South Korea’s Guidance For the Safe Use of Personal Information in AI

The Personal Information Protection Commission (PIPC) of South Korea released its guidance for the safe use personal information in AI environments on August 3, 2023.

The “Policy Direction for Safe Use of Personal Information in the Age of Artificial Intelligence” establishes personal information processing principles by AI, aiming to enable digital innovation while maintaining individuals’ privacy rights.

Interpreting and applying the Personal Information Protection Act (PIPA)

The guidance includes rules explaining how to interpret and apply the Personal Information Protection Act (PIPA) for organizations developing and using AI technologies.

The PIPC explained that generative AI models such as ChatGPT and the increasing uses of AI across many areas of daily life, including in medical care, education and finance, mean that data is processed for purposes other than those it was collected for.

Covering each stage of AI development, the new guide establishes principles for personal information processing including:

• Planning — following privacy-by-design principles in modelling, learning and operational processes
• Data collection — complying with PIPA when collecting and processing all types of protected data
• AI learning — ensuring that pseudonymization does not allow re-identification and using synthetic data where possible
• AI service — guaranteeing individuals’ data rights and providing transparency of data collection and use.

The future role of the PIPC

The PIPC was the among the first authorities globally to fine a company for their AI practices. They claimed that the company used data for purposes other than those it was collected when developing their AI chatbot, Lee-Luda.

In response, the PIPC Policy Direction, further explained the future role of the PIPC in overseeing personal data use in AI. As well as adopting a principle-led approach to governance, the PIPC will establish an “AI Privacy Team” to communicate and work with business, supporting interpretation of laws and regulations and consulting with organizations developing AI products and services.

An adequacy review system will also be introduced that will analyze business environments, on request, to ensure they comply with PIPA rules.

With AI rapidly becoming routine in modern life, South Korea’s proactive stance toward AI innovation while protecting privacy is a model that’s likely to be enacted by other jurisdictions in the not-so-distant future.