- Published 2026.11.05 11:44
2.6 million borrower credit records past the 5-year mark left un-deleted
In contrast to commercial banks' systems that delete immediately
Beyond delayed measures, a real electronic deletion system is urgently needed
Korea Technology Finance Corporation (KOTEC) and Korea SMEs and Startups Agency (KOSME) have kept 2.6 million credit records of financial consumers and companies whose transactions ended more than five years ago, such as through full loan repayment, without deleting them. The two institutions cited exceptions allowed by law, including the development of credit scoring models, but critics say the indiscriminate accumulation of data has increased potential security risks.
According to findings pointed out by Rep. Choi Su-jin of the People Power Party during the National Assembly Trade, Industry, Energy, SMEs, and Startups Committee audit on Oct. 15, KOTEC holds 310,000 credit records older than five years, while KOSME holds more than 2.29 million. In particular, the records kept by KOSME were found to include a large number of credit files of normal borrowers who had settled their debts and ended their transactions, leaving them tied up on servers for an extended period.
Article 20-2 of the Credit Information Use and Protection Act requires credit information to be deleted within a maximum of five years from the date a financial transaction ends. It is a legal safeguard to protect the privacy of individuals and companies and to prevent large-scale data leaks and misuse. Compared with commercial banks, which have built electronic deletion systems to periodically erase information older than five years, the policy institutions that manage public funds have been too complacent about compliance, critics say.
The two institutions have used the exception clause of the Credit Information Act as a way to bypass the deletion obligation. KOTEC applied the clause on the grounds that it needs to verify companies subject to guarantee restrictions, such as those with unpaid debts after subrogation. KOSME also cited the need to respond to insolvency risks and upgrade its credit scoring model. However, if past data is needed for model development, the principle of data governance is to remove source identification information and keep only statistically processed information. The two institutions were confirmed to have kept borrowers' sensitive information, including resident registration numbers, addresses, salaries and financial statements, in near-original form.
Facing criticism, the two institutions on Nov. 5 announced follow-up measures to overhaul their management of credit information older than five years since the end of transactions. KOTEC said it would establish standards and select information to delete, while KOSME said it would draw up a phased deletion plan next year after legal consultation and research services. However, critics say they are ignoring the essence of the problem by sticking to a 'phased approach' that delays immediate bulk deletion by months or more.
As hacking attacks targeting the public and financial sectors become more sophisticated, the 2.6 million undeleted credit records are nothing short of a major time bomb. Keeping the information of small business owners and individuals who have repaid their loans and ended their dealings with policy finance institutions on servers indefinitely is a clear potential privacy violation. Whether policy finance institutions break away from outdated data accumulation practices and when they actually operate an electronic deletion system, and what level of follow-up inspection financial authorities will conduct, will be key indicators for controlling future security risks.
※ This article is an AI translation of the Korean original published by Korea Credit News; it was checked by automated quality guards and published by the English edition desk.
