Oct 30, 2024

Toss Penalized for Violating Credit Information Act Print Editor Jasmine Choi The logo of Toss (Viva Republica) On Oct. 29, the Financial Supervisory Service (FSS) imposed a significant financial penalty on Viva Republica, the parent company of the popular South Korean fintech platform Toss, for unauthorized use of customer information. The FSS's ad-hoc inspection revealed that Toss had improperly utilized 29,282,869 electronic receipt transaction records provided by an electronic receipt solution company, Company A, from November 2021 to April 2022. These records were directly combined with Toss members' card transaction details without obtaining the necessary consent from the information subjects or using a specialized data agency, as required by the Credit Information Act. The FSS has levied a fine of 5.374 billion won and an additional penalty of 628 million won on Toss, totaling 6 billion won. Furthermore, eleven employees of Toss have faced disciplinary actions, including salary reductions, reprimands, cautions, and cautionary warnings. This enforcement action underscores the regulatory body's commitment to protecting consumer data and ensuring compliance with financial regulations. In addition to the unauthorized use of electronic receipt transaction records, Toss also improperly obtained consent for the collection and use of personal credit information from 4,631,801 individuals. The company marked non-essential items as "mandatory" instead of "optional" in the consent form for collecting and using personal information during membership registration for providing electronic financial and MyData services. Moreover, Toss's My Insurance Inquiry Service was found to have collected and stored personal credit information, such as insurance subscription details and contract status, of 274 users who did not consent to the collection of their personal credit information. This improperly collected data was used to provide the insurance inquiry service to these 274 users 2,102 times. Additionally, Toss violated the obligation to ensure the safety and protection of the credit information computer system as stipulated by the Credit Information Act. The company failed to back up and store access records of the credit information computer system on a separate physical storage device. Viva Republica, founded in 2013, has rapidly grown to become a leading player in South Korea's fintech industry, offering a wide range of financial services through its Toss platform. The company has been at the forefront of innovation, providing users with convenient and efficient financial solutions. However, this recent incident has raised serious concerns about the company's data handling practices and compliance with regulatory requirements.