“Only Necessary Information Should Be Displayed on Customer Service Screens,” Personal Information Protection Commission (PIPC) Recommends

[Financial News] After an incident in which someone got a job at a delivery platform’s call center under false pretenses and misused subscriber information for personal retaliation, the PIPC inspected customer service centers and outsourcing firms at major companies. The inspection found that some centers had left agents able to access unnecessary subscriber information without authorization.
The PIPC set out four customer service privacy rules, including masking information on screen so that agents cannot casually view subscriber data.
The PIPC said on the 29th that it had inspected personal information handling at customer service centers that process large volumes of users’ personal data and recommended four privacy practices that service providers and customer service center operators can voluntarily follow.

The companies whose practices the PIPC inspected this time included customer service centers at major firms such as Coupang, Widaehan SangSang, CJ ENM, Gmarket and SK Broadband, as well as customer service center operators such as MetaM, UBASE, Transcosmos Korea and HUNECT.
The PIPC said, “The inspection found that Company A did not use secure authentication methods, such as certificates or security tokens, for external access. Company B omitted required items from its access logs or kept them for only one year, shorter than the legally required retention period of two years. There were also cases in which companies outsourced personal information processing without disclosing the work being outsourced or the parties entrusted with it.”
It also pointed out, “Some systems allowed personal information such as a detailed address to be retrieved by entering just one piece of information, such as a customer’s name or phone number. There were also cases in which customers’ names, phone numbers and addresses appeared on agent screens without being masked.”
The PIPC said it had called for stronger safeguards to prevent the misuse or abuse of personal information, and that considerable improvements had been made during the inspection process.
Based on the inspection results, it also set out service privacy practices that include recommended masking standards for key personal information, such as names, addresses, phone numbers and email addresses.
First, it said that only personal information essential to handling an inquiry should be displayed and accessed. It recommended displaying only the first and third characters of names, and phone numbers only up to the middle digits. It also called for access to be limited to those who need the information for their work; records to be kept and checked showing who accessed what information and when; and agents and customer service center operators to be jointly managed and supervised.
The PIPC said, “We plan to check whether the corrective actions and recommended improvements have been implemented, promote the privacy practices, and hold briefings for the relevant industries, among other measures, to spread the principle of minimizing access to and use of personal information throughout customer service center operations.”
[email protected] Lee Gu-sun Reporter