AI learning data utilization, Personal Information Protection Committee's new regulatory easing policy

Recently, the Personal Information Protection Committee (hereinafter referred to as "Personal Information Protection Committee") announced its 2025 major policy promotion plan, revealing regulatory innovation plans for AI development and data utilization. The announcement included various contents aimed at balancing the need to ease data regulations due to the rapid growth of emerging technologies such as generative AI and strengthening privacy protection.

In particular, it established special regulations conditionally allowing the use of original data for research and development, expanded the basis for personal information processing based on legitimate interests and public interest, and concretized safe data processing standards, among other policies, demonstrating its commitment to actively supporting the AI industry, which is highly dependent on data.

Regulations on AI development and data utilization vary by country, but there is a growing trend worldwide to maximize the value and usability of data. For example, the European Union (EU) actively encourages data utilization within the scope of complying with the GDPR regulations and supports AI technology development through new legislation such as the AI Act. The United States applies relatively flexible regulations regarding the construction and utilization of datasets for AI research, and federal-level support is underway to promote AI innovation. The Personal Information Protection Committee's recent easing of regulations, in line with this global trend, is expected to significantly contribute to enhancing the competitiveness of the domestic AI industry.

The necessity of using original data

Using original data provides several benefits that can activate AI development. First, original data has better integrity and consistency than pseudonymized data, enabling more accurate AI model learning. This improves data quality, and researchers can utilize the necessary data without restrictions, also reducing the time and cost associated with data preparation. Furthermore, learning using original data prevents information distortion that can occur during the pseudonymization process, ultimately contributing to the reliability of AI.

This easing of regulations aims to maintain a balance between the AI industry and personal information protection. By allowing the use of original data in cases where research objectives cannot be achieved with only pseudonymized data, it is expected that advanced AI technologies will become possible. For example, in the medical AI field, there has been a problem where important information is lost due to the pseudonymization of data, making highly precise analysis difficult. Allowing the use of original data in such situations will enable the development of more accurate and reliable AI models.

Increasing AI learning efficiency by using original data

In AI technology development, high-quality learning data is a key resource that determines the performance of AI models, and using original data can reduce the possibility of data distortion and minimize errors in the learning process, significantly improving the predictive accuracy of the model. With the easing of personal information protection regulations, the use of original data has become possible, which is expected to increase the efficiency of research and development and particularly improve performance in advanced AI fields such as Natural Language Processing (NLP) or image recognition by utilizing the rich contextual information of the data. This change is expected to accelerate the development of AI solutions that can be used in the market by reducing waste of time and resources.

Examples of learning data utilization by industry

* Healthcare: Electronic medical records (EMR) and medical image data of patients are important resources for AI model learning. Using original data can increase the precision of disease diagnosis models and contribute to the development of new treatments.

​* Finance: Sensitive information such as transaction data is used to prevent financial fraud and develop customized financial services. Using original data can significantly improve the accuracy of risk modeling and personalized financial product recommendations.

​* Education: Original data is also used to analyze students' learning patterns and develop personalized education solutions. This can contribute to reducing educational disparities and increasing learning efficiency.

Safety measures and legal considerations for learning data utilization

The most important aspect of data utilization is maintaining personal information protection and transparency. When using original data, consent from the data owner, as well as the purpose, method, storage period, and compliance with international data transfer regulations, must be clearly disclosed, and the Personal Information Protection Committee's review and approval process is expected to play a key role in enhancing reliability.

Data used for AI learning involves various legal issues, such as ownership, scope of utilization, disposal procedures, and differences in domestic and international regulations. In particular, it is important to clearly define the ownership of the research results in the data provision contract as issues may arise between the institution that provided the original data and the AI model developer and user of the AI model.

Also, failure to comply with the Personal Information Protection Act's proper disposal procedures after data utilization ends can lead to legal problems, so data disposal criteria and procedures must be established and reflected in the contract. When data utilization involves cooperation between global companies, data management and usage plans should be designed to consider differences in domestic and international regulations such as GDPR and CCPA, and an international data management system should be established.

Law firm Veat’s role in learning data utilization

First, drafting data collection and utilization consent forms. The data collection process must comply with domestic and international regulations such as the Personal Information Protection Act, the Information and Communications Network Act, and GDPR, and to that end, the purpose of data collection, procedures for the information subject or personal information provider, such as the right to consent and request deletion, the scope and period of data utilization, and compliance with international data transfer regulations must be clearly reviewed.

Second, establishing safe data processing standards. Companies must comply with protective measures such as encryption, access control, and de-identification when processing learning data, and must establish an internal system including the status of ISMS certification, access control and record management, and re-identification prevention measures.

Third, legal risk analysis of data management. Since the ability to use original data increases the possibility of disputes due to personal information infringement or data misuse, companies can minimize their prior risks by preparing documents for the Personal Information Protection Committee’s review and approval, reviewing the legality of data utilization projects, and preparing a manual for responding to personal information infringement incidents.

Law firm Veat supports companies and organizations to maintain a balance between personal information protection and AI research and development and to minimize legal risks. In line with the Personal Information Protection Committee’s easing of regulations, we aim to contribute to the innovation and global competitiveness of the domestic AI technology by providing clear legal criteria for data collection and utilization, establishing a safe data processing system, and analyzing the legal risks of companies.

This case study can also be found on the Law firm Veat blog below.

- AI learning data utilization, new regulatory easing policy by the Personal Information Protection Committee

Thank you.
Law firm Veat