[IT Litigation] In the Age of Artificial Intelligence (AI), Data Protection Laws for Companies to Know

The advancement of artificial intelligence (AI) technology has brought innovation across industries, but it has also increased the risk of personal information infringement. In August 2023, the Personal Information Protection Committee announced the ‘Policy Direction for Safe Use of Personal Information in the Age of Artificial Intelligence,’ emphasizing the importance of personal information protection in the process of artificial intelligence (AI) processing vast amounts of data.

Data used by artificial intelligence (AI) models often contains sensitive personal information, which increases the possibility of personal information abuse. For example, artificial intelligence (AI) can be used to impersonate individuals or for phishing, and deepfake technology has emerged as a social problem.

To solve these problems, providers of artificial intelligence (AI) services must comply with the Personal Information Protection Act. If artificial intelligence (AI) collects and uses data without the consent of the data subject in the process of learning personal information, a violation of the law may occur, so companies must strictly comply with relevant regulations to avoid legal liability.

Artificial intelligence(AI) and Personal Information Protection Act

One of the most important legal considerations when developing artificial intelligence (AI) services is compliance with the Personal Information Protection Act. The Personal Information Protection Act provides clear criteria for collecting, processing, and using personal information, and failure to comply with these criteria may result in legal liability. Companies providing artificial intelligence (AI) services must thoroughly review whether the services they provide comply with the Personal Information Protection Act.

Compliance requirements for Personal Information Protection Act and Artificial Intelligence (AI) services

The current Personal Information Protection Act restricts companies from processing personal information unless they obtain consent from the data subject or only use personal information in exceptional cases prescribed by law. In particular, companies providing artificial intelligence (AI) services must comply with the following items.

- Prohibition of use of personal information for purposes other than the specified purpose

If an artificial intelligence (AI) service collects personal information for a specific purpose, it must not be used for other purposes outside of that purpose. For example, if an artificial intelligence (AI) chatbot analyzes conversations with users to provide customized advertising, it must obtain consent for this purpose in advance, and it must not be used for other purposes outside of the consent.

- Compliance with standards for use of pseudonymized information

The Personal Information Protection Act allows the use of pseudonymized personal information (personal information that has been pseudonymized) without the consent of the data subject only for specific purposes such as statistical compilation and scientific research. However, simply pseudonymizing personal information does not mean that it can be used without consent. Further use outside of that purpose can still cause legal problems.

- Ensuring transparency of personal information collection and use

Companies providing artificial intelligence (AI) services must establish clear guidelines for how they collect and use personal information. They must also provide sufficient explanation to service users regarding how artificial intelligence (AI) processes personal information and establish a procedure for obtaining consent.

- Reliability of artificial intelligence (AI) outputs and establishment of personal information protection measures

Adequate review and filtering procedures must be introduced to ensure that outputs generated by artificial intelligence (AI) do not infringe on personal information. For example, technical and administrative measures must be implemented to prevent an artificial intelligence (AI) chatbot from automatically learning specific personal information and exposing it externally.

Necessity of personal information protection check before developing artificial intelligence (AI)

Companies planning to provide artificial intelligence (AI) services must thoroughly consider the Personal Information Protection Act from the initial development stage. A thorough review is needed to determine what data is handled by artificial intelligence (AI) technology and whether it can be collected and used within the scope of compliance with the Personal Information Protection Act. During this process, it is important for companies to seek advice from experts in personal information protection law. In particular, if there is a possibility that the data used by the company contains sensitive personal information, a clear policy must be established for how to handle it.

There are several ways to prevent personal information from being infringed upon in the process of processing data through an artificial intelligence (AI) model. For example, anonymization, encryption, or processing data according to a specific purpose. Companies can protect personal information and provide legally safe services through these methods.

In addition, as artificial intelligence technology advances, personal information protection laws are also constantly being updated. Companies developing artificial intelligence (AI) services must continuously monitor and educate themselves on the latest laws to minimize legal risks. As artificial intelligence is applied to a wider range of fields, legal requirements related to personal information protection are becoming increasingly complex, so it is important to establish a system that can reflect this quickly.

Artificial intelligence (AI) technology is already being used in various ways in our daily lives, and this will continue to expand in the future. However, as artificial intelligence (AI) technology advances, the issue of personal information protection is becoming increasingly important. Providers of artificial intelligence (AI) services must strictly comply with the Personal Information Protection Act and establish technical and legal measures to prevent personal information infringement.

Law firm Veat provides professional legal advice to IT and artificial intelligence (AI) related companies so that they can comply with the Personal Information Protection Act and operate artificial intelligence (AI) services effectively. If you are a company that wants to reduce the risk of violating the Personal Information Protection Act in relation to artificial intelligence (AI) development and operate a stable service, we recommend you receive the best legal advice from Law firm Veat.

Thank you.

From Law firm Veat