential Decree, such as a credit finance company and a credit business entity" in Article 27-2 of the Act means any of the following:
1. Nonghyup banks, agricultural cooperatives, and the National Agricultural Cooperative Federation established under the Agricultural Cooperatives Act;
2. Credit business companies established under the Act on Registration of Credit Business, etc. and Protection of Finance Users;
3. Insurance companies established under the Insurance Business Act;
4. Forestry cooperatives and the National Forestry Cooperative Federation established under the Forestry Cooperatives Act;
5. Mutual savings banks and the Korea Federation of Savings Bank established under the Mutual Savings Banks Act;
6. Community credit cooperatives and the Korean Federation of Community Credit Cooperatives established under the Community Credit Cooperatives Act;
7. Suhyup banks, fisheries cooperatives, and the National Federation of Fisheries Cooperatives established under the Fisheries Cooperatives Act;
8. Credit unions and the National Credit Union Federation of Korea established under the Credit Unions Act;
9. Banks established under the Banking Act (including branches or agencies deemed banks under Article 59 of the same Act);
10. Specialized credit finance business companies established under the Specialized Credit Finance Business Act (including financial institutions authorized and licensed under Article 3 (3) 1 of the same Act);
11. Financial investment business entities, securities finance companies, and merchant banks established under the Financial Investment Services and Capital Markets Act;
12. The Industrial Bank of Korea established under the Industrial Bank of Korea Act;
13. The Korea Development Bank established under the Korea Development Bank Act;
14. The Export-Import Bank of Korea established under the Export-Import Bank of Korea Act.
[This Article Newly Inserted by Presidential Decree No. 28918, May 28, 2018]
 Articles 25 and 26 Deleted. <by Presidential Decree No. 24697, Aug. 27, 2013>
 Article 27 (Public Notification of Credit Information Utilization Status)
(1) "A credit information provider/user determined by Presidential Decree" in Article 31 of the Act means any institution prescribed in Articles 5 (1) 1 through 21 and 21 (2) 1 through 21. <Amended by Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 27070, Mar. 29, 2016>
(2) A credit information company, a credit information collection agency, and a person falling under paragraph (1) shall publicly notify the following matters pursuant to Article 31 of the Act: <Amended by Presidential Decree No. 23076, Aug. 17, 2011; Presidential Decree No. 26517, Sep. 11, 2015>
1. The type and purpose of use of the managed credit information;
2. The type, recipient of information, and purpose of use by the recipient (limited to any person falling under paragraph (1)), if credit information is provided to a third party;
3. The period of storage and use of credit information, if any, and procedures for and method of scrapping thereof;
4. In cases where the processing of credit information is outsourced under Article 17 of the Act, the details of the work, and the person outsourced with such work;
5. Rights of owners of credit information and the method of exercise thereof;
6. The name, department and contact information of a credit information administrator/guardian under Article 20 (3) of the Act or a person who handles complaints raised in connection with the credit information management and protection;
7. The type of credit information that shall be reflected in assessing the credit rating, the weight of the credit information to be reflected, and the period of such reflection (only applicable to credit bureaus).
(3) A credit information company, a credit information collection agency and a person falling under paragraph (1) shall publicly notify each of the matters prescribed in subparagraphs of paragraph (2) by any of the following methods:
1. The matters concerned shall be furnished in a conspicuous place within a store and/or office for perusal;
2. The matters concerned shall be provided on the Internet website of the relevant institution so that an owner of credit information can view the information.
 Article 28 (Consent to Provision and Use of Personal Credit Information)
(1) Deleted. <by Presidential Decree No. 26517, Sep. 11, 2015>
(2) Where a credit information provider/user intends to obtain consent from the relevant owner of credit information under the main sentence of Article 32 (1) of the Act, he/she shall notify the following matters in advance: Provided, That where it is impracticable to indicate or notify the entire terms of consent due to its nature, the credit information provider/user may provide the methods of ascertaining the terms of consent, including the Internet website address and telephone number of workplace of the relevant institution, and obtain his/her consent: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. A recipient of personal credit information;
2. Recipient’s purpose of use of personal credit information;
3. The details of personal credit information to be provided;
4. The period during which a recipient stores and uses personal credit information (excluding a credit inquiry company and a credit information collection agency).
(3) Where a credit information provider/user has obtained consent by wired or wireless communication under Article 32 (1) 4 of the Act, it shall notify the matters prescribed in subparagraphs of paragraph (2), within one month, in writing, by electronic mail, mobile phone text message, or other means determined and publicly notified by the Financial Services Commission. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(4) "Means determined by Presidential Decree" in Article 32 (1) 5 of the Act means the methods of notifying the relevant owner of credit information of the matters requiring consent and obtaining his/her consent by confirming his/her expression of intent to give consent, by using means of securing the safety and reliability of consent to the provision of information. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
(5) In obtaining consent to the provision of personal credit information from the relevant owner of credit information by means defined in paragraph (4), a credit information provider/user or a person who intends to receive personal credit information from a credit bureau or credit information collection agency shall, taking the following matters into consideration, adopt and use the means by which the safety and reliability of the consent to the provision of information can be secured: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. Type, characteristics, and level of risk of a commercial transaction relationship, including financial transactions;
2. Characteristics of the business or category of business of the credit information provider/user or the person who intends to be provided with personal credit information by a credit bureau or credit information collection agency;
3. Number of owners of credit information from whom the consent to the provision of information is to be obtained.
(6) A person who intends to be provided with personal credit information by a credit bureau or a credit information collection agency as prescribed in Article 32 (2) of the Act, shall notify the relevant individual of the matters prescribed in the following subparagraphs and obtain his/her consent: Provided, That where it is impracticable to indicate or notify the entire terms of consent due to its nature, such person may provide the methods of ascertaining the terms of consent, including the Internet website, address and telephone number of workplace of the relevant institution, and obtain his/her consent:
1. The provider of personal credit information;
2. Recipient's purpose of use of personal credit information;
3. The items of personal credit information received;
4. The effective period of the consent on provision of personal credit information.
(7) A credit bureau or credit information collection agency shall, under Article 32 (3) of the Act, verify in writing, or through electronic records, etc. as to whether a person who intends to be provided with personal credit information has obtained consent from the relevant owners of personal information under Article 32 (3) of the Act, and regularly examine the truth or falsehood of the matters verified. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(8) In distinguishing compulsory consent matters and optional consent matters from each other under the former part of Article 32 (4) of the Act, a credit information company, etc. shall take the following matters, etc. into consideration: <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
1. Whether no commercial transaction relationship, including financial transactions, with the owner of credit information can be established and maintained if the relevant owner of credit information does not consent to the consent matters;
2. Whether the relevant personal credit information which is provided and used with consent to the consent matters is directly related to the goods or services provided to the owner of credit information in accordance with a commercial transaction relationship (including cases where a third party on a separate contract, agreement, etc. with the credit information company, etc. has provided goods or services which have been agreed to be provided in a commercial transaction relationship which was applied by the owner of credit information to the relevant credit information company, etc.);
3. Whether it is impractical to perform obligations under this Act or any other statute unless the owner of credit information gives consent to the consent matter.
(9) Where an insurance company, etc. obtains consent by distinguishing compulsory consent matters and other optional consent matters from each other in accordance with the former part of Article 32 (4) of the Act, it shall ensure that an owner of credit information can readily understand each consent matter in the manner, such as distinguishing the forms of the written consents, etc. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
(10) "Purposes prescribed by Presidential Decree, including claims collection (applicable only to credit subject to collection), permission and authorization, determination of a company's credit worthiness, and transfer of securities" in Article 32 (6) 4 of the Act means any of the following purposes: <Amended by Presidential Decree No. 23076, Aug. 17, 2011; Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 27786, Jan. 10, 2017>
1. A creditor who requests claims collection, provides a claims collection agency with personal credit information of a person subject to claims collection, or receives the requested information from a claims collection agency;
2. A creditor or claims collection agency is provided by a credit bureau with personal credit information on a person who failed to repay any of his/her debts the due date, or a person subject to claims collection;
3. An administrative agency is provided by a credit bureau with personal credit information to use for its permission and authorization services;
4. The purpose to be provided by a credit information collection agency and a credit bureau with the personal credit information on a company's representative or a person falling under any item of Article 2 (1) 3 in order to determine whether to build and maintain business relations, including financial transactions, with the relevant company;
5. Financial institutions under Article 21 (2), and the bearers of bills/checks, are provided by a credit information collection agency and a credit bureau with the personal credit information on issuers, underwriters, endorsers, and guarantors of bills/checks, in order to determine whether to build and maintain business relations therewith, and verify intent to repay and solvency thereof, respectively;
6. If a credit information provider/user who has acquired a nominative claim under Article 450 of the Civil Act falls under any of the following cases, the purpose to provide the personal credit information of the obligor of the relevant nominative claim to a credit bureau or credit information collection agency or to be provided with such information by a credit bureau or credit information collection agency:
(a) Where the transferor of a nominative claim has obtained consent from the relevant obligor to the provision or receipt of the personal information of an obligor in any manner prescribed in subparagraph of Article 32 (1) of the Act, as at the time a commercial transaction relationship which constitutes a cause for the nominative claim was established;
(b) Where the credit information of the obligor of the nominative claim can be provided or received under this Act or any other statute;
7. The purpose for being provided with individual credit information from credit information companies, etc. in a form not to make it possible to identify specific persons where such information is necessary for statistics, academic researches, etc.
(11) "A person who destabilizes sound practices in credit transaction prescribed by Presidential Decree" in Article 32 (6) 9 of the Act means any of the following persons: <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
1. A person who conducts any commercial transactions, including financial transactions, by using personal identification information (referring to the information prescribed in Article 29; hereafter the same shall apply in this subparagraph) of any other owner of credit information or provides his/her own personal identification information to any other person who intends to conduct such commercial transactions, for wrongful purposes;
2. A person who provides forged, altered or false credit information to the other party to transaction in connection with commercial transactions, including financial trades, for wrongful purposes;
3. A person who conducts any transaction by using another person's credit card information acquired by mortgage fraud, insurance fraud, fraudulent or other wrongful means, or any financial transaction, etc. similar thereto;
4. A person who is sentenced by the court to the decision on the commencement of procedures for rehabilitation, simplified rehabilitation or individual rehabilitation, adjudication of bankruptcy, or any decision or sentence similar thereto, by fraudulent or other wrongful means;
5. Other persons determined and publicly notified by the Financial Services Commission as persons who have destabilize practices in financial transaction in connection with commercial transactions, including financial transactions.
(12) Where a credit information company, etc. notifies in advance an owner of credit information of the fact of providing his/her personal credit information, the reasons therefor, etc. in accordance with the main sentence of Article 32 (7) of the Act and where such notification is made or publicly announced ex post facto inevitably under the proviso to the same Article 32 (7) of the Act, the timing and methods of notification or public announcement by reason for the provision thereof and by person who make notification or public announcement shall be as specified in attached Table 2-2. <Amended by Presidential Decree No. 226517, Sep. 11, 2015>
(13) "Any credit information provider/user prescribed by Presidential Decree" in Article 32 (8) of the Act means an institution falling under any of Article 5 (1) 1 through 21. <Amended by Presidential Decree No. 23076, Aug. 17, 2011; Presidential Decree No. 26517, Sep. 11, 2015>
(14) "Matters determined by Presidential Decree, including the scope of credit information provided" in Article 32 (8) of the Act means the scope of personal credit information to be provided, and the credit information management and protection system for the person to be provided with. <Amended by Presidential Decree No. 23076, Aug. 17, 2011; Presidential Decree No. 26517, Sep. 11, 2015>
 Article 29 (Provision and Use of Personal Identification Information)
"Information prescribed by Presidential Decree" in Article 34 of the Act means information by which an individual can be identified, including the name, address, numbers in the following subparagraphs, gender, and nationality of a living person: <Amended by Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 28150, Jun 27, 2017>
1. Resident registration number under Article 7-2 (1) of the Resident Registration Act;
2. Passport number under Article 7 (1) 1 of the Passport Act;
3. Driver's permission number under Article 80 of the Road Traffic Act;
4. Alien registration number under Article 31 (4) of the Immigration Act;
5. Report number of domestic place of residence under Article 7 (1) of the Act on the Immigration and Legal Status of Overseas Koreans.
 Article 30 (Fact-Finding Inquiry, etc. into Use and Provision of Credit Information)
(1) In accordance with the main sentence of Article 35 (1) of the Act, a credit information company, etc. shall allow the owner of credit information to inquire into matters for inquiry (referring to the matters classified in subparagraphs of the same Article 35 (1) of the Act; hereafter the same shall apply in this Article) by no later than the period determined and publicly notified by the Financial Services Commission commencing from the date of use or provision of the personal credit information in the manner classified as follows: Provided, That where any inevitable cause exists as prescribed in the proviso to Article 32 (7) of the Act, the inquiry shall be made possible at the time notification or public announcement is made, as prescribed in attached Table 2-2: <Amended by Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 27070, Mar. 29, 2016>
1. Any of the following credit information companies, etc.: Method of constructing a personal credit information inquiry system for convenient verification of matters for inquiry by an owner of credit information, and posting the method, procedures, etc. for using such personal credit information inquiry system on the Internet website, etc.:
(a) A credit information collection agency;
(b) A credit information company;
(c) An institution defined in Article 5 (1) 1 through 20 (excluding institutions which are not equipped with a computer system for managing individual credit information and hold individual credit information regarding less than 10,000 principals of credit information);
(d) An institution defined in Article 21 (2) 1 through 21 (excluding institutions which are not equipped with a computer system for managing individual credit information and hold individual credit information regarding less than 10,000 principals of credit information);
2. A credit information company, etc. other than those defined in subparagraph 1: Method prescribed in subparagraph 1, or enabling an owner of credit information to peruse the matters for inquiry at an office, shop, etc.
(2) A credit information company, etc. should allow an owner of credit information prescribed in paragraph (1) to inquire into the matters for inquiry for the last three years from the date such request for inquiry is made. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(3) In allowing an owner of credit information to inquire into matters for inquiry under paragraph (1), a credit information company, etc. shall verify whether the person who has requested the inquiry is the actual credit information concerning the relevant matters for inquiry. In such cases, a credit information company, etc. may adopt and use means by which the safety and reliability of the identification of a principal can be secured, taking into consideration the type, characteristics, level of risk, etc. of a commercial transaction relationship, including financial transactions. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(4) “Cases prescribed by Presidential Decree, such as where it is used for the purpose of internal business management or provided for repeated outsourcing of business affairs” in the proviso to Article 35 (1) of the Act means where it is used or provided for any of the following purposes: Provided, That where personal credit information is used or provided for the purpose of introducing or recommending to purchase any goods or service shall be excluded therefrom: <Amended by Presidential Decree No. 26517, Sep. 11, 2015; Presidential Decree No. 27070, Mar. 29, 2016>
1. Risk management and internal control, including credit risk management;
2. Analysis of clients and development of goods and services;
3. Managing achievement;
4. Performing outsourced affairs;
5. Examining business and financial status;
6. Providing data to the State or local governments, as prescribed by other statute.
(5) "Matters prescribed by Presidential Decree" in Article 35 (1) 1 of the Act means the period of keeping and using the relevant personal credit information. <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(6) "Matters prescribed by Presidential Decree" in Article 35 (1) 2 of the Act means the period for keeping and using the relevant personal credit information by the recipient thereof. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
(7) A credit information company, etc., upon request for notification from an owner of credit information under Article 35 (2) of the Act, shall notify the relevant owner of credit information of the matters inquired into regularly from the time it receives such request in the format and manner determined and publicly notified by the Financial Services Commission. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
(8) A credit information company, etc. may cause the relevant owner of credit information to bear the expenses directly incurred in the inquiry under paragraph (1) or notification under paragraph (7): Provided, That if a personal credit information inquiry system referred to in paragraph (1) is available for making inquiry into matters for inquiry, an owner of credit information shall be allowed to make the inquiry free of charge at least once annually. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
(9) A credit information company, etc. shall preserve the details inquired into by an owner of credit information, as prescribed in paragraph (1) and the details notified to an owner of credit information, as prescribed in paragraph (7) for three years. <Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015>
 Article 31 (Notification, etc. of Credit Information Constituting Grounds for Refusal of Commercial Transaction)
(1) "Information prescribed by Presidential Decree" in Article 36 (1) of the Act means the following credit information: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. Credit information defined in Article 2 (1) 3;
2. Credit information defined in items of Article 2 (1) 5: In such cases, credit information under items (e), (g), (k), (l), and (m) thereof shall be excluded; and in cases of item (d), it shall apply only to the information related to payment in arrears, and in cases of items (i) and (j) thereof, it shall apply only to the information on credit rehabilitation and similar information determined and publicly notified by the Financial Services Commission.
(2) "Matters prescribed by Presidential Decree, including the credit information that constitutes the grounds for refusal or revocation thereof" in Article 36 (1) of the Act means the following matters: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. The credit information that constitutes the grounds for refusal or revocation of commercial transactions;
2. Name, address, and contact of a credit bureau and credit information collection agency which has provided the information defined in subparagraph 1;
3. The fact that such revocation was not determined by a credit bureau and credit information collection agency, the fact, if any, that other information was used along with the information provided by a credit bureau or a credit information collection agency, and the relevant other information.
 Article 32 (Rights, etc. to Revoke Consent to Provide and Use Personal Credit Information)
(1) Pursuant to Article 37 (1) of the Act, an owner of credit information may revoke the consent to provide personal credit information by defining the target information and details, through the Internet website of the relevant institution or by wired/wireless communication, in writing, or other means determined and publicly notified by the Financial Services Commission: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
(2) Pursuant to Article 37 (2) of the Act, an individual owner of credit information may request a credit information provider/user who contacts him/her for the purposes of introducing goods or services or soliciting the purchase thereof to cease such contact by defining the target contact and details by means defined in paragraph (1).
(3) A credit information provider/user, in receipt of request under paragraphs (1) and (2), shall complete the appropriate actions within one month from the receipt of such request.
(4) Where a credit information provider/user has verbally notified its individual counterparty pursuant to Article 37 (3) of the Act, the additional post-notification shall be made within one month from the first notification, in writing, or through electronic mail, mobile phone text message, the Internet website, or through other methods determined by the Financial Services Commission.
(5) Pursuant to Article 37 (4) and (5) of the Act, a credit information provider/user shall provide measures, including toll-free numbers and recipient-paid mail.
 Article 33 (Request for Perusal, Correction of Credit Information, etc.)
(1) "Means prescribed by Presidential Decree, including telephone, Internet website, etc." in Article 38 (1) of the Act means any of the following means: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. Presentation of identification indicating an individual's identity;
2. Use of telephone or Internet website;
3. Methods, other than those prescribed in subparagraphs 1 and 2, by which a person who requests the provision and perusal of his/her personal information verifies that he/she is the very owner of credit information, by using means to secure the safety and reliability of the verification of the principal. In such cases, a credit information company, etc. may adopt and use means by which the safety and reliability of the identification of a principal can be secured taking into consideration the type, characteristics, level of risk, etc. of a commercial transaction relationship, including financial transactions.
(2) An owner of credit information may be provided with or peruse his/her information pursuant to Article 38 (1) of the Act by means of written documents, electronic documents, or an Internet website, etc.
(3) Where an owner of credit information intends to request correction pursuant to Article 38 (4) of the Act, he/she shall submit a request form for correction determined and publicly notified by the Financial Services Commission within 15 days from the receipt of notification of the processing results (if no notification is made, within seven business days from the request for correction under Article 38 (1) of the Act) to the Financial Services Commission along with the following documents:
1. Document stating the details of a request for correction to a credit information company, etc. under Article 38 (1) of the Act;
2. Notification details, if an owner of credit information has been notified by a credit information company, etc. of the processing results under Article 38 (4) of the Act;
3. Evidentiary data verifying the authentication of the credit information to be corrected.
 Article 33-2 (Requirements for Suspension of Provision of Information by Credit Bureau, Matters to be Notified to Owners of Credit Information, etc.)
(1) Where a credit bureau in receipt of a request under Article 38-2 (1) of the Act is deemed to have received the relevant request due to any of the following occurrences, as prescribed in Article 38-2 (2) of the Act, it shall suspend, without delay, the provision of personal credit information of the owner of credit information to the person who has requested the information, if it is suspected that a credit information provider/user or any other user (hereafter referred to as "information requester" in this Article) has requested the personal credit information using the stolen personal credit information of the relevant owner of credit information as a result of such occurrence:
1. Disclosure of the personal credit information of the relevant owner of credit information;
2. Loss of the identification card of the relevant owner of credit information;
3. Facts similar to those provided for in subparagraphs 1 or 2, determined and publicly notified by the Financial Services Commission.
(2) Matters to be notified by a credit bureau to an owner of credit information pursuant to the former part of Article 38-2 (1) and (2) of the Act shall be as classified below:
1. Where the notification is made pursuant to Article 38-2 (1) of the Act by providing the personal credit information of the relevant owner of credit information to the information requester: Recipient of the personal credit information, and the purpose, details and date of the provision;
2. Where the notification is made pursuant to Article 38-2 (2) of the Act without providing the personal credit information of the relevant owner of credit information to the information requester: Information requester, and the purpose and date of the request.
(3) Pursuant to Article 38-2 (3) of the Act, a credit bureau shall notify the relevant owner of credit information of the matters classified in subparagraphs of paragraph (2) by any of the following means:
1. In writing;
2. Telephone;
3. Electronic mail;
4. Text message via a cellular phone;
5. Means similar to those provided for in subparagraphs 1 through 4.
(4) A credit bureau may, pursuant to Article 38-2 (3) of the Act, cause the relevant owner of credit information to bear the expenses incurred in making notification under paragraph (2) and (3): Provided, That where any of the occurrences exist under paragraph (1) 1 and notification is made because such fact has occurred due to any cause attributable to a credit information company, etc., it shall cause the relevant credit information company, etc. to bear such expenses.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 33-3 (Requests for Deletion of Personal Credit Information)
(1) "Period prescribed by Presidential Decree" in the main sentence of Article 38-3 (1) of the Act means the period classified as follows:
1. In cases of personal credit information under Article 17-2 (1) 1: Five years;
2. In cases of personal credit information under Article 17-2 (1) 2: Three months.
(2) Where any disadvantage is incurred by an owner of credit information by deleting his/her personal credit information by a credit information provider/user at the request for deletion in accordance with the main sentence of Article 38-3 (1) of the Act, the relevant owner of credit information shall be informed that such disadvantage may occur, before deleting such information.
(3) The management of personal credit information by a credit information provider/user pursuant to Article 38-3 (3) of the Act shall be conducted as prescribed in subparagraphs of Article 17-2 (1) 1.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 34 (Right to Free Perusal)
"Regular intervals prescribed by Presidential Decree" in Article 39 of the Act means four months. <Amended by Presidential Decree No. 23076, Aug. 17, 2011>
 Article 34-2 (Notification, etc. of Divulgence of Credit Information)
(1) Where a credit information company, etc. intends to make notification pursuant to Article 39-2 (1) of the Act, it shall notify the divulgence of credit information to the relevant owner of credit information as prescribed in any subparagraph of Article 33-2 (3).
(2) In cases falling under the former part of Article 39-2 (3) of the Act, a credit information company, etc. shall widely notify that the credit information has been divulged in any of the following means, other than those provide for in paragraph (1):
1. Posting such fact on its Internet website;
2. Enabling the relevant owners of credit information to peruse such fact at an office, shop, etc.;
3. Publishing such fact in a general daily newspaper, general weekly newspaper or an online newspaper (referring to a general daily newspaper, general weekly newspaper or an online newspaper defined in subparagraph 1 (a), (c) or 2 of Article 2 of the Act on the Promotion of Newspapers, Etc.), the circulation district of which is a Special Metropolitan City, Metropolitan City, Special Self-Governing City, Do, Special Self-Governing Province or a wider area where the principal offices are located.
(3) Notwithstanding paragraph (1), where it is obvious that no damage was caused from the disclosure of credit information and measures to prevent the spread of divulged information and additional disclosure of credit information is deemed urgently needed under Article 39-2 (2) of the Act, the credit information company, etc. shall notify the credit information subjects of such fact, without delay, after taking the relevant measures. In such cases, the details of the measures taken shall also be notified together.
(4) "Credit information, the scale of which exceeds that prescribed by Presidential Decree" in the former part of Article 39-2 (3) of the Act means personal credit information of at least ten thousand owners of credit information.
(5) "Specialized agency prescribed by Presidential Decree" in the former part of Article 39-2 (3) of the Act means the Financial Supervisory Service.
(6) A credit information company, etc. obligated to report pursuant to the former part of Article 39-2 (3) of the Act shall submit a written report determined and publicly notified by the Financial Services Commission to the Financial Services Commission or the Financial Supervisory Service, without delay, at the time it becomes aware of the divulgence of the credit information.
(7) Notwithstanding paragraph (6), a credit information company, etc., in cases falling under the former part of paragraph (3), may firstly notify the divulgence of the credit information to the Financial Services Commission or the Financial Supervisory Service and submit a written report provided for in paragraph (6), without delay, after taking measures to prevent additional divulgence.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 34-3 (Electronic Media or Methods through which Transmission of Information in Nature of Advertisement is Prohibited)
"An electronic medium or a method prescribed by Presidential Decree" in subparagraph 7 of Article 40 of the Act means any of the following medium or method:
1. Telephone;
2. Electronic mail;
3. Text message via a cellular phone;
4. Any other medium or method through which symbols, letters, pictures, or images are sent to the recipient in an electronic form via an information and communications network.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 35 (Prohibited Matters for Claims Collection Agency, etc.)
Any claims collection agency and its delegated claims collectors shall abide by the provisions of Articles 5, 6, and 8 of the Fair Debt Collection Practices Act in collecting claims, and shall not violate the provisions of Articles 9 through 13 of the same Act in collecting claims.
 Article 35-2 (Verification, etc. of Recruitment Channels of Agents of Recruitment Business)
(1) An agent of recruitment business under Article 41-2 (1) of the Act shall be any of the following persons:
1. A person allowed to recruit credit card members defined in Article 14-2 (1) 2 or 3 of the Specialized Credit Finance Business Act;
2. A recruiter of credit card merchants defined in the Specialized Credit Finance Business Act;
3. An insurance solicitor defined in the Insurance Business Act;
4. An insurance agency defined in the Insurance Business Act;
5. An investment solicitor defined in Article 51 (9) of the Financial Investment Services and Capital Markets Act;
6. A loan solicitor defined in the proviso to Article 3 (1) of the Act on Registration of Credit Business, etc. and Protection of Finance Users.
(2) "Matters prescribed by Presidential Decree" in Article 41-2 (1) 3 of the Act means any of the following matters:
1. Whether the personal credit information used for the recruitment business is not kept safe or whether no information is yet discarded despite the purpose of use is attained or the period of use has elapsed;
2. Whether the personal credit information provided for in subparagraph 1 is used for any purpose other than recruitment business or whether it is provided to a third party.
(3) "Registration agency prescribed by Presidential Decree" in Article 41-2 (3) of the Act means an agency with which a person falling under any subparagraph of paragraph (1) is registered in accordance with the statutes, etc. concerning recruitment business outsourced by a credit information provider/user (hereafter referred to as "registration agency" in this Article).
(4) A credit information provider/user shall verify the matters provided for in subparagraphs of Article 41-2 (1) of the Act at least once each quarter.
(5) A credit information provider/user shall notify the registration agency of the matters verified under paragraph (4) by no later than the deadline classified as follows:
1. Where it is verified that an agent of recruitment business has used illegally acquired credit information in the recruitment business pursuant to Article 41-2 (1) 1 of the Act: Within seven days from the verification date;
2. Where any matter, other than that prescribed in subparagraph 1 is verified: Within one month from the end of the relevant quarter based on the end of each quarter.
(6) In cases of paragraph (5) 1, a credit information provider/user shall notify the fact verified under paragraph (4) also to the Financial Services Commission.
(7) A registration agency shall report the matters notified by a credit information provider/user under paragraph (5) to the Financial Services Commission within two months from the end of the relevant quarter as at the last day of each quarter.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 35-3 (Calculation Standard, etc. of Penalty Surcharges)
(1) "Amount of sales involved in a violation prescribed by Presidential Decree" in the main sentence of Article 42-2 (1) of the Act means the average annual sales of the relevant credit information company, etc. during the immediately preceding three business years generated from the business sector that has used personal credit information related to violation (hereafter referred to as "average annual sales amount" in this Article): Provided, That in cases classified as follows, the relevant amount shall be deemed the average annual sales amount.
1. Where three years have not passed since the commencement of the business based on the first day of the relevant business year: An amount obtained by converting the sales amount from the commencement of the business until the last day of the immediately preceding business year into an average annual sales amount;
2. Where the business commenced in the relevant business year: An amount obtained by converting the sales amount from the commencement date of the business until the date of violation, into an average annual sales amount.
(2) "Cases prescribed by Presidential Decree" in the proviso to Article 42-2 (2) of the Act means any of the following cases:
1. Where no business performance exists due to failure to commence business, suspension of business, etc.;
2. Where it is difficult to calculate sales amount objectively because the data for calculation of sales amount ceases to exist, damaged, etc. due to a natural disaster, etc.
(3) Standards for calculating penalty surcharges shall be as specified in attached Table 2-3. <Amended by Presidential Decree No. 28387, Oct. 17, 2017>
(4) In cases falling under the proviso to Article 42-2 (2) of the Act, the smaller of the following amounts shall be the maximum imposable penalty surcharge:
1. 3/100 of the average annual sales of a credit information company, etc., the scale of which is similar to that of the relevant credit information company;
2. 3/100 of the average annual sales of a credit information company, etc., the type of which is the same as the relevant credit information company;
3. 20 billion won.
(5) Deleted. <by Presidential Decree No. 28387, Oct. 17, 2017>
(6) Where financial statements or other data are required to calculate the sales amount under paragraph (1), the Financial Services Commission may request the relevant credit information company, etc. to submit the relevant data, for a period not exceeding 20 days.
(7) "Person prescribed by Presidential Decree" in Article 42-2 (8) of the Act means a person falling under any subparagraph of Article 35-2 (1).
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 35-4 (Submission of Opinions)
(1) The Financial Services Commission shall provide a person directly involved, interested persons, etc., with an opportunity to state their opinions before imposing an administrative fine under Article 42-2 of the Act.
(2) A person directly involved, interested persons, etc. referred to in paragraph (1) may attend a meeting of the Financial Services Commission and state their opinions or submit necessary data.
(3) A person directly involved, interested persons, etc. may, in stating their opinions or submitting data, seek advice from a lawyer or designate him/her as his/her attorney.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 35-5 (Procedures for Imposition, Payment, etc. of Penalty Surcharges)
(1) In imposing a penalty surcharge under Article 42-2 of the Act, the Financial Services Commission shall issue a written notice to pay the penalty surcharge, specifying the facts of violation, amount imposed, method of raising an objection, period for raising an objection, etc.
(2) A person in receipt of a notice referred to in paragraph (1) shall pay the penalty surcharge at a collecting agency designated by the Financial Services Commission within 60 days from the receipt date of the notice.
(3) Except as otherwise expressly provided for in paragraphs (1) and (2), specific matters necessary for the imposition of penalty surcharges shall be determined and publicly notified by the Financial Services Commission.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 35-6 (Extension of Payment Deadline and Payment in Installment)
(1) Where it is deemed difficult for a person who has received a disposition of a penalty surcharge (hereinafter referred to as "person liable to pay a penalty surcharge") to fully pay the penalty surcharge on any of the following grounds, the Financial Services Commission may grant an extension of the payment deadline or allow installment payments pursuant to Article 42-2 (9) of the Act. In such cases, he/she may be requested to provide security, if deemed necessary:
1. Where he/she has suffered a significant economic loss due to a disaster, etc.;
2. Where his/her business is in serious crisis due to deterioration of business conditions;
3. Where he/she is expected to face significant financial difficulty if the penalty surcharge is paid in lump sum.
(2) Where the payment deadline is extended or the installment payment is allowed pursuant to paragraph (1), the payment deadline shall not be extended exceeding one year, the interval of installment payment shall not exceed six months, and the number of installment payment shall exceed three times.
(3) If a person liable to pay a penalty surcharge intends to extend the payment deadline of a penalty surcharge or to pay in installment pursuant to paragraph (1), he/she shall file an application with the Financial Services Commission not later than ten days prior to the payment deadline.
(4) If a person liable to pay a penalty surcharge for whom an extension of payment deadline is granted or installment payment is allowed pursuant to paragraph (1) falls under any of the following subparagraphs, the Financial Supervisory Commission may revoke the decision on the extension of payment deadline or installment payment and collect the penalty surcharge in lump sum:
1. Where he/she fails to pay the penalty surcharge determined to be paid in installments by the payment deadline;
2. Where he/she fails to comply with an order to change security or any other order of the Financial Services Commission necessary for the perpetuation of security;
3. Where it is deemed impractical to collect the full amount or remainder of the penalty surcharge due to compulsory execution, commencement of an auction, adjudication of bankruptcy, dissolution of the corporation, disposition on default of any national tax or local tax, or any other similar incidents.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 35-7 (Disposition on Deficits)
If a person liable to pay a penalty surcharge falls under any of the following grounds, the Financial Services Commission may write it off as a bad debt pursuant to Article 42-2 (9):
1. Where the disposition on default is concluded and the portion appropriated for the amount in arrears is smaller than such amount in arrears;
2. Where the extinctive prescription of the right to collect the amount, etc. to be collected is completed;
3. Where it is ascertained that the whereabouts of a defaulter is unknown or a defaulter has no asset;
4. Where it is verified that the computed value of the total assets forming the subject matter of the disposition of arrears, is barely sufficient to appropriate for the amount in arrears, and there will be no leftover;
5. Where it is verified that the total assets that are the subject matter of the disposition of arrears is barely sufficient to appropriate for repaying bonds, etc., secured as a national tax, local tax, a right to lease on a deposit basis, pledge or mortgage, etc., and no assets will remain;
6. Other cases where collection is impossible and the person liable to pay the penalty surcharge is exempted from responsibilities under the rehabilitation claims, etc. pursuant to the main sentence of Article 251 of the Debtor Rehabilitation and Bankruptcy Act.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 35-8 (Period for Claiming Statutory Damages)
(1) Pursuant to Article 43-2 (1) of the Act, an owner of credit information may claim damages against a credit information company, etc., or any other credit information user (including the agent) within three years from the date he/she becomes aware of the existence of conduct that falls under all of the subparagraphs of Article 43-2 of the Act.
(2) Damages shall not be claimed pursuant to paragraph (1), if ten years elapse from the date of the relevant conduct.
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 35-9 (Scope of Credit Information Company, etc. Obligated to Purchase Indemnity Insurance, etc.)
"Credit information company, etc. prescribed by Presidential Decree" in Article 43-3 of the Act means a person determined and publicly notified by the Financial services Commission, from among the following:
1. A credit information collection agency;
2. A credit information company;
3. A person defined in any of Article 5 (1) 1 through 21;
4. A person defined in any subparagraph of Article 21 (2).
[This Article Newly Inserted by Presidential Decree No. 26517, Sep. 11, 2015]
 Article 36 (Business of Credit Information Companies Association)
"Any other business prescribed by Presidential Decree" in Article 44 (3) 4 of the Act means the following business:
1. Collection and statistical work of information on management of a credit information company;
2. Education and publishing in relation to credit information business;
3. Business delegated or entrusted to a Credit Information Companies Association under the Act or other statutes;
4. Other business determined and publicly announced by the Financial Services Commission.
 Article 37 (Delegation or Entrustment of Authority)
(1) The Financial Services Commission shall entrust its authority under attached Table 3 to the FSS Governor in accordance with Article 49 of the Act, and entrust the registration of delegated claims collectors referred to in Article 27 (3) of the Act to the Credit Information Companies Association.
(2) The FSS Governor and the Credit Information Companies Association shall report the details of processing of the business entrusted pursuant to paragraph (1) to the Financial Services Commission every six month.
 Article 37-2 (Management of Sensitive Information and Personally Identifiable Information)
(1) Where it is essential for performing the following business affairs, the Financial Services Commission (including a person outsourced with duties of the Financial Services Commission pursuant to Article 34 (2)) and the FSS Governor may process any information constituting criminal records referred to in subparagraph 2 of Article 18 of the Enforcement Decree of the Personal Information Protection Act, and the information that contains personal identification numbers: <Amended by Presidential Decree No. 26517, Sep. 11, 2015>
1. Business affairs concerning permission for credit information business under Article 4 of the Act and reporting under Article 8 of the Act;
2. Business affairs concerning approval for changes in controlling shareholders under Article 9 of the Act;
3. Business affairs concerning authorization of transfer, acquisition by transfer, etc. of credit information business under Article 10 of the Act;
4. Business affairs concerning the receipt of reports of concurrent operation of business activities under Article 11 (1) of the Act and approval of the concurrent operation of business operations under the proviso to Article 11 (2) of the Act;
5. Business affairs concerning the authorization of concurrent office holding by executive officers under Article 13 of the Act;
6. Business affairs concerning the revocation of permission, etc., and suspension of business under Article 14 of the Act;
7. Business affairs concerning the registration of delegated claims collectors under Article 27 of the Act;
8. Business affairs concerning the processing of requests for correction under Article 38 (4), (5), and (7) of the Act;
9. Business affairs concerning the supervision, inspection, follow-up measures, etc. prescribed in Article 45 of the Act;
10. Business affairs concerning the hearings under Article 48 of the Act;
11. Business affairs concerning the verification of matters about persons outsourced with recruitment business under Article 41-2 (1) of the Act and notification under Article 41-2 (3) of the Act;
12. Business affairs concerning the imposition, collection, etc. of penalty surcharges under Article 42-2 of the Act.
(2) Where it is essential for conducting the following business affairs, a credit information company may collect and process the data containing criminal record materials referred to in subparagraph 2 of Article 18 of the Enforcement Decree of the Personal Information Protection Act and personal identification numbers: Provided, That where personal identification numbers are to be collected directly from individuals, consents shall be obtained from the relevant individuals: <Newly Inserted by Presidential Decree No. 25532, Aug. 6, 2014; Presidential Decree No. 26517, Sep. 11, 2015>
1. Business affairs concerning the credit inquiry business, credit investigation business, and claims collection business performed in connection with financial transactions under Article 4 (1) of the Act;
2. Business affairs related to financial transactions among concurrent operation of business activities under Article 11 of the Act;
3. Business affairs concerning the verification of grounds for disqualification when appointing or hiring executive officers and/or employees, under Articles 22 (1) and 27 (1) of the Act;
(3) Where it is essential for conducting business affairs referred to in Article 25 (1) of the Act and subparagraphs of Article 25-2 of the Act, a credit information collection agency and a person with whom credit information is to be exchanged pursuant to Article 25 (4) of the Act may collect and process personal identification numbers: Provided, That where personal identification numbers are to be collected directly from individuals, consents shall be obtained from the relevant individuals: <Newly Inserted by Presidential Decree No. 25532, Aug. 6, 2014; Presidential Decree No. 26517, Sep. 11, 2015>
(4) Where it is essential for conducting business affairs that use credit information for financial transactions, an institution under Article 21 (2) may collect and process the data containing personal identification numbers: Provided, That where personal identification numbers are to be collected directly from individuals, consents shall be obtained from the relevant individuals: <Newly Inserted by Presidential Decree No. 25532, Aug. 6, 2014; Presidential Decree No. 26517, Sep. 11, 2015>
[This Article Newly Inserted by Presidential Decree No. 23488, Jan. 6, 2012]
 Article 38 (Criteria for Imposition of Administrative Fines Depending on Violations)
The criteria for imposing administrative fines under Article 52 (1) through (4) of the Act shall be as determined in attached Table 4.
ADDENDA
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Article 2 (Transitional Measures concerning Capital)
A credit investigation company and a claims collection agency permitted pursuant to the previous provisions at the time this Decree enters into force shall be compliant with the amended provisions of Article 7 by the settlement of accounts for 2012.
Article 3 (Transitional Measures concerning Citation of other Statutes)
The "Small and Medium Enterprises Promotion Act" in the amended provisions of Article 21 (2) 12 shall be deemed the "Promotion of Small and Medium Enterprises and Encouragement of Purchase of Their Products Act" until November 21, 2009.
Article 4 Omitted.
Article 5 (Relationship to other Statutes)
Where other statutes cite the provisions of the previous Enforcement Decree of the Credit Information Use and Protection Act at the time this Decree enters into force, if the provisions corresponding thereto exist in this Decree, such corresponding provisions of this Decree shall be deemed to have been cited in lieu of the previous provisions.
ADDENDA <Presidential Decree No. 22151, May 4, 2010>
Article 1 (Enforcement Date)
This Decree shall enter into force on May 5, 2010.
Articles 2 through 4 Omitted.
ADDENDA <Presidential Decree No. 22220, Jun. 28, 2010>
Article 1 (Enforcement Date)
This Decree shall enter into force on July 6, 2010
Articles 2 and 3 Omitted.
ADDENDUM <Presidential Decree No. 22467, Nov. 15, 2010>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 22493, Nov. 2, 2010>
Article 1 (Enforcement Date)
This Decree shall enter into force on November 18, 2010
Articles 2 through 5 Omitted.
ADDENDA <Presidential Decree No. 22626, Jan. 17, 2011>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Articles 2 through 6 Omitted.
ADDENDA <Presidential Decree No. 23076, Aug. 17, 2011>
Article 1 (Enforcement Date)
This Decree shall enter into force on August 20, 2011.
Article 2 (Applicability to Reporting by Credit Bureaus)
The amended provisions of Article 18-2 (1) shall apply to reporting on the business matters that are handled by credit bureaus between January 1 and December 31 in 2012.
Article 3 (Applicability to Public Notification of Credit Information Utilization Status)
The amended provisions of Article 27 (2) 7 shall apply to those which are publicly notified on and after the enforcement date of this Decree.
Article 4 (Applicability to Base Date for Right to Free Perusal)
The amended provisions of Article 34 shall apply to those who receive their own information from credit bureaus or peruse such information on and after the enforcement date of this Decree.
Article 5 (Transitional Measures concerning Period of Use of Credit Information, etc.)
With respect to any credit information that is registered with credit information companies, etc., and managed by such companies, etc., for which the cause of disadvantage is removed pursuant to Article 18 (2) of the Act, as at the time this Decree enters into force, the previous provisions shall apply, notwithstanding the amended provisions of Article 15 (4) through (6).
Article 6 (Transitional Measures concerning Notification to Owners of Credit Information or Public Disclosure)
Where notification or public disclosure is made to owners of credit information pursuant to the previous provisions at the time this Decree enters into force, the previous provisions shall be deemed notification or public disclosure pursuant to the amended provisions of Article 28 (9) or (10).
ADDENDA <Presidential Decree No. 23488, Jan. 6, 2012>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation. (Proviso Omitted.)
Article 2 Omitted.
ADDENDA <Presidential Decree No. 23535, Jan. 25, 2012>
Article 1 (Enforcement Date)
This Decree shall enter into force on January 26, 2012.
Articles 2 and 3 Omitted.
ADDENDA <Presidential Decree No. 24076, Aug. 31, 2012>
Article 1 (Enforcement Date)
This Decree shall enter into force on September 2, 2012. (Proviso Omitted.)
Articles 2 through 4 Omitted.
ADDENDA <Presidential Decree No. 24697, Aug. 27, 2013>
Article 1 (Enforcement Date)
This Decree shall enter into force on August 29, 2013. (Proviso Omitted.)
Articles 2 through 13 Omitted.
ADDENDA <Presidential Decree No. 25155, Feb. 11, 2014>
Article 1 (Enforcement Date)
This Decree shall enter into force on February 14, 2014.
Article 2 Omitted.
ADDENDUM <Presidential Decree No. 25532, Aug. 6, 2014>
This Decree shall enter into force on August 7, 2014.
ADDENDA <Presidential Decree No. 25945, Dec. 30, 2014>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date the registration of merger is completed pursuant to Article 4 (6) of the Addenda to the Korea Development Bank Act wholly amended by Act No. 12663.
Articles 2 through 5 Omitted.
ADDENDA <Presidential Decree No. 26369, Jun. 30, 2015>
Article 1 (Enforcement Date)
This Decree shall enter into force on July 1, 2015.
Articles 2 through 4 Omitted.
ADDENDA <Presidential Decree No. 26517, Sep. 11, 2015>
Article 1 (Enforcement Date)
This Decree shall enter into force on September 12, 2015: Provided, That the amended provisions of Articles 16-2, 17-2, 28, 29, 30, 33-2, and 33-3 shall enter into force on March 12, 2016.
Article 2 (Transitional Measures concerning Incompetent Persons, etc.)
The adjudication of adult guardianship, limited guardianship, and specific guardianship referred to in the amended provisions of Article 2 (1) 5 shall be deemed to include adjudication of incompetency or quasi-incompetency on a person for whom the adjudication of incompetency or quasi-incompetency remains in effect under Article 2 of the Addenda to partially amended Civil Act (Act No. 10429).
Article 3 (Transitional Measures concerning Appointment, etc. of Credit Information Administrator/Guardian)
A person who falls under the amended provisions of Article 17 (1) or (2) shall meet the requirements prescribed in Article 20 (3) of the Act within three months after this Decree enters into force.
Article 4 (Transitional Measures concerning Scope of Credit Information Company, etc. Obligated to Purchase Insurance, etc. to Perform Liability to Compensate for Damage)
A person who falls under the amended provisions of Article 35-9 shall meet the requirements prescribed in Article 43-3 of the Act within one month after this Decree enters into force.
Article 5 (Transitional Measures concerning Criteria for Imposition of Fines for Negligence)
Notwithstanding the amended provisions of attached Table 4, the application of the criteria for the imposition of penalty surcharges for an offence committed before this Act enters into force shall be governed by the former provisions.
Article 6 Omitted.
ADDENDA <Presidential Decree No. 27037, Mar. 11, 2016>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Article 2 Omitted.
ADDENDUM <Presidential Decree No. 27070, Mar. 29, 2016>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 27205, May 31, 2016>
Article 1 (Enforcement Date)
This Decree shall enter into force on September 30, 2016. (Proviso Omitted.)
Articles 2 and 3 Omitted.
ADDENDA <Presidential Decree No. 27322, Jul. 6, 2016>
Article 1 (Enforcement Date)
This Decree shall enter into force on July 25, 2016.
Articles 2 through 4 Omitted.
ADDENDA <Presidential Decree No. 27511, Sep. 22, 2016>
Article 1 (Enforcement Date)
This Decree shall enter into force on September 23, 2016.
Articles 2 through 8 Omitted.
ADDENDA <Presidential Decree No. 27556, Oct. 25, 2016>
Article 1 (Enforcement Date)
This Decree shall enter into force on December 1, 2016.
Article 2 Omitted.
ADDENDUM <Presidential Decree No. 27786, Jan. 10, 2017>
This Decree shall enter into force on the date of its promulgation.
ADDENDA <Presidential Decree No. 28150, Jun. 27, 2017>
Article 1 (Enforcement Date)
This Decree shall enter into force on July 1, 2017: Provided, That the amended provisions of Article 3 shall enter into force on the date of its promulgation.
Articles 2 and 3 Omitted.
ADDENDA <Presidential Decree No. 28152, Jun. 27, 2017>
Article 1 (Enforcement Date)
This Decree shall enter into force on the date of its promulgation.
Article 2 Omitted.
ADDENDA <Presidential Decree No. 28283, Sep. 5, 2017>
Article 1 (Enforcement Date)
This Decree shall enter into force three months after the date of its promulgation: Provided, That Article 6 of attached Table shall enter into force on the date of its promulgation.
Articles 2 through 6 Omitted.
ADDENDA <Presidential Decree No. 28387, Oct. 17, 2017>
Article 1 (Enforcement Date)
This Decree shall enter into force on October 19, 2017.
Article 2 (Transitional Measures concerning Standards for Calculating Penalty Surcharges)
Notwithstanding the amended provisions of Article 35-3 (3) and (5) and attached Table 2-3, the former Article 35-3 (3) and (5) shall govern in applying standards for calculating penalty surcharges to any violations committed before this Decree enters into force.
ADDENDUM <Presidential Decree No. 28918, May 28, 2018>
This Decree shall enter into force on May 29, 2018.
ADDENDA <Presidential Decree No. 29269, Oct. 30, 2018>
Article 1 (Enforcement Date)
This Decree shall enter into force on November 1, 2018.
Articles 2 through 11 Omitted.