(1) Reasons for Proposal
To follow up on “Measures to Increase Cloud Use in the Finance Sector” (July 16, 2018; press release), the Amendment modifies provisions concerning "designation of non-critical information processing system” to increase the scope of data that may be used by a financial company or electronic financial business entity through a cloud service, and also prescribe procedures for safe cloud use.
(2) Major Provisions
A. Modify provisions to enable financial companies and electronic financial business entities to use personal credit information and personally identifiable information on a cloud (Article 14-2, paragraphs 1 and 8)
B. Propose standards for the usage and provision of a cloud in the finance sector, including safety measures that reflect the particular nature of the finance sector (Article 14-2, paragraph 1; attached Table 2-2)
C. Prescribe procedures for using a cloud computing service, through which financial companies, etc., classify the importance of information according to internal standards and evaluate the soundness and safety of service providers (Article 14-2, paragraphs 1 and 2)
Also prescribe grounds on which to allow infringement-handling agencies to assist with cloud computing service safety evaluations conducted by financial companies, etc. (Article 60, paragraph 5).
D. Require the status of cloud use to be reported to the supervisory authority according to the importance of information, and require cloud provider obligations, etc., to be incorporated into outsourcing agreements (Article 14-2, paragraphs 1 and 3 through 6)
E. Modify other provisions to reflect the increased scope of cloud use
In the detailed requirements for physical installations for permits and registrations, change the term “own” to “be equipped with” to match the requirements for physical installations in individual finance business laws (Article 50, paragraph 1)
Relax the requirements for conducting preliminary identity checks on workers for outside orders such that they may be replaced by a fidelity insurance policy request (Article 60, paragraph 1, subparagraph 13)
Adjust the re-examination deadline to every 3 years from January 1, 2019, etc.
