Discussions are intensifying around the need to revise the personal data regulatory framework due to the rise of artificial intelligence (AI). As generative and agentic AI increasingly combine and infer data, facilitating the movement of personal information across various services, experts argue that the current regulations, which focus primarily on prior consent and purpose limitation, are inadequate.
There are calls to clarify the grounds for processing personal data beyond 'consent' and to refine the criteria for 'third-party sharing.' Additionally, experts suggest that regulations should be more nuanced based on the type of information, processing methods, and responsible parties.
At a forum titled 'Discussing the Future of Personal Data Regulation' held on September 14 at the National Assembly Library in Yeouido, Seoul, participants addressed how to improve the consent-based personal data processing system and how to refine protection and accountability frameworks in line with expanded data utilization.
Bong Seong-hyun, a lawyer at Kim & Chang, pointed out the limitations of the consent-based system, stating, "In reality, users rarely check each term or detail of personal data processing to decide whether to consent." He suggested that the criteria for applying other grounds for processing personal data, such as contract fulfillment and legitimate interests, should be clarified, and that the current requirement for legitimate interests to 'clearly' outweigh the rights of data subjects needs revision.
The 'AI special provision,' which allows for the use of personal data under certain conditions for AI development, is seen as a potential shift from a consent-centric regulation to one that assesses actual risks.
Bae Kwan-pyo, a professor at Chungnam National University, stated, "The nature of regulation will shift from being preventive to being responsive, with responsibilities changing based on risk." However, he cautioned that startups lacking data may find it difficult to benefit from these provisions, warning that only data-rich companies might gain from the system.
The issue of third-party sharing of personal data has also emerged as a significant topic. Under current law, sharing personal data held by one business with another requires separate consent from the data subject. However, concerns have been raised that the frequent movement of personal data in agentic AI could make the current consent model restrictive.
Lee Hee-jin, a lawyer at Meta, suggested that if separate consent is required at every stage, it could not only inconvenience users but also disadvantage South Korean companies in system implementation. She proposed that third-party sharing be addressed under the same legal grounds as other personal data processing.
As data utilization expands, there is a consensus that protection and accountability structures need to be more robust. Park So-young, a legislative researcher at the National Assembly Legislative Research Service, emphasized the need to refine the regulatory framework based on the type of information, processing methods, and responsible parties.
Current laws require the purpose, items, and retention period for collecting personal data to be predetermined. However, AI can infer new personal data by combining conversations, documents, and images, allowing multiple businesses to participate in a single service. This raises concerns that the existing framework centered on data processors may not adequately cover processing processes and responsibilities.
Park stated, "It is crucial to work on refining the regulatory framework based on the type of information, processing methods, and responsible parties, rather than simply loosening or tightening regulations uniformly."
The need for enhanced protective measures was also highlighted. Kim Bo-ra-mi, a lawyer at the law firm Dike, argued that personal data protection should be viewed as a social value that limits the power of the government and corporations. Kim Chang-o, Chief Privacy Officer at KT, called for a protective framework that considers AI risks, suggesting a connection between personal data impact assessments and AI risk evaluations.
These discussions are expected to lead to reforms by the Personal Information Commission. Choi Yoon-jung, a policy officer at the commission, stated, "We will prepare and announce innovative and improved measures suitable for the AI era by the end of the year." The commission is also working on an enforcement decree for the AI special provision, aiming for implementation by March next year.
Choi Kyung-jin, a professor at Gachon University, emphasized the need to distinguish between areas that can be addressed under existing regulations and those that require reform, stating, "In the AI era, both sophisticated interpretation and careful regulatory design are necessary."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.