Financial Authorities Introduce 'Continuous Information Security Evaluation System' for Financial Institutions

Benefits Such as Sanction Reduction for Outstanding Information Security Institutions

[Asia Economy Reporter Kim Hyo-jin] The Financial Services Commission announced on the 6th that it will introduce the 'Continuous Information Protection Evaluation System' to continuously and systematically inspect the personal credit information protection status of over 3,600 financial institutions.

The Continuous Information Protection Evaluation System involves continuously inspecting the management and protection status of personal credit information handled by financial companies and assigning scores and grades based on the inspection results. It will be implemented on February 4th next year.

Accordingly, the financial authorities have specified evaluation items to enable comprehensive inspection throughout the information lifecycle. These include the principle of consent, collection and provision, retention and deletion, rights protection, processing consignment, administrative protection measures, technical protection measures, and pseudonymized information protection measures.

They will also inspect the implementation of technical and administrative information protection measures related to pseudonymized information processing, transmission request compliance, and data linkage. This includes the status of separate storage of pseudonymized and additional information, compliance with transmission requests and withdrawals, and whether data linkage is conducted through specialized data linkage.

The financial authorities plan to grant a 'Stability Certification Mark' that offers benefits such as reduced sanctions in case of incidents to institutions with excellent scores and no incidents over a certain period.

Accordingly, the financial authorities expect that consistent and secure information protection in new data processing environments, such as the emergence of AI and the introduction of pseudonymized information, will enhance public trust.

Furthermore, through systematic inspection of information protection levels in the financial sector, precise monitoring, and improvement of the financial sector's self-inspection capabilities, the financial authorities expect to reduce the possibility of incidents such as information leakage.