Personal Information Protection Commission orders financial firms to stop unnecessary ID collection

The Personal Information Protection Commission said it has secured improvements from 220 financial companies that were processing resident registration numbers without legal grounds. The regulator conducted preliminary fact-finding inspections across six financial sectors, including banking, insurance, and securities.

The review focused on routine business operations such as member information and account management, which are unrelated to direct financial transactions. While laws require the collection of these unique identifiers for specific transaction purposes, the commission found that many firms had formed a habit of using them as a basic means of identification in general administrative work.

Under the Personal Information Protection Act, the processing of these numbers is prohibited except in cases specifically permitted by law. Leaks or misuse can cause long-term damage to victims because the numbers allow for unique individual identification and cannot be changed arbitrarily.

This action follows a sanction imposed against a credit card company for violating restrictions on processing resident registration numbers under Article 24-2 of the act. As part of the follow-up measures, the commission issued correction recommendations for violations of the law and improvement recommendations for other areas requiring attention.

Song Kyung-hee, chair of the commission, stated that the body acts as a guardian to protect the precious personal information of the public.