Korea privacy watchdog flags customer-center data lapses at 9 firms
The Personal Information Protection Commission issued corrective recommendations after finding unmasked customer data and short access-log retention at inspected call centers.
The Personal Information Protection Commission announced on October 28 the results of a pre-inspection of 9 companies in delivery, home shopping, online shopping and fixed-line telecom, along with corrective measures, according to dailysecu.com.
The inspection covered service providers Coupang, Widaehan Sangsang, CJ ENM, Gmarket and SK Broadband, plus customer-center operators MetaM, Ubase, Transcosmos Korea and Hunet.
The commission found that some customer centers allowed staff to search detailed addresses using only a customer's name or phone number. In some cases, customer names, phone numbers and addresses were displayed on consultation screens without masking.
One company did not apply certificate or security-token authentication for external access to its customer-center system. Some companies kept access logs for only one year instead of the legally required two years, or omitted required log fields, and some did not disclose the content of outsourced personal-data processing or the information of the entrusted companies.
The commission presented four customer-center personal information protection rules covering minimal display and masking, role-based access control, access-log management and abnormal-usage detection, and supervision of outsourced operations.
Background
In March, a customer-center counselor improperly looked up customer information and used it in a retaliatory crime, prompting this inspection.
Quick answers
Which companies were inspected?
Coupang, Widaehan Sangsang, CJ ENM, Gmarket and SK Broadband, plus customer-center operators MetaM, Ubase, Transcosmos Korea and Hunet.
What did the regulator find?
Unmasked customer data on consultation screens, address searches using only a name or phone number, weak external-access authentication and access logs kept for one year instead of two.
What rules did the commission issue?
Four customer-center rules covering minimal display and masking, role-based access control, access-log management and abnormal-usage detection, and supervision of outsourced operations.