Three measures sowed seeds of crisis

Loopholes in rules and regulations initially intended to strengthen the financial industry and protect consumer information are blamed for triggering the country’s worst-ever data leaks.

Getting the most attention are three measures enacted from 1995 to 2000, when the Korean financial industry was undergoing a major restructuring: the Financial Holding Company Act, Real Name Financial Transaction Act and Credit Information Use and Protection Act.

The Financial Holding Company act of November 2000 contains Article 48-2, which allows subsidiaries of financial holding groups to share customer information.

The act was intended to promote larger financial holding companies to improve the industry’s competitiveness and to encourage efficient and sound management of small financial units within groups. It was based on economies of scale, aiming at expanding relatively small financial companies so they could compete abroad.

“The information-sharing provision was needed to make local financial companies competitive compared to foreign players, because the size of each company’s data ultimately can be translated into power and profits,” said Lee Kyung-ho, a professor at the Graduate School of Information Security at Korea University.

Experts estimate tens of billions of card numbers and accounts have been shared among financial entities in the years since the enactment of the law.

According to the Financial Services Commission, there were around 4 billion cases of information trading in 2011-12.

The real-name financial transaction system of Korea has been a big contributor to data leakage as well, experts say.

“It is true that the Korean financial authority demands much personal information compared to other countries when making financial transactions, exposing individuals to fraud and financial crimes,” said a research fellow at the Center for Information Security Technologies at Korea University.

The Real Name Financial Transaction Act of 1997 requires consumers to use their true names and reveal identity card numbers in financial transactions.

The Credit Information Use and Protection Act, written in 1995, also allows companies to share customer information in order to judge credit worthiness.

Financial authorities are reviewing steps related to protection of personal information as part of efforts to prevent a repeat of the leaks.

“The authorities are considering measures to revise the current rules that have given room to allow data theft,” said an FSC official.

Along with lax legal provisions, accessible and widely used credit cards also played a significant role in the crisis.

According to a CNN report in November, the use of credit cards is one of 10 areas in which Korea is a global leader.

CNN said Korea became the world’s top user of credit cards two years ago, adding that while Americans made 77.9 credit card transactions per person in 2011 and Canadians made 89.5, Koreans made 129.7.

Wide use of plastic was, in fact, encouraged by the government in the late 1990s and early 2000s to stimulate a domestic economy that was hurting after the Asian financial crisis. Credit cards were seen as a way to boost spending and enhance transparency of transactions, which would increase tax collections.

Then the Kim Dae-jung administration eased regulations on credit card issuance. This included improved tax incentives on year-end settlements.

With fewer regulations, credit card companies started to aggressively distribute and promote their products, leading to the first credit card crisis in 2003.

With credit cards distributed even to people with low credit ratings, people started to take out loans they couldn’t afford with high interest rates. Defaults followed. The crisis came to a screeching halt after 3.5 million card holders became delinquent, with some committing suicide. As a result, some credit card companies were sold while others like Kookmin Card merged back into Kookmin Bank.

However, in recent years as the country slowly began recovering from the 2008 global crisis, financial companies started to spin off credit card units to raise competitiveness and enhance profitability. KB Kookmin Card was the first in March 2011. Woori Card followed in April 2013.

Korea Exchange Bank plans to spin off its credit card unit and merge it with Hana SK Card by end of the first quarter. The merged credit card company is estimated to have 640 billion won in capital and 2.8 trillion won in assets.

Shinhan Card launched in 2007 after merging with the troubled LG Card.

As a result, Koreans’ credit card spending grew to 562 trillion won in 2012.

The number of newly issued cards stood at 116 million in the same year, according to the Bank of Korea.

BY SONG SU-HYUN [ssh@joongang.co.kr]