Preliminary audit of 9 customer service centers in delivery, shopping and telecom sectors finds security gaps
Centers faulted for missing secure authentication and incomplete access logs
Watchdog issues four-point code of conduct for personal data protection
Nine customer service centers operated by companies in the delivery, shopping and telecommunications sectors — including Coupang Inc and G Market — have received corrective recommendations from the Personal Information Protection Commission for inadequate data protection measures.
Inspectors found that the centers had failed to apply secure authentication methods for external access and had omitted mandatory fields from access logs, among other shortcomings.
Along with the corrective recommendations, the commission announced a four-point code of conduct for personal data protection at customer service centers and said it would continue pushing for improvements to security measures.
The commission said Thursday it had reviewed personal data handling practices at customer service centers that process large volumes of customer information and had voted to adopt corrective measures.
The preliminary audit covered five service providers — Coupang Inc, Widaehan Sangsang, CJ ENM, G Market and SK Broadband — and four customer service center operators: Meta M, Ubase, Transcosmos Korea and Hunect.
The audit found that one company had not applied secure authentication methods — such as digital certificates or security tokens — when accessing systems from outside its network.
Other companies had omitted mandatory fields from access logs or retained records for only one year instead of the legally required two years. In some cases, companies that had outsourced personal data processing work failed to disclose the scope of the outsourced tasks or the identity of the subcontractors.
In some instances, entering a single piece of information — such as a customer's name or phone number — was enough to retrieve detailed personal data including home addresses. Inspectors also found cases where customer names, phone numbers and addresses were displayed on consultation screens without any masking.
The commission said many of the deficiencies had been remedied during the inspection process, and that corrective recommendations had been issued for items not yet fully addressed.
Based on the audit findings, the commission also introduced a four-point code of conduct that service providers and customer service center operators can voluntarily adopt.
The first point calls on operators to display only the information necessary for each task and to prevent blanket exposure of personal data through masking.
The second requires that the range of information a consultant can access be limited to the scope of assigned duties, and that unnecessary access privileges be promptly revoked when an employee leaves or changes roles.
Third, access logs must be retained for the legally required period — one or two years depending on the scale and type of processing — and any abnormal activity must trigger protective measures such as requiring consultants to log the reason for a data lookup.
Fourth, service providers must periodically audit whether their outsourced customer service operators are complying with data protection requirements. Operators are also recommended to train consultants on rules prohibiting unauthorized access to or use of customer data, and to strengthen accountability.
"This inspection is significant in that it identified and addressed risks of personal data misuse or abuse that can arise in real working environments before they cause harm," the commission said. It added that it plans to verify compliance with the corrective and improvement recommendations, promote the code of conduct, and hold briefings for relevant industries to spread the principle of minimum data access and use across customer service center operations.
sjpark@heraldcorp.com
