"No Unauthorized Searches or Bulk Display of Customer Information"... Customer Service Center Rules Established

Preliminary inspections of the delivery, shopping, and telecommunications sectors
Recommendations to prevent unnecessary access to personal information

Going forward, customer service representatives will be prohibited from looking up a customer's detailed address without authorization using just one piece of information, such as a name or phone number, or displaying a customer's information in full on their screens.

Song Kyung-hee, chairperson of the Personal Information Protection Commission, delivers opening remarks at the 21st plenary meeting held at the Government Complex Seoul on the 28th. Provided by the Personal Information Protection Commission.

The Personal Information Protection Commission said on October 29 that it had established the “Four Key Rules for Protecting Personal Information at Customer Service Centers” and recommended stronger safeguards to prevent customer service representatives from accessing or using personal information without authorization or displaying it in bulk.

First, under the principle of displaying and accessing only the minimum necessary information, the commission recommended masking customers' names, addresses, phone numbers, email addresses, and other information shown on representatives' screens. The system will also block representatives from searching for customer information at their own discretion. The commission recommended limiting the scope of information accessible for each type of work and immediately revoking system access rights when an employee leaves. The measures also include establishing a logging and monitoring system to retain access records, and continuously detecting and inspecting anomalous activity, such as a representative repeatedly searching for information or conducting searches on a large scale.

The rules were drawn up in response to an incident in March in which a representative accessed customer information without authorization and used it in a retaliatory crime. They are based on the results of a preliminary inspection of five companies in the delivery (Coupang and Widakhan Sangsang), shopping (CJ ENM and Gmarket), and telecommunications (SK Broadband) sectors, as well as four customer service center operators.

According to the commission, businesses generally implemented basic safeguards, such as checking access records and training representatives. However, inspections found cases in which secure authentication methods, such as certificates or security tokens, were not used for external access. Some businesses also omitted required items from access records or failed to comply with the statutory retention period of two years. In other cases, businesses outsourced personal information processing without disclosing the details or the contractors. It was also possible to look up personal information, including detailed addresses, by entering only a customer's name.

A commission official said, “The commission plans to verify whether its recommendations for correction and improvement have been implemented and to promote the principle of accessing and using only the minimum necessary personal information across all aspects of customer service center operations.”

This content was produced with the assistance of AI translation services.