South Korea's Personal Information Protection Commission said on Oct. 29 it inspected personal data handling in customer service centre operations that process customer information in bulk. It said it urged companies to minimise the scope of customer information shown to agents and strengthen controls over arbitrary searches by agents.

The commission conducted the pre-inspection of five major service providers across four sectors - delivery, home shopping, online shopping and wired telecommunications - and four customer service centre operators. It followed a March case in which a customer service agent unlawfully accessed customer information and used it for retaliatory crime. Through the inspection, the commission examined not only whether companies complied with legal obligations such as access-rights management, but also risks of personal data misuse that could arise during consultations.

According to the commission, companies were generally implementing basic protective measures such as checking access records and training agents.

But some did not apply secure authentication methods such as certificates and security tokens for external access. Some companies omitted mandatory access-log items or kept logs for 1 year, shorter than the legal retention period of 2 years.

In some cases, companies outsourced personal data processing tasks without disclosing the details of the outsourced work and the contractors. The commission said many of these shortcomings were improved during the inspection process, and it issued corrective recommendations for matters where measures have not yet been completed.

Based on the inspection results, the commission also issued "four rules for protecting personal information at customer service centres." The rules focus on displaying and viewing only necessary personal information, controlling access so only those who need it for work can access it, recording and checking who viewed what information and when, and jointly managing and supervising agents and customer service centre operators.

The commission plans to check whether corrective and improvement recommendations are implemented. It also plans to promote the rules and hold briefing sessions for related industries so the principle of minimising the viewing and use of personal information spreads across customer service centre operations.