The Korean government plans to expand the MyData service beyond finance and public sectors to all areas of daily life starting in March 2025. While this scheme facilitates data management in various industries, concerns arise over data breaches and transmission costs. Considering these challenges, the Sungkyun Times (SKT) will examine its data protection issues, economic strains, and potential countermeasures.
The MyData Story
-From A: Background of MyData
MyData is a service that allows individuals to transfer their personal information from various institutions to a specific business, view their credit information in a single app, and receive personalized product recommendations. This service, launched in January 2022, is based on the right to data portability, which gives users the right to request the transfer of their personal credit information from financial companies to MyData businesses. MyData businesses use the collected information to recommend financial products and provide financial services such as credit score management and debt refinancing. Currently, MyData operates exclusively in financial and public sectors, allowing individuals to send their information to themselves or selected recipients through financial applications and administrative or public institutions. For example, in the financial industry, Woori Bank offers a service through the Woori WON Card application that allows users to readily view all their financial information, such as assets and hidden points. It also provides a consumption expenditure calendar to help manage spending. In the public sector, with Samsung Fire & Marine Insurance’s car insurance, in the event of an automobile accident, MyData users can easily file an insurance claim by agreeing to provide personal authentication and information, without having to submit required documents separately. In this way, MyData enables personalized services and efficient management through the use of personal information, creating a more convenient experience.
-To Z: Unlocking MyData 2.0
The government plans to expand MyData in March 2025, extending its services beyond finance and public sectors to 10 key areas selected by the Personal Information Protection Commission (PIPC), which include healthcare, telecommunications, and transportation. The four main aspects that needed further improvement from the previous services were information expansion, business activation, user convenience, and data protection. To support this, the PIPC announced a legislative notice to revise the Enforcement Decree of the Personal Information Protection Act to promote MyData across sectors in May 2024. The revision set criteria for information transmitters, recipients, and transmission methods beyond financial institutions. With a more substantial legal basis, MyData could now cover healthcare, telecommunications, and retail industries and begin gradually expanding industries. Related services would also be available at physical branches to support digitally vulnerable groups for in-person sign-ups. In an interview with the SKT, Doctor Roh, a hospital director in Seoul City, stated that expanding access to medical data will shift doctor-patient relationships from hierarchical to interactive, empowering patients in treatment decisions. Additionally, in the past, individuals had to consider which financial institutions they were affiliated with to select financial products. However, the revision would now allow consumers to view all financial data at once and manage third-party access easily. This enables proactive data management and personalized services across sectors.
MyData Glitches Uncovered
-Data Leak Exposed
Despite its advantages, MyData faces data-related risks in two aspects: in-app malfunctions and potential leaks to foreign distribution companies. Firstly, the Application Programming Interface (API) method in MyData serves as an intermediary for data exchange. The financial institution holding the data delivers only the requested information, addressing excessive data collection issues in previously used methods such as web scraping. Although API is safer, flaws in MyData applications could result in leaks. In December 2021, the MyData financial service Hana HAP malfunctioned, unintentionally exposing clients’ personal information. Secondly, consumer data could be leaked by other companies. Korea’s expanded MyData business is globally the first to mandate the right to data portability to distribution and platform businesses. This raises concerns, as transferring domestic consumer data to companies with weak security could make it a vulnerable target for hackers. Additionally, sensitive data, including consumption habits, could be transmitted without user awareness. In fact, the PIPC fined the online retailer AliExpress in July 2024 for transferring Korean customer data to 180,000 Chinese vendors without adequately notifying users. The PIPC noted that personal data provided to foreign entities cannot always be protected under domestic laws. As MyData expands, similar risks, such as data being transferred abroad without user consent or legal protection may become more critical.
-The Cost of MyData Chaos
The transmission costs for MyData operators and the financial burden on online distributors may hinder MyData’s goal of cross-sector data fusion. Large financial technology (FinTech) providers like Naver Pay, Kakao Bank, and Toss Bank offer free credit information management services. According to Financial Services Commission statistics, 110.33 million domestic financial consumers, including duplicates, had signed up for MyData as of December 2023. However, financial companies’ profitability remains low as managing personal credit information generates little revenue, which leads companies to rely on ancillary services like financial product brokerage, data analysis, and advertising. Moreover, the MyData transfer costs, incurred as operators receive data from financial institutions and telecommunications companies, increased by ₩4.6 billion in 2023 to ₩32.8 billion in 2024 due to the rising number of users. As a result, smaller companies facing additional transmission costs have withdrawn from MyData. This suggests that as MyData expands, financial burdens on small and medium-sized enterprises could grow, particularly straining online retail businesses. Imposing transmission obligations on these businesses, which are already struggling from competition with Chinese e-commerce, will increase pressure on MyData operators in the distribution sector.
Cracking the MyData Code
-Fixing the Data Leak
To prevent data breaches, the government must recognize the severity of overseas personal data leaks and implement policies to address this issue. The European Union’s (EU) General Data Protection Regulation (GDPR), which served as a model for South Korea’s MyData, is a law that directly applies to companies both within and outside the EU regarding personal data protection. This makes any entity processing the personal data of individuals within the EU subject to the GDPR. If violated, fines of up to 4% of the company’s global revenue or €20 million can be imposed, whichever is higher. Due to such legal regulations, Korean companies have swiftly adapted to comply with the GDPR, with the government raising corporate awareness and providing education and consultation. If the PIPC, responsible for investigating and addressing data leaks in Korea, introduces strict regulations and enforces them rigorously, foreign companies utilizing Korean citizens’ data through MyData would also be compelled to take maximum precautions against data breaches. In an interview with the SKT, Professor Park Eun-il of the Department of Applied Artificial Intelligence stated that strong authentication, encryption, and access monitoring are key to enhance security. Globally, the EU, United Kingdom, and United States (U.S.) emphasize data control and portability, while South Korea focuses on credit information. If Korea introduces a similar legal framework, it can be expected to enhance the level of personal data protection, establish data sovereignty, and foster a trust-based digital ecosystem.
-Optimizing Data Transmission
Reducing MyData transmission costs is key to integrating data across industries. Strategies like lowering transmission fees or providing government-supported API compatibility platforms could be possible solutions. The U.S.-based trading application Robinhood cut costs by eliminating branches, research, and analytical tools, funding its operations through interest on deposits instead of commissions. This allowed commission-free cryptocurrency trading and a cash management service through its debit card. Similarly, Korea must adopt innovative strategies to reduce MyData transmission costs, shifting from commission-based models to exploring new revenue sources. Furthermore, adequate financial and non-financial integration requires interoperable MyData APIs. According to the Korea Digital Health Industry Association, the Ministry of Trade, Industry, and Energy’s Bio-industry Technology Development Project is developing platforms for cross-industry data integration, digital pharmacies, and corporate health data distribution. These platforms acquire user data from finance, healthcare, and fitness, building a MyData platform through API integration. Financial support for this platform could lower transmission fees, which enhances cost effectiveness and encourages industry participation. If the government eases businesses’ financial burden, MyData expansion across sectors will likely succeed, benefiting consumers and enterprises while fostering an efficient and secure data ecosystem.
Just as Rome was not built in a day, MyData’s full potential will not be realized overnight. As its scope expands, strong privacy protections and security are crucial. With thoughtful regulation and safeguards, MyData can usher in a new era of personalized services. Kingos, be sure to pay attention to this promising future.