On July 16, 2018, the Financial Services Commission (“FSC”) announced its “Plan for Expansion of Cloud Usage in the Financial Sector” (the “Plan”).
Background:
Until now, to promote cloud usage in the financial sector, the Korean government has amended the Regulation on Supervision of Electronic Financial Transactions (“EFTR”) and, in 2016, prepared a guideline on the usage of cloud services in the financial sector. However, recently, the financial sector has been seeing an increasing need for additional regulation on the expansion of cloud usage, followed by an expanded linkage of the financial sector with new technologies, such as AI and Big Data. Accordingly, the FSC announced the Plan.
Details:
The Plan mainly entails: (i) expansion of the scope of cloud usage in the sector; (ii) introduction of standards for cloud services; and (iii) reinforcement of monitoring and investigation on the use of cloud services. Notable aspects of the Plan include:
1. Expansion of the scope of cloud usage in the finance sector
Until now, financial institutions have not been able to use cloud services for their information processing systems, as the EFTR only allowed the use of a cloud for “non-significant information processing systems” that do not process personal credit information and/or unique identification information.
However, the FSC’s Plan is expected to ease the relevant regulations to enable the use of cloud services for even “significant information processing systems” that process personal credit information and unique identification information.
2. Introduction of standards for cloud services
In conjunction with the deregulation efforts, the FSC also announced that it will implement standards for the use and provision of cloud services to which cloud service providers will be obligated to conform in order to ensure data protection.
3. Reinforcement of monitoring and investigation on the use of cloud services
The FSC plans to reinforce the general reporting obligations of financial companies regarding the use of cloud services, and to amend the relevant laws to explicitly prescribe their statutory authority to directly supervise and investigate cloud service providers.
Significance:
The FSC is expected to improve all regulations relating to the use of cloud services in line with the Plan, and we anticipate these efforts to likely result in a more active use of cloud services in the financial sector.