A Case Study on the Information Privacy Laws in Insurance Industry
Authors:   Asia-Europe Perspective Association, Park Kyung-Hee , Lim Ye-Jin , Shin Jung-soon 
Published: June 2018

This study follows cases related to information privacy laws in the financial industry that are increasingly important in Korea and problematic in the Korean legal system and compares them with cases in other developed countries.
In the domestic insurance industry, Korea Credit Information Services was launched in 2016; it integrates the credit information of financial institutions including the Federation of Korean Banks. Considering that credit information sources deal with sensitive data, such as personal information, credit information, financial transactions, and health information, the Korea Credit Information Center has a strong influence.
By contrast, laws related to personal information are included in the Personal Information Protection Act, the Credit Information Act, and the Information and Communications Network Act, and distinct supervisory bodies manage these agencies. To overcome this inconvenience, the Financial Services Commission announced a legislative amendment to the Credit Information Act for 2017 that would unify the regulations on personal credit information applied to financial institutions, credit information companies, and credit information concentration agencies. If the amendment of the Credit Information Act is revised, the credit information law will only be applied to financial institutions, credit information companies, and credit information concentration agencies.
Given this background, we studied cases of personal information in other developed countries. In April 2016, the European Union adopted the General Data Protection Regulation, which is an integrated system operated by individual members. Europe is launching the European Network and Information Security Agency, a specialist network information security agency, and has come to a special agreement to guarantee that companies not only comply with the requirements for information security insurance but are also liable for the cost of information leakage. If such information protection insurance products were deployed in the domestic insurance market, socioeconomic benefits could be expected to increase.
The privacy information protection regulations in the US and Japan follow the self-regulatory model. The autonomous regulatory model is a self-regulatory model in which governments provide autonomous guidelines in accordance with the delegation of the state rather than establishing detailed rules through law. And to realize the purpose of the law internally. This system has the merit of avoiding excessive regulation and emphasizing the autonomy of each member, thus allowing the system to flexibly cope with environmental changes. However, in order for the self-regulatory model to work well in society, it is necessary to raise the level of awareness of information privacy among the members of society. Although Korea has enacted general regulations through laws, there are many inadequacies in implementation. In light of the cases of the United States and Japan, there is a substantial need for education and publicity regarding information privacy laws.