NAVER ​​SASB
Report 2021

Sustainability Accounting Standards Board

NAVER SASB Report 2021

01

CONTENTS
04

Accounting Metrics- Environmental Footprint of Hardware Infrastructure- Data Privacy, Advertising Standards & Freedom of Expression- Data Security- Employee Recruitment, Inclusion & Performance

In 2020, NAVER began to publish three types of reports – ESG, SASB and TCFD reports – inorder to better communicate with its stakeholders regarding its ESG management. As away to further strengthen its stakeholder communication, NAVER published an Integrated
Report that covers both business performance and ESG implementation status in a morecomprehensive manner.
Sustainability Disclosure Topics & Accounting Metrics
Topic

Code

ReportingPage(1) Total energy consumed, (2) percentage grid electricity,(3) percentage renewable

TC-IM-130a.1●

4(1) Total water withdrawn,(2) total water consumed, percentage of each in regions with high orextremely high baseline water stress

TC-IM-130a.2●

5Discussion of the integration of environmental considerations into strategicplanning for data center needs

TC-IM-130a.3●

6

Description of policies and practices relating to behavioral advertising anduser privacy

TC-IM-220a.1●

8Number of users whose information is used for secondary purposes

TC-IM-220a.2●

10Total amount of monetary losses as a result of legal proceedings associatedwith user privacy

TC-IM-220a.3●

11(1) Number of law enforcement requests for user information,(2) number of users whose information was requested,(3) percentage resulting in disclosure

TC-IM-220a.4●

12

List of countries where core products or services are subject to governmentrequired monitoring, blocking, content filtering, or censoring

TC-IM-220a.5●

12Number of government requests to remove content, percentage compliancewith requests

TC-IM-220a.6--(1) Number of data breaches, (2) percentage involving personally identifiable
information (PII), (3) number of users affected

TC-IM-230a.1●

13

Description of approach to identifying and addressing data security risks,
including use of third-party cybersecurity standards

TC-IM-230a.2●

13Percentage of employees that are foreign nationals

TC-IM-330a.1●

16

Employee engagement as a percentage

TC-IM-330a.2●

17Percentage of gender and racial/ethnic group representation for(1) management, (2) technical staff, and (3) all other employees

TC-IM-330a.3●

17Total amount of monetary losses as a result of legal proceedings
associated with anticompetitive behavior regulations

TC-IM-520a.1

●

18

Code

ReportingPage

Entity-defined measure of user activity

TC-IM-000.A●

19(1) Data processing capacity, (2) percentage outsourced

TC-IM-000.B--(1) Amount of data storage, (2) percentage outsourced

TC-IM-000.C--- Intellectual Property Protection & Competitive Behavior
19

Activity Metrics- Entity-defined measure of user activity

Environmental footprint of
hardware infrastructure

Data privacy, advertising
standards & freedom of
expression

Data security

Employee recruitment,
inclusion & performanceIntellectual property protection& competitive behavior

Accounting Metric

Activity Metric

NAVER SASB Report 2021

03

Accounting Metrics
ENVIRONMENTAL
FOOTPRINT OF
HARDWARE
INFRASTRUCTURE(1) Total energy consumed, (2) percentage grid electricity,(3) percentage renewable [TC-IM-130a.1]
Unit

2018

2019

2020

2021

TJ

1,495

1,624

1,649

1,646

159

152

143

124

1784

-

-

-

34

Connect One

-

-

-

18

Total
Green Factory
Total energy
consumption

NAVER Square

TJ

Leased business sites
Data Center GAK
Chuncheon
Total

TJ/ Revenue(KRW billion)

Green Factory
1784
Energy intensity

Connect One
NAVER Square

TJ/ Revenue(KRW billion)

Leased business sites
Data Center GAK
Chuncheon
Direct Energy
Consumption

Total

TJ

Green Factory

LNG

1,472

1,506

1,448

0.27

0.37

0.31

0.24

0.03

0.03

0.03

0.02

-

-

-

0.00

-

-

-

0.00

-

-

-

0.00

-

-

-

0.00

0.24

0.34

0.28

0.21

6.7

5.7

4.5

9.7

5.8

4.8

3.9

1.9

-

-

-

-

5.2

-

-

-

0.1

-

-

-

0.1

0.3

0.4

0.4

0.5

NAVER Square

TJ

Data Center GAK
Chuncheon

TJ

Connect One
NAVER Square

TJ

Data Center GAK
Chuncheon

-

-

-

1.6

0.1

0.1

0.1

0.0

0.04

0.01

0.01

-

-

-

-

-

-

-

-

0.0

-

-

-

0.0

0.4

0.4

0.1

0.3

1,488

1,618

1,645

1,640

143

138

130

113

1784

-

-

-

32

Connect One

-

-

-

14

Total

TJ

Green Factory

NAVER Square

TJ

Leased business sites
Data Center GAK
Chuncheon

04

1,336

-

1784

Steam

8

-

Green Factory

Electricity

14-

Green Factory

Indirect Energy
Consumption

-

1784

Data Center GAK
Chuncheon

Diesel-Connect One
Leased business sites

Mobile combustion-

Green Factory
1784

TJ

-

-

-

14

-

-

-

8

1,335

1,471

1,506

1,448

10.0

8.8

8.5

8.2

-

-

-

2.9

Unit

2018

2019

2020

2021

MWh

37,303

41,68941,19937,402

138

517

837

1,819

511

511

514

512

101

101

101

101

-

-

-

684

36,371

40,34339,53433,989

-

-

-

22

182

217

213

213

-

-

-

62

283

318

314

1,082

101

101

101

101

1784

-

-

-

684

1784

-

-

-

22

-

-

-

62

182

217

213

213

Total Energy Saving

Total

Saving through officemanagement

Data Center

Saving of electricity for
air-conditioning andheating by adopting
geothermal energy
Saving through natural
cooling system

Green Factory

MWhGreen Factory
MWh1784
Data Center

MWh

1784
Saving by producing
renewable energy

Data Center

MWhConnect One
Renewable energy
consumption
Geothermal power

Solar power

Total

MWh

Green Factory

MWhConnect One
Data Center
GAK Chuncheon* Began to manage data of 1784, Connect One, NAVER Square, and leased offices(1) Total water withdrawn, (2) total water consumed, percentage of each in regionswith high or extremely high baseline water stress [TC-IM-130a.2]
2018

2019

2020

2021

Total

177,335

176,517

167,213173,139

Green Factory

92,058

101,929

76,43854,625

-

-

-

5,284

-

-

-

14,46385,27774,58890,774

98,767

9,812

5,428

7,060

5,739

-

-

-

1,142

Unit
Water consumption

Municipal watersupplies

1784

m3

Connect One
Data Center
GAK Chuncheon
Green Factory

Water reuse

Water reuse rate

1784

m3

Connect One

-

-

-

3,000

Green Factory

11

5

9

11

-

-

-

22

-

-

-

21

1784
Connect One%

NAVER SASB Report 202105

ACCOUNTING METRICS

Low-Medium

Medium- HighHigh

Extremely High

0-1

1-2

2-3

3-4

4-5

NAVER business sites[WWF]
Water Risk Filter√
Very Low Risk

Low RiskMedium Risk

High Risk

Very High Risk

1.0-1.8

1.8-2.6

2.6-3.4

3.4-4.2

4.2-5.0

NAVER business sites
1)
2)

√

Results of the global water resource sensitivity analysis presented by the World Resources Institution
Results of the global water resource sensitivity analysis presented by the World Wide Fund for Nature

Discussion of the integration of environmental considerations into strategic planningfor data center needs [TC-IM-130a.3]
Data Center “Gak Chuncheon”

Data Center GAK Chuncheon

Opened in June 2013, Data Center “GAK Chuncheon” was built by making many efforts and applying manytechnologies to reduce server heat in an eco-friendly way. As a result, it became the world’s first data center
to receive “Platinum” certification, which is the highest grade, at LEED1) New Construction (NC) 2009, aninternational environmentally-friendly building certification system. It uses Snow Melting2), photovoltaic and solar
thermal power generation3), and a natural cooling system using outside air. In particular, the Data Center GAK
Chuncheon South Wing was opened in 2017, after the opening of the North Wing in 2012 and West Wing in 2014,
and it adopted a wide array of nature-friendly technologies to significantly improve energy efficiency, aiming
to become the world’s top data center. Receiving recognition for these efforts, Data Center GAK Chuncheon
received the Minister’s Citation at the Climate Week 2016, won the Energy Champion Prize in 2017, and received
the ‘Grand Leader’s Award’ from the Climate Change Center in 2018. It also won a prize for creating social value
from the Korea Energy Agency in recognition of its use of innovative energy saving technology.
Data Center GAK Chuncheon has developed the Air Misting Unit (AMU) and the NAVER Air Membrane Unit
(NAMU) – eco-friendly technologies that can reduce server room temperatures using cold air and undergroundwater – and expanded the scope of their application to maximize energy savings. Thanks to these, it maintains a
power usage effectiveness (PUE)4) level that is closest to 1, the best performance among data centers in South
Korea. This is the top level even in comparison to the PUE of global data centers.

1

 EED: Leadership in Energy andL
Environmental Design, Environmentallyfriendly building certification developed by
the US Green Building2

 road heating system which uses wasteAheat in the wintertime3

 sed for outdoor lighting and greenhouseUheating

06

Data Center GAK Chuncheon uses photovoltaic energy and also invests in relevant businesses. It reduced 213
MWh of power consumption through photovoltaic power generation, leading to the reduction of some 95 tons of
GHG emissions. In addition, by using such technology as natural cooling systems that uses external air, 33,989
MWh of power was saved. It manages energy as efficiently as possible, including through LED lighting andEVs, and uses the air heated in the process of cooling computer servers to operate greenhouses. All plumbing
fixtures are water-saving, and uncontaminated water is purified and reused in bathroom fixtures where possible.
Rainwater is collected to be used as cooling water or for firefighting.

1.10
2021

Low

2020

[WRI]
Water Risk Atlas

Water resource sensitivity level
2019

Analysis organization

1.09

NAVER is well aware of the importance of the water resources that it uses in various ways for its business
operations, including data center cooling. We therefore review and use the analyses results of WRI1) and WWF2)
to manage the impact of water usage on sensitivity of local community water resources. Our business sites arelocated in Seongnam-si, Gyeonggi-do (Green Factory and 1784); Sejong Special Self-Governing City (Data Center
Gak Sejong); and Chuncheon, Gangwon-do (Data Center Gak Chuncheon and Connect One). Sensitivity of Water
Resource at all business sites has been identified as low. However, instead of being complacent, we are striving toconserve water resources by introducing various water recycling systems, such as water-saving sanitary devices
and heavy water treatment systems, at all its workplaces.

Data Center “Gak Sejong”

Power Usage
Effectiveness (PUE)

1.09

Sensitivity of Local Community Water Resource (as of the end of March 2022)“GAK Sejong” is NAVER’s Internet data center (IDC), representing our promise to deliver technological stability
and efficiency as well as nature conservation. We think thoroughly how to create our new space as a new
standard of healthy living and future industry for generations to come. Spanning a gross area of 293,697 m2
that can accommodate more than 100 thousand servers, Data Center GAK Sejong is slated for completionof construction in 2023. GAK Sejong is a large-scale IDC that is at least six times more extensive than GAK
Chuncheon, with an efficient management system using uses brainless robots in place.
Ever since the location selection, development of GAK Sejong was implemented in the direction of raisingenergy efficiency while coexisting with Nature. When choosing a location, we excluded sites with a history ofland damage, such as reclaimed land and landfill sites, and also avoided changing the land characteristic during
the selection period to develop a new industrial complex. We also purchased raw land and set the limit of thedevelopment to only essential range, in our earnest efforts toward minimizing forest damage and restoring
vegetation.
GAK Sejong is being built with the goal of achieving a higher PUE than that of GAK Chuncheon by applying
a hybrid cooling system. The hybrid cooling system that will be applied to GAK Sejong was developed to use
natural outdoor air as much as possible and therefore can improve cooling energy efficiency by as much as
20% in comparison to GAK Chuncheon. In addition, we plan to save data center cooling energy by improving
mechanical infrastructure facilities, including late-night electric power, freezer, and cooling tower, and by applying
new technologies. By optimizing cooling system arrangement, we will enhance electric power efficiency and also
strengthen stability of heating, ventilating, and air conditioning equipment.
GAK Sejong currently produces an annual 300 MWh renewable energy through a rooftop photovoltaic generation
system, and uses a geothermal system for its cooling and heating. Waste heat retrieved from the server room isused to supply warm water in the building and for floor heating of the wide indoor space of the operation building.
Also, we applied the Snow Melting system to an internal beltway, and used other such accumulated know-how
from GAK Chuncheon to design GAK Sejong in a way that leads to higher energy efficiency.
GAK Sejong also preserves ecological diversity of business sites whose importance has recently been on therise, and the ecological preservation archive at GAK Sejong is showcasing NAVER’s efforts to preserve ecologicaldiversity. Going forward, we will seek for ways to set construction ecological environment preservation measures
as a corporate-wide policy.

CASE STORY

Ecological diversity preservation activities of “GAK Sejong”
When choosing a site for “GAK Sejong” and designing it, NAVER placed one of its top priorities on ecological diversity. We accordingly strive tominimize the developed site and purchased raw land for an area that inevitably needed to be additionally developed, thereby mitigating ecologicaldestruction as much as possible. At the GAK Sejong construction site, in particular, we investigated the ecosystem prior to the construction andstrived to preserve the raw land ecosystem. To this end, we conducted a detailed ecology survey and recorded the ecological characteristics of thesurrounding area prior to architectural design, and in the construction stage, we are transplanting trees growing in places where require inevitable
logging, in our efforts to minimize our environmental impact.
NAVER SASB Report 2021

07

ACCOUNTING METRICSDATA PRIVACY,
ADVERTISINGSTANDARDS &FREEDOM OF
EXPRESSION
NAVER’s Principles on
Personal Information Protection
1.	NAVER complies with all laws
and international standards
related to personal information
protection.
2.	NAVER transparently discloses
processing of user’s personal
information at all times.
3.	NAVER respects user’s exerciseof the right of self-determination
regarding personal information.
4.	NAVER collects minimum datain accordance with the purpose
and responsibly manages
personal information.
5.	NAVER considers user privacy
protection with top priority.

Description of policies and practices relating to behavioral advertising and user
privacy [TC-IM-220a.1]

The status inspection includes inspection and improvement activities regarding the violation of the privacy of thedata subject which can be human rights risk. We have established the “Guidelines on Data Breach Response”
to improve our response procedures and existing personal data management system and respond to potential
personal data leakages more effectively.

Privacy Protection System
NAVER’s Chief Privacy Officer (CPO) concurrently serves as the Chief Information Security Officer (CISO),
managing data privacy protection risks throughout the company. To comply with all data and privacy protection
laws at home and abroad, we have established global privacy compliance regulations that meet global standards
and are expanding its application scope. Having focused on protecting users’ privacy with respect to ourpersonalization services and NAVER Pay services, which may be considered sensitive in terms of privacy, we
have acquired the SOC (Service Organization Controls) certification, an international accreditation of businesses’
service reliability and internal controls. Since acquiring SOC 2 and SOC 3 (Sys Trust) for the first time in South
Korea in 2013, NAVER has undergone rigorous audits every year and renewed the SOC certification in five areas– security, availability, process integrity, confidentiality, and privacy – in an effort to verify the safety of our services
and the reliability of service organizations.

Employee Education on Privacy Protection
NAVER runs education courses on various subjects so that its employees can choose and take necessary training,ranging from basic to in-depth courses, and enhance their awareness about personal information protection. In
2021, we conducted mandatory employee education on data protection for all employees of NAVER’s 25 major
subsidiaries, including full-time staff, contract workers, and expatriates. We divided the privacy protection educationby level (basic, introductory, practical) to allow our employees to choose from a wide range of courses according
to their job characteristics and personal interests. We had our privacy officers engage in the filming and production
processes to ensure that the training materials would be of practical help to our employees’ job performance.
In particular, we launched courses on global privacy protection in the first half of 2021 to further strengthen our
global privacy compliance capabilities. Good example includes the new course designed to help employees better
understand the Japan Act on the Protection of Personal Information in preparation for the entry of the “MySmartStore”
service into the Japanese e-commerce market.

NAVER is committed to the concept of “Privacy as a Service (PaaS)”, providing the protection of data and privacy
as a service, and always seeking for better ways to communicate with users with respect to NAVER’s privacy
protection. We became the first in South Korea to open the “Privacy Center”, in 2013 whereby we transparently
disclose our “personal information protection principles” that are applied to overall NAVER services as well as
each of our service operation policies. In addition, we publish the Transparency Report twice a year to regularly
and transparently disclose the statistics of personal information provided to investigative agencies in accordancewith relevant laws. We also publish the annual Personal Data Protection Report of our personal information
protection activities, and the “NAVER Privacy White Paper” detailing the results of the in-depth research we
conduct on the protection of user privacy, thereby providing various basic research materials on subjects that
require social discussions and agreements. In addition, we provide all the global personal information andprivacy-related laws and guidelines including those of the U.S. and Japan in the Global Support menu of thePrivacy Center. We also run an official blog and other social media platforms as well as the NAVER Privacy TV
where we hold discussions with users in the event of a personal information and privacy issue, thus expanding
communications with users.

1H 2021
Privacy protection training for
employees

By employment
type

Total

Privacy Protection System
NAVER
Privacy CenterTransparency
ReportPrivacy
ReportPrivacyWhitepaper

NAVER
Personal Information
Protection Blog

NAVER
Privacy TV

08

NAVER strictly applies the “privacy by design” principle for user’s personal information protection as a way ofprotecting the privacy and data of users throughout the entire lifecycle of our services, ranging from service
planning to service closing. As advance control procedures, we operate Privacy Impact Assessment (PIA), tocheck whether we are complying with relevant laws and internal regulations, identify the user privacy sensitivity,and manage risks as well as nPIMS for constant advice. PIA refers to the process of identifying compliance with
relevant laws and internal regulation as well as privacy sensitivity in advance, and managing related risks as a way
to make privacy protection the core of all services offered by NAVER.
As a follow-up control process, we conduct an annual assessment of the integrity of service privacy protection,
location-based services, mobile app privacy, and personal information partners (trusted companies processing
personal information on behalf of NAVER) as part of our effort to minimize data protection risks. In particular, we
inspect the handlers of outsourced personal data using 40 criteria we have set up in accordance with the Personal
Information Protection Act, each of which classified into high/medium/low levels depending on the severity ofrisks; each low level is considered a violation and assigned a penalty point in accordance with a preset penalty
table. Inspection results are reviewed and confirmed by NAVER’s CPO, and improvement measures are advised inaccordance with the performance level of the handlers. Those whose personal data protection level is evaluatedto be low or who have continuously failed to implement improvement measures are urged to maintain or improve
the level of their personal data protection with the treat of a contract termination or other appropriate sanctions.

2H 2021

No. of participantsCompletion rate

No. of participantsCompletion rate

Full-time

3,866

98.3%

2,065

99.7%

Executives

117

100%

122

100%

Part-time

21

100%

19

100%

Expatriates

23

100%

1

100%

Interns

69

94.2%

1

100%

4,096

98.3%

2,208

99.7%​

Privacy Enhancement Reward for Users

Information on
NAVER’s
Customized Ads

As a way to strengthen the protection of user personal information and privacy, NAVER established “Privacy
Enhancement Reward (PER)” system in 2016 for the first time in South Korea. PER is a concept that is very similar
to “Bug Bounty” which receives reports on technological security-related vulnerabilities and provides rewards.
PER is however different as it consists of reporting legal/institutional violations in relation to service operation;suggesting service operation and functionality improvements; and recommending required services. Any user
can directly present opinions on NAVER services, and a prescribed reward is provided according to the respective
opinion’s suitability, practicality, and level of contribution. In 2021, we held the “PER Gold Medal Challenge”
event in July, a month of data protection, encouraging more users to participate in PER. We received a total of
41 opinions during the year, of which 23 opinions were rewarded with NAVER Pay points worth a total of KRW
1,695,000.

In addition, we conduct a separate “inspection of the status of compliance with measures to ensure the safety of
uniquely identifiable information” including the regular “inspection of personal information protection status of HR
department and finance department” and other departments that process unique identification information suchas resident registration numbers.

NAVER SASB Report 2021

09

ACCOUNTING METRICS

Maximizing the User’s Right to Self-Control Personal Information
As one of its data protection principles, NAVER respects users’ exercise of their right to personal information selfdetermination as specified in the Constitution, making diverse efforts to guarantee this right. Since 2013, for the
first time in South Korea, we have started providing the history of “collection and use of personal information”
and of “information provision to a third party”, both of which occur when using NAVER services, with the consent
of the person through the “Status of Personal Information Usage” page tailored to users’ particular behavior. In
July 2020, we began to additionally disclose the date of the consent the user granted to collection and provisionof personal information to a third party, and also reorganized the personal information usage status page so thatusers can easily withdraw their consent to the collection and provision of personal information to a third party
within all services of NAVER, providing users with a one-stop process to exercise their right to control theirpersonal information.
Regarding customized advertising that uses behavior information, we disclose operational principles on collecting,retaining, and destroying information as well as users’ exercise of the right to control and damage relief methods
through the “Information on NAVER’s Customized Ads page”. With top priority being placed at the user privacy
protection, we strive to offer useful adverting to users and effective advertising platform to advertisers. Across theglobe, demand for user privacy-related rights is growing as a result of the enactment of privacy protection laws bycountries, including the EU GDPR and US CCPA. Against this backdrop, we will continue our preemptive efforts
to protect users’ right to control their own information to the global level.

Children’s Online Privacy Protection
Children are on of NAVER’s valued customers. They are familiar with the online environment and demonstrate ahigh level of adaptability as service users. Nevertheless, their awareness of the importance of privacy or personal
information is relatively low compared to adults, as is their cognitive ability to figure out the risks associated withnew technologies and services. Special attention is therefore required for service design and usage guidancefor children. Since 2009, NAVER has provided education through the “Children’s Privacy Protection Class” forJunior NAVER members. In 2015, we published the “10 Rules Students Should Know to Protect Their Social
Media Privacy”. In addition, we are striving to strengthen children’s right to protect their personal data by offeringa children’s version of the “Consent to Collection and Use of Personal Information” when they sign up for NAVER
membership. Also, the “personal information usage details notification mail” for users aged less than 14 is written
in a way that they can easily understand its content. In 2020, NAVER published a privacy white paper with thetheme of “protecting children’s online privacy” in an effort to figure out a differentiated approach to privacy andpersonal data protection for children.
To bolster children's rights to personal information protection, we have launched the “NAVER Privacy TV for Children”
channel within the Junior NAVER service and produced educational videos on personal information protection forchildren. In July 2021, “Information Protection Month,” we organized campaigns and events under the theme of “SNSrules to be followed to protect children’s personal information” for both children and adults. In addition, our band app“Band for Kids” and Band Web have acquired PRIVO’s COPPA (Children Online Privacy Protection Act) Safe Harbor
certification, verifying the global level of our children's personal information protection system.

Total amount of monetary losses as a result of legal proceedings associated with user
privacy [TC-IM-220a.3]
NAVER has only one personal information leakage incident, which was the erroneous sending of AdPost receipt
mail in 2019. In the process of providing receipts needed for year-end tax adjustment to users via email, datathat was more than necessary was included in the receipt file. On June 5, 2020, the Korea Communications
Commission imposed upon us an administrative fine of KRW 13 million and a penalty surcharge of KRW
28.2 million for having violated the Act on the Promotion of Information and Communications Networks andInformation Protection, along with a corrective action order.
To prevent such and other similar accidents from happening again, we have since inspected the entire outbounddata transfer systems of ours, stopping all personal data outbound transfers, and have installed a new work
process in which users are required to log in to access their personal information, which has prevented
infringements during data transmissions or the transmission of excess data due to a transmission error. We
are strengthening the education of developers and personal data handlers on the causes of accidents while
enhancing our employees’ security awareness to ensure that the same mistake will not be repeated.
On May 26, 2021, NAVER was requested by the Personal Information Protection Commission to take corrective
action about the non-compliance with its obligations under the Personal Information Protection Act. Although
there was no leakage of users’ personal information, the Commission requested the corrective action as a resultof its investigation into our personal information handling and managing status as well as our compliance with theAct. Judging that the merchants of NAVER Smart Store Center were “personal information handlers” of NAVER”
the Commission ruled that we had violated Article 29 of the Personal Information Protection Act as the personal
information handlers could access the merchant system from the outside just with their IDs and passwords
without having to go through any additional authentication process, and it imposed upon us an administrative fineof KRW 8.4 million.
In response, we have strengthened our privacy protection guidance and education tailored to business operators
in a bid to raise their awareness of personal information protection. In 2021, we sent a privacy protection guidance
email to all businesses in our platforms with the themes of “Basic Rules for the Protection of Our Customers’
Personal Information” and “Case Studies about How to Prevent Personal Information Leakage/Exposure
Accidents”. In addition, our Chief Privacy Officer (CPO) gave an online data protection lecture under the theme of“privacy issues A to Z that small businesses need to know” to small business owners using Smart Store.
Classification

Total amount of monetary losses as aresult of legal proceedings associatedwith user privacy

KRW 10,000

2018

2019

2020

2021

-

-

4,020

840

Number of users whose information is used for secondary purposes [TC-IM-220a.2]
There are no cases where NAVER used or provided personal information outside the scope of the purpose forwhich it initially received consent.
Classification

Number of users whose information isused for secondary purposes

10

Cases

2018

2019

2020

2021

0

0

0

0

NAVER SASB Report 2021

11

ACCOUNTING METRICSDATA SECURITY(1) Number of law enforcement requests for user information, (2) number of users
whose information was requested, (3) percentage resulting in disclosure[TC-IM-220a.4]
NAVER is reporting the means and frequency through which user information is provided by disclosing statistics
related to user information requested by the government and judicial authorities over a specific period through theTransparency Report. NAVER became the first company in South Korea to disclose statistics on user information
provision requests made by investigative agencies through the NAVER Personal Data Protection Report inJanuary 2015, and has been disclosing its Transparency Report biannually to protect and guarantee user rights.
The terms “requested” and “processing” used in the statistics of the Transparency Report refer to the numberof documents that we have received requests from investigative agencies and processed accordingly. In
addition, “provided” information refers to the number of units of user data actually provided. A request to provide
information on several users can be made through one document.
NAVER ceased providing communications materials in compliance with a court ruling rendered in October 2012
in relation to confirmation of whether a business operator has a substantial examination obligation regarding
the provision of communications materials and concerns over non-compliance with the warrant-requirement
principle. We have therefore not complied with any requests for communications materials since October 2012.
Transparency Report Statistics
Classification

Unit

Requested
Seizure warrant

Processing

Cases

ProvidedHandling rate%

Requested
Communications
restriction measure

Processing

Cases

ProvidedHandling rate%

Requested
Communications fact Processing
confirmation material Provided
Handling rate

Cases
%

Requested
Communications
material

Processing

Cases

ProvidedHandling rate%

NAVER has only one personal information leakage incident, which was the erroneous sending of AdPost
receipt mail on April 29 and 30, 2019. In the process of providing users with the receipts needed for year-end tax
adjustment via email, data that was more than necessary was included in the receipt file.
2,331 users were affected by the incident, while the number of receipts sent amounted to 1,940,768. On June 5,
2020, NAVER was requested by the Korea Communications Commission to take corrective action as a businessthat had not complied with the Act on the Promotion of Information and Communications Network Utilization andInformation Protection, Etc.
To prevent such and other similar accidents from happening again, we have since inspected the entire outbounddata transfer systems of ours, stopping all personal data outbound transfers, and have installed a new work
process in which users are required to log in to access their personal information, which has prevented
infringements during data transmissions or the transmission of excess data due to a transmission error. We
are strengthening the education of developers and personal data handlers on the causes of accidents while
enhancing our employees’ security awareness to ensure that the same mistake will not be repeated. In addition,
we have improved the “Guidelines on Data Breach Response” based on our experience in responding to thewrong delivery of AdPost receipt emails, while overhauling the internal system to ensure regulatory reporting anduser notification as part of follow-up measures to be taken upon detecting any personal information leakages.

2018

2019

2020

2021

8,145

7,712

7,248

7,307

6,710

6,109

5,269

5,269

6,966,563

318,380

1,304,804

4,036,190

82

79

73

72

17

18

6

5

17

18

6

5

71

82

76

94

100

100

100

100

4,255

4,266

2,506

2,094

3,629

3,701

2,083

1,821

Data Protection System

12,798

8,139

4,793

3,997

85

87

83

87

311

119

49

33

0

0

0

0

0

0

0

0

NAVER has in place data protection regulation systems that fit our unique environment and culture, while also
having unified the data protection management systems of NAVER and its subsidiaries by categorizing the system
into the four areas of general, service by stage, global advancement, and security/infrastructure. We acquire
information protection certifications with credibility at home and abroad to verify the stability of our services andthe reliability of our operating systems. Our guiding principle is 24/7 security reinforced by internal vulnerability
diagnosis, error management, mock hacking and so forth.

0

0

0

0

* In terms of seizure warrants, in case of the provision of a log record, not user identification information, each log was tallied as one case.
* In case of the request for the provision of registered user’s personal information, and if there is no other information than membershipwithdrawal date, the case was tallied as zero.

List of countries where core products or services are subject to government-required
monitoring, blocking, content filtering, or censoring [TC-IM-220a.5]
NAVER operates its business in 13 countries across the globe and is providing services in these countries. We
observe each country’s policy management criteria for posting content.

12(1) Number of data breaches, (2) percentage involving personally identifiable
information (PII), (3) number of users affected [TC-IM-230a.1]

Classification

Number of data breaches
Percentage involving personallyidentifiable information (PII)

Unit

2018

2019

2020

2021

Cases

0

1

0

0

%

0

100

0

0

* PII is calculated by tallying the percentage of users whose PII was exposed against users who was affected by the personal information
leakage incident

Description of approach to identifying and addressing data security risks, including
use of third-party cybersecurity standards [TC-IM-230a.2]

NAVER manages information security risks at the BOD level to ensure that information security risks aremonitored and controls at the highest governance level. On matters that have a company-wide impact, the Risk
Management Committee under the BOD receives a detail report from, and subsequently advises, the CPO/CISO
who then carries out the advice and reports to the BOD the results of steps taken.
Furthermore, NAVER manages company-wide data information risks through the Privacy Protection Committee
chaired by the CEO and staffed by key executives; and has since 2007 been conducting privacy research throughthe NAVER Personal Information Protection Committee, composed of leaders from academic and legal circles in
the field of personal information protection, in a bid to effectively respond to users’ increasing demand for privacy
resulting from business expansions.

NAVER SASB Report 2021

13

ACCOUNTING METRICS

Data Protection Certification
ISO/IEC 27001, 27017, 27018, 27701

ISMS-P

Security Improvements
NAVER maintains international standard certifications
granted by the ISO (International Organization forStandardization) and the IEC (International Electro-technicalInternational certification
Commission) for the information protection managementfor data protection
system governing its personalized services such as mailmanagement systemand cloud, as well as company-wide services such as cafes,
blogs and NAVER Pay.
The ISMS-P certification is granted by KISA (Korea
Internet & Security Agency) to certify that an organization’s
Certification for data measures and activities meet its certification standards forprotection and personal (personal) information protection. NAVER has been certified
information protection as appropriate in recognition of the measures and activities
management system it has implemented to secure the stability of information andcommunications networks and protect personal information.

Classification

Unit

2018

2019

2020

2021

No. of areas of improvement for security
that were discovered

Cases

1,128

1,344

1,158

1,062

Number of completed mitigation measures

Cases

1,126

1,282

1,022

973

%

99.82

95.38

88.25

91.62

Mitigation within the given deadline

Cases

728

744

694

650

Mitigation after the given deadline

Cases

370

513

293

270

Mitigation with no specific deadline

Cases

28

25

35

53

Unit

2018

2019

2020

2021

Cases

208

533

314

291

Percentage of mitigation

Bug Bounty Statistics
Classification

No. of reported bugs
ISMS

SOC

NAVER has been certified by the Ministry of Science, ICT
and Future Planning for its continuous implementation of
appropriate information protection activities in the operation
Certification for dataof NAVER Data Center “Gak” according to the Act on theprotection management
Promotion of Information and Communications Network
systemUtilization and information Protection.

The SOC certification verifies the stability of services andinternal controls in accordance with the international
standards established by the International Auditing andCertification for reliability
Assurance Standards Board (IAASB). In 2013, NAVER
in providing andbecame the first company in Korea to acquire the SOC 2
operating services
and SOC 3

No. of persons who made a report
RewardPersons

31

129

154

166

KRW 10,000

4,425

11,9008,089

11,553

Named Common Vulnerabilities and Exposures (CVE)Classification

Unit

2018

2019

2020

2021

No. of cases of named CVE

Cases

4

2

3

3

Efficient, Transparent Management Of Security Threat Factors
In managing service security, NAVER strives to apply the “Security by Design” and and “Usable Security”
principles to all our service areas. We have a security review process for service planning and designing, and asecurity check process that is implemented upon completion of development, and a DevSecOps support systemthat we have developed based on open-source software (OSS), a source repository for smooth collaboration,
which minimizes developer interventions in outputs that are being developed while enabling an automatic code
security review.
Even the most effective planning, design, and development cannot ensure 100% prevention of security bugs.
We have therefore developed and operated our own security bug bounty (https://bugbounty.NAVER.com/ko/)program that can identify and deal with security bugs that we are not aware of before an accident occurs, with thehelp of an external analyst. The program is evaluated as the most outstanding case among companies in South
Korea. In 2021, 162 people participated in NAVER Bug Bounty, and 291 cases were reported, leading to a total of
KRW 110 million in rewards.
In 2018, NAVER was registered as a CVE Numbering Authority (CNA) with the authority to issue vulnerabilities
of its software under the international standard management number – Common Vulnerabilities and Exposures(CVE). NAVER has since established itself as a transparent company that can systematically manage andquickly respond to security vulnerabilities. We have issued a total of 13 CVE numbers since participating in CNA,
including three issued in 2021.

14

NAVER SASB Report 2021

15

ACCOUNTING METRICSEMPLOYEERECRUITMENT,INCLUSION &PERFORMANCE

Percentage of employees that are foreign nationals [TC-IM-330a.1]

Employee engagement as a percentage [TC-IM-330a.2]

NAVER is running various programs for employees with foreign nationality to network and adapt to theorganization. Good examples include “Global Lunch”, during which foreign employees meet to have lunch andnetworking opportunities, and we also encourage them to share information, know-how, and experiences at work
and in South Korea through the NAVER Works chat room.

Unit

2018

2019

2020

2021

New ZealandPersons

1

2

2

2

TaiwanPersons

0

0

1

1

Germany

Persons

1

1

1

0

U.S.

Persons

6

6

8

10

SwedenPersons

1

1

1

2

Switzerland

Persons

1

1

1

1

Argentina

Persons

1

1

1

1

Azerbaijan

Persons

1

1

0

0

U.K.

Persons

2

1

1

1

Austria

Persons

1

1

1

1

India

Persons

3

0

0

0

Japan

Persons

1

2

3

2

China

Persons

4

4

4

6

Kazakhstan

Persons

1

1

1

1

CanadaPersons

6

3

2

4

Kyrgyzstan

Persons200Persons

0

1

1

1

2

0

0

0

Turkmenistan

Persons

1

0

0

0

FrancePersons

0

1

2

2

0

1

67%

The analysis result of NAVER’s organizational culture profile based on these results shows that about half (47%)
of the respondents belong to an effective group. It is a comparable level to that of global IT companies as well
as more positive than that of domestic companies2). Going forward, we will make continuous efforts to create aworkplace where our employees can work happily while being proud of NAVER’s services and user experience.

Percentage of gender and racial/ethnic group representation for (1) management, (2)technical staff, and (3) all other employees [TC-IM-330a.3]
As of the end of 2021, NAVER’s male-to-female ratio is 63:373) with female leaders accounting for approximately
27% of overall leader positions as the result of a gradual increase over the years. Also, women account for 16% of
the C-level senior management, including the director for CIC (Company-in-Company), an independent in-houseorganization. NAVER does not impose glass ceiling limitations and any other gender disadvantages. We also
encourage employees to use maternity and parental leave to ensure that the opportunities for female talents are
not restrained due to pregnancy and childbirth. In addition, other than wage differential by job group, there is nowage differential by gender in NAVER.
Employment
ClassificationBygender

Unit

Persons
Persons

Female
Total
Office0	Positive response rate: Percentage of
employees who answered 5 (strongly
agree) or 4 (agree) on a 5-point scale

Male
FemaleBy job1

Total
Technical

Male
Female2

Percentage of female employees

3

Percentage of female managers
Female(leader position)
talentPercentage of female executive(C-level)	Based on the diagnosis results of some
26,000 people working for 10 global
software and platform companies and20,000 people working for 60 domestic
companies

16

68%“Execution environment”

Male

Persons1“Voluntary engagement”

0

Republic of Tajikistan

Persons

68%

Total number of employees

ThailandAustralia

Organizational culture

In 2021, NAVER conducted an internal organizational culture diagnosis in cooperation with an external
professional organization to create a healthier organizational culture. 72% (2,938 people) of all employees
participated in the diagnosis, with 68% of them showing a positive perception of the overall organizational
culture. Notably, more than half of the total responses was positive in the areas of “voluntary engagement” and“establishment of an execution environment” – two key factors of organizational culture.

Number of Employees by Nationality
Country

Positive response rate1)

Items

NAVER strives to create a flexible organizational culture unique to NAVER, where people from diverse
backgrounds, including gender and nationality, come together. NAVER is taking the lead in creating anenvironment where people can work according to their capabilities and contribute to society based on mutual
respect.

Based on full-time employees

Persons
Persons
Persons
Persons

%

2018

2019

2020

2021

3,611

3,523

4,103

4,696

2,309

2,262

2,639

2,967

1,302

1,261

1,464

1,729

1,573

1,540

1,717

1,949

629

628

697

750

944

912

1,020

1,199

2,038

1,983

2,386

2,747

1,680

1,634

1,942

2,217

358

349

444

530

36.1

35.8

35.7

36.8

23.3

24.6

24.6

26.9

-

-

30.0

16.0

NAVER SASB Report 2021

17

ACCOUNTING METRICSINTELLECTUAL
PROPERTY
PROTECTION &COMPETITIVEBEHAVIOR

Activity Metrics

Total amount of monetary losses as a result of legal proceedings associated with
anti-competitive behavior regulations [TC-IM-520a.1]
In January 2021, NAVER paid an administrative fine for abusing its market-dominant position according to Article
3-2 of the Monopoly Regulation and Fair Trade Act and for non-compliance with the prohibition of unfair tradepractices according to Article 23 of the Act. The Korea Fair Trade Commission requested corrective action of
NAVER’s alleged manipulation of the search algorithm to expose its shopping and video services first. However,this was a part of our efforts to improve our shopping search algorithm based on the principles of diversity so that
we could maintain diversity in search results by preventing the overconcentration toward specific companies,
aimed at providing more opportunities for small business owners to expose their products. The main reason
why users visit the NAVER Shopping site is the convenience of comparing and purchasing products sold at
multiple malls at once. In 2013, NAVER introduced a logic banning the consecutive exposure of more than three
products from the same shopping mall in order to secure the diversity of search results, as a way to put an end
to the dominance of search results for a limited number of open market products and to give more opportunities
to distinctive SOHO mall products of SMEs. In September 2013, we limited the number of exposures on SmartStore to eight, but as it was considered too unfavorable to the merchants of Smart Store, the number was later
increased to ten.

ENTITY-DEFINEDMEASURE OF
USER ACTIVITY

Entity-defined measure of user activity [TC-IM-100.A0]
NAVER is a leading Internet search portal in South Korea. We support the creation of content, introduce
AI technology, and thus continue to improve our search quality. We have been strengthening our businesscapabilities by expanding our commerce platform and upgrading fintech services, while spreading the joy andpleasure of connection made possible through these efforts to numerous NAVER users. Going forward, we
will evolve into a technology platform where time that our partners spend in NAVER platforms will lead to theremarkable growth of all NAVER partners.
Classification

User Activity

NAVER App

Persons

Daily Active User: 34 million

NAVER Webtoon

Persons

Monthly Active Users: 170 million

ZepetoPersons

Monthly Active Users: 20 million*As of December 2021

The Korea Fair Trade Commission imposed a fine of KRW 27.9 billion (KRW 26.6 billion for shopping, KRW 1billion for real estate, KRW 300 million for video) on us. However, as the execution for the video segment has beensuspended, we have excluded the amount from the table below.
Classification

Monetary losses as a result oflegal proceedings associated with
anti-competitive behavior regulations

18

KRW million

2018

2019

2020

2021

0

0

0

27,667

NAVER SASB Report 2021

19