Korea privacy watchdog tightens rules on call-center access to customer data

The Personal Information Protection Commission said Thursday it has told nine companies in the delivery, home shopping, online retail and fixed-line telecom businesses to limit what call-center agents can see and to curb arbitrary searches of customer records, after a pre-emptive inspection found some agents could retrieve detailed addresses from a single piece of information.

The audit followed a case in March in which a call-center agent used unauthorized lookups of customer data in a retaliatory crime. It covered five service operators — Coupang, Wemakeprice, CJ ENM, Gmarket and SK Broadband — and four call-center contractors: MetaM, Ubase, Transcosmos Korea and Huconnect.

Investigators found that in some cases entering only a customer's name or phone number was enough to bring up a detailed address, and that names, phone numbers and addresses appeared on agents' screens without masking.

The inspection also covered compliance with legal obligations such as managing access rights, and found that most companies had basic measures in place, including checks on access logs and training for agents. One company, identified only as Company A, did not apply secure authentication such as certificates or security tokens for remote access. Others omitted required fields in access logs or kept them for one year, short of the two-year legal retention period, and some did not disclose the scope of outsourced personal-data work and the contractors handling it. Most of those shortcomings were corrected during the inspection, and the commission issued corrective recommendations for items still outstanding.

The commission issued a set of four recommended practices for call centers. It advises displaying only the information needed for each type of inquiry and processing stage, and masking the rest: showing only the first and third characters of a name, limiting addresses to the street name or legal district, showing only the middle digits of a phone number, and revealing only the first two characters of an email address's identifier plus the domain.

It also recommends restricting searches by name or phone number and requiring a stated reason and additional authentication before detailed records are opened or masking is lifted. Access should be limited to staff whose duties require it, with unnecessary rights recovered promptly when employees leave or change roles, and access logs kept and monitored for repeated or bulk lookups.

The commission said it will check whether the recommendations are carried out and will hold briefings for the industry.