The South Korean Personal Information Protection Commission (PIPC) published the results of a preventive review on the processing of personal data by customer contact centers, issuing recommendations to strengthen information protection.

This review was initiated following an incident in March, where an advisor used a customer's data without authorization. The authority inspected nine companies in the delivery, online commerce, and telecommunications sectors, including five service providers (Coupang, Great Sangsang, CJ ENM, Gmarket, and SK Broadband) and four contact center operators (MetaM, Ubase, Transcosmos Korea, and Hunect). Failures were identified, such as the absence of secure authentication for external access, retention of access logs for less than the legal period of two years, and non-compliance with transparency obligations regarding subcontracting. It was also noted that systems allowed excessive data consultation and displayed data without masking. Most of these issues were corrected during the inspection, with the remainder subject to correction recommendations.

Based on these findings, the PIPC presented a "4-point Code of Conduct for the protection of personal data in customer contact centers." This code recommends displaying only necessary data by applying default masking, limiting access according to tasks, retaining access logs for the legal duration, and detecting abnormal consultations. The code also emphasizes the supervision of subcontractors by service providers and the continuous training of advisors on their data protection obligations.