On July 17, 2024, the Personal Information Protection Commission (PIPC) announced the publication of the Guide to the Processing of Disclosed Personal Information for Artificial Intelligence (AI) Development and Services to resolve uncertainty regarding the use of public data for AI development. The guide focuses on the safe and legal use of public data within the current regulatory system.

What is public data?

The PIPC states that public data is data that can be accessed by anyone on the internet and is used to develop generative AI. The PIPC also states that AI companies collect public data from various sources, including web scraping, blogs, and websites. The PIPC further explains that public data may include personal data so there is a greater concern for the potential violation of citizens' privacy. The PIPC mentions that the Personal Information Protection Act (PIPA) does not currently have clear standards that can be applied to the processing of this category of personal information.

What is the purpose of the guide?

The guide clarifies the legal standards for collecting and using personal information and presents the minimum standards for companies to refer to regarding appropriate safety measures for implementation during the stages of AI development. The PIPC states that the goal is to minimize personal information infringement issues for companies utilizing disclosed personal information while also resolving legal uncertainty. The PIPC also provides guidance on technical and managerial security measures and measures to protect the rights of data subjects for AI companies to consider when processing personal information based on the legitimate interest standard under the PIPA.

The PIPC highlighted that AI companies are not required to implement all safety measures mentioned in the guide and should consider factors including AI performance degradation and bias and technological maturity. Therefore, the PIPC recommends that AI companies select and implement the best combination of safety measures that suits their needs.

The PIPC states that the guide will be continuously updated in consideration of developments in personal information laws and trends in overseas regulatory development.

You can read the press release, only available in Korean, here.