URL copied successfully.
Press CTRL+V or paste display URL.
| Article 32 (Consent to Provision and Use of Personal Credit Information) |
| (1) | If a credit information provider or user intends to provide any personal credit information to any other person, he or she shall obtain individual consent in advance from the relevant credit data subject each time he or she intends to provide personal credit information by using the following methods, as prescribed by Presidential Decree: |
| 1. | In writing; |
| 2. | Electronic documents bearing an electronic signature (referring to the one by which the real name of a signer can be authenticated) defined in subparagraph 3 of Article 2 of the Digital Signature Act (referring to electronic documents defined in subparagraph 1 of Article 2 of the Framework Act on Electronic Documents and Transactions); |
| 3. | Entering the personal identification number by wire or wireless communication that ensures stability and reliability of the consent to provide such information, in consideration of the details and purpose of the personal credit information to be provided; |
| 4. | Obtaining consent from an individual after notifying him or her of the consent by wire and wireless communication. In such cases, evidential material shall be obtained and maintained by, for instance, recording a verbal dialogue concerning identification of the individual, questions as to whether the individual consent and his/her answers thereto, etc., and post-notification procedures shall be conducted, as prescribed by Presidential Decree; |
| 5. | Other means prescribed by Presidential Decree. |
| (2) | A person, who intends to obtain any personal credit information from a personal credit rating company, sole proprietor credit rating company, corporate credit inquiry company, or credit information collection agency, shall obtain individual consent from the relevant credit data subject whenever he/she intends to provide personal credit information (excluding where it is provided to maintain the accuracy and currency of personal credit information within the scope of the purpose or use already agreed) by any means set forth in subparagraph of paragraph (1), as prescribed by Presidential Decree. In such cases, the person who intends to obtain personal credit information shall notify the relevant credit data subject when his/her personal credit score may be degraded at the time of such inquiry. <Amended on Mar. 11, 2015; Feb. 4, 2020> |
| (3) | Where a personal credit rating company, sole proprietor credit rating company, corporate credit inquiry company, or credit information collection agency provides personal credit information under paragraph (2), it shall verify whether the person who intends to obtain such personal credit information has obtained consent under paragraph (2), as prescribed by Presidential Decree. <Amended on Feb. 4, 2020> |
| (4) | When a credit information company, etc. obtains consent to the provision and utilization of personal credit information, it shall explain the information subject to mandatory consent and information subject to optional consent to provide services by distinguishing them, and obtain consent thereto respectively, as prescribed by Presidential Decree. In such cases, as to the information subject to mandatory consent, explanation of their relationship with the provision of services shall be explained, and as to the information subject to optional consent, it shall be notified that the other party need not consent to the provision of information. <Added on Mar. 11, 2015> |
| (5) | No credit information company, etc. may refuse to provide services to a credit data subject on the ground that he/she does not consent to information subject to optional consent. <Added on Mar. 11, 2015> |
| (6) | Where any credit information company, etc. (including data agencies for purposes of applying subparagraph 9-3) provides personal credit information in any of the following cases, paragraphs (1) through (5) shall not apply: <Amended on Mar. 11, 2015; Feb. 4, 2020> |
| 1. | Where a credit information company or a claims collection agency provides such information for the purpose of performing centralized management and utilization thereof with another credit information company, claims collection agency, or credit information collection agency; |
| 2. | Where such information is required to entrust the processing of credit information under Article 17 (2); |
| 3. | Where the relevant personal credit information is provided as the rights and obligations are fully or partially transferred by business transfer, division, merger, etc.; |
| 4. | Where personal credit information is provided to a person who uses the information for purposes prescribed by Presidential Decree, including claims collection (applicable only to the credit which is an object of collection), purpose of authorization or permission, determination of a company's creditworthiness, and transfer of securities; |
| 5. | Where personal credit information is provided in accordance with a court order for submission thereof or a warrant issued by a judicial officer; |
| 6. | Where such information is provided upon request by a prosecutor or judicial police officer, in an emergency where a victim's life is in danger or he/she is expected to suffer bodily injury, etc., so that no time is available to issue a judicial warrant under subparagraph 5. In such cases, the prosecutor provided with personal credit information shall, without delay, seek a warrant from a judicial officer, and the judicial police officer shall apply to the prosecutor for a warrant, who, in turn, seeks it from a judicial officer. Where the warrant is not issued within 36 hours from receipt of the personal credit information, such personal credit information shall be scrapped without delay; |
| 7. | Where such information is provided upon written request by the head of a competent tax office for inquiry and examination in accordance with tax-related Acts, or upon request for the taxation data subject to mandatory submission in accordance with tax-related Acts; |
| 8. | Where personal credit information held by a financial institution is provided to a foreign financial supervisory body in accordance with international conventions, etc.; |
| 9. | Where information referred to in subparagraph 1-4 (b) of Article 2 is provided to or from a personal credit rating company, a sole proprietor credit rating company, a corporate credit inquiry company engaged in business affairs of providing corporate credit ratings or technology credit ratings, or a centralized credit information collection agency; |
| 9-2. | Where pseudonymized information is provided for the purpose of producing statistics, conducting research, and retaining records for the public interest; In such cases, the production of statistics shall include the production of statistics for commercial purposes, including market research, and research shall include industrial research; |
| 9-3. | Where personal credit information is provided to a data agency for the purpose of combining data sets under Article 17-2 (1); |
| 9-4. | Where any personal credit information is provided for a purpose that does not conflict with the purpose for which the personal credit information was initially collected in consideration of the following factors: |
| (a) | Relevance between the purposes; |
| (b) | Reasons and events leading to the collection of personal credit information from the credit data subject by the credit information company, etc.; |
| (c) | Impact of provision of the relevant personal credit information on the credit data subject; |
| (d) | Whether measures to protect personal credit information, such as pseudonymization, have been appropriately implemented; |
| 10. | When such information is provided in accordance with this Act and other statutes; |
| 11. | Other cases prescribed by Presidential Decree as equivalent to those stipulated in subparagraphs 1 through 10. |
| (7) | Any person who intends to provide personal credit information to any other person or who obtains such information under any subparagraph of paragraph (6) shall notify, in advance, the relevant credit data subject of the fact of and reason for such provision, as prescribed by Presidential Decree; provided,, where in extenuating circumstances prescribed by Presidential Decree, such circumstances may be notified or publicly announced later by posting them on his/her website or by similar means. <Amended on May 19, 2011; Mar. 11, 2015> |
| (8) | Any credit information provider or user prescribed by Presidential Decree, who provides personal credit information to any other person subject to paragraph (6) 3, shall obtain approval from the Financial Services Commission with regard to any of the matters prescribed by Presidential Decree, including the scope of credit information provided. <Amended on Mar. 11, 2015> |
| (9) | A person who has obtained personal credit information after obtaining approval under paragraph (8) shall manage it separately from the personal credit information of owners of credit information with whom he/she currently deals, as determined by the Financial Services Commission. <Added on Mar. 11, 2015> |
| (10) | Where a credit information company, etc. provides personal credit information, it shall verify the identity of the person who obtains the personal credit information and purpose of use thereof, as determined and publicly notified by the Financial Services Commission. <Amended on Mar. 11, 2015> |
| (11) | Where there is any dispute over whether individual prior consent has been obtained under paragraph (1), the credit information provider or user who has provided the personal credit information, shall prove such fact. <Amended on Mar. 11, 2015> |