[E-Daily Reporter SHIN MIN JOON ] The retail industry is successively overhauling its organizational structures and management systems to protect personal information.

As the volume of customer data handled by retail companies has increased due to the expansion of online shopping, membership programs, and delivery services, a series of personal data breaches has caused information security to rapidly emerge as a critical management issue directly linked to corporate trust. The retail industry is expanding dedicated information security teams or placing them under the direct supervision of the CEO, while also strengthening security policy audits conducted by external experts and the management of partner companies.

According to the retail industry on the 15th, #CJ Corp. Olive Young recently established a Personal Information Protection Team and a Security Strategy Team under its Information Security Center. This move separates the functions of personal information protection and security strategy—previously handled by the existing Information Security Center—to strengthen management capabilities. Olive Young’s Information Security Center reports directly to the CEO, and the center director serves concurrently as the Chief Information Security Officer (CISO) and the Chief Privacy Officer (CPO).

The company has also increased its investment in information security and expanded its dedicated workforce. According to information security disclosures by the Korea Internet & Security Agency (KISA), Olive Young’s investment in information security last year totaled approximately 6.2 billion won, a 10.8% increase from the previous year. During the same period, the number of dedicated information security staff rose from 11.7 to 14.1.

Olive Young is also devoting significant effort to managing partner companies that process personal information. External transactions involving the processing of personal information undergo both legal review and security-focused review. For contracts outsourcing the processing of personal information, the company uses standard agreements that reflect the requirements of relevant laws and regulations and also reviews the appropriateness of the terms of individual contracts.

Shinsegae Co.,Ltd. has expanded its information security organizations across its affiliates. In particular, during a recent organizational restructuring, it established new Information Security Centers at SCK Company, which operates Starbucks, and E-MART Co., Ltd. E-MART Co., Ltd. and Chosun Hotel & Resort elevated their existing security organizations to center-level status.

E-commerce platforms are also focusing their efforts on personal information protection. Musinsa operates an IT Security Division—a dedicated information security organization—that reports directly to the Chief Executive Officer (CEO). The Information Security Committee, chaired by the Chief Information Security Officer (CISO), includes key executives such as the CEO, Chief Technology Officer (CTO), Chief Financial Officer (CFO), and Chief Risk Officer (CRO), as well as heads of relevant departments such as information security, IT operations and development, and compliance. Musinsa’s dedicated information security staff increased from 4.6 in 2022 to 9.8 last year. The company is recruiting specialists in areas such as information security policies, network security, and cloud security.

Coupang has initiated security audits conducted by external experts. Last September, it launched an Information Security Advisory Committee comprising seven external experts in the fields of information security, law, management, and information technology (IT). Through regular meetings, the committee reviews security policies and incident response systems and proposes improvements in response to security threats and changes in laws and regulations. Heo Seong-wook, Chairman of the Chief Privacy Officer (CPO) Forum, and Brett Mattis, Coupang’s Chief Information Security Officer, serve as co-chairs.

Baemin is tightening its oversight of partner companies entrusted with processing personal information. It has expanded the number of security inspection items for contractors from 31 to 53 and is conducting on-site, comprehensive inspections of the entire process—from the collection, storage, use, and provision of personal information to its disposal. The company is also identifying and addressing risk factors specific to each contractor and system. Baemin is also refining the terms of its data protection agreements with service providers and strengthening procedures to conduct preemptive checks on personal information protection matters in accordance with manuals whenever new customer service centers are opened.

The reason the retail industry is strengthening its security management is the recent spate of data breaches within the sector. Over the past three months, personal information has been leaked from platforms such as 29CM and SSG.com. The retail industry is not only enhancing its security organizations and management systems but also expanding the scope of its oversight. This is because, in addition to processing customers’ names, contact information, and shipping addresses during online transactions, the expansion of overseas operations and artificial intelligence (AI) services requires them to also consider country-specific personal information regulations and data access permissions.

A retail industry official stated, “As the issue of personal data breaches has recently spread across all sectors of the domestic industry, it has emerged as a critical concern for the retail sector,” adding, “The retail industry is not only expanding its organizational structure and increasing investment but is also meticulously reviewing whether access rights management and partner audits are being properly carried out on the ground.”