A legal basis has been established to utilize personal data in the development of artificial intelligence (AI) when high-quality training data cannot be obtained through pseudonymous or anonymous information. However, the use of personal data for AI development is not universally permitted; it requires approval from the Personal Information Commission (PIC) based on public and social necessity and enhanced safety measures.
On August 20, the PIC announced that a bill amending the 'Personal Information Protection Act' to allow exceptions for the use of personal data in AI technology development has passed the National Assembly. The PIC explained that the amendment was made in response to demands for swift and extensive access to high-quality training data to enhance the competitiveness of the AI industry.
Under current law, using personal data collected legally for purposes other than those originally intended requires separate consent from the data subject or a legal basis. Consequently, utilizing collected personal data for AI development has led to issues with data quality, as it had to be used in pseudonymous or anonymous forms.
While the PIC has previously allowed data usage for certain innovative services, such as AI for preventing voice phishing and developing autonomous robots, these exceptions were temporary, lasting from two to four years. Additionally, it became clear that relying solely on individual laws for industrial promotion was insufficient to ensure adequate safety measures for personal data protection.
The amendment introduces a new exception for AI development, allowing the use of legally collected personal data if it is difficult to develop AI solely with pseudonymous or anonymous information, if there is recognized public or social necessity, and if enhanced safety measures are in place, subject to PIC review and approval.
Safety measures to prevent personal data breaches have also been strengthened. When processing sensitive or unique identification information, companies must assess risks in advance and develop improvement plans. Organizations utilizing these exceptions are required to disclose key information through their privacy policies. The PIC will also publish the status of AI exception operations on its website.
The amendment will take effect six months after being promulgated following approval at the Cabinet meeting. Before implementation, the PIC plans to gather expert and field opinions to establish operational guidelines and subordinate regulations for the AI exceptions.
Song Kyung-hee, chairperson of the PIC, stated, “This amendment is significant in that it rationally expands opportunities for the use of personal data in an era where the level of AI development translates into national competitiveness, while also establishing a corresponding management and oversight system in collaboration with businesses.”
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.