[IT Litigation] Is the application of the legitimate interest provision possible when AI learning uses publicly disclosed personal information?

Recently, the pace of artificial intelligence (AI) development has accelerated, leading to an increase in instances where personal information is processed during the development and provision of AI models and services. In particular, large-scale data containing publicly exposed personal information is often included in the learning process of AI models, which may lead to potential legal issues. Therefore, AI development companies and service providers need to identify and manage legal issues related to personal information processing in advance.

Meaning and Examples of Publicly Exposed Personal Information
Publicly exposed personal information refers to data that is legally accessible by anyone on the internet, such as Common Crawl, Wikipedia, blogs, and websites. AI companies utilize these publicly available data by employing methods such as web scraping to acquire data needed for AI model training.

Constitutional self-determination of personal information means the right of an individual to decide the processing and methods concerning their personal information. Even if personal information already exists on a public platform, in principle, unauthorized collection or use by a third party is not permitted. For example, accessing a specific website without proper access privileges to collect personal information for AI learning may violate the Act on Promotion of Information and Communication Network Utilization and Information Protection and the Personal Information Protection Act.

The ‘Legitimate Interest Clause’ and its Requirements under the Personal Information Protection Act

The “Guidance on Processing Publicly Exposed Personal Information for AI Development & Service” published by the Personal Information Protection Committee in July 2024 stipulates that the collection, storage, and processing of personal information during the AI learning process are considered ‘processing’ under the Personal Information Protection Act. Therefore, AI developers and service providers must strictly comply with the processing requirements stipulated by the Personal Information Protection Act. In particular, to legally process publicly exposed personal information for AI model development and service operation, compliance with Article 15(1)(6) of the Personal Information Protection Act, the ‘Legitimate Interest Clause’ must be followed. According to this clause, personal information may only be collected and used without consent when the legitimate interest of the personal information processor clearly overrides the rights of the data subject.
The ‘Legitimate Interest Clause’ of Article 15(1)(6) of the Personal Information Protection Act requires that the following three conditions are all met.

First, the legitimate interest pursued by the personal information processor must be recognized.
Second, the processing of personal information must be necessary to achieve that legitimate interest, and must have a substantial relevance and rationality. . That is, learning data that matches the purpose and use for AI model development and service operation should be collected, and excessive processing of personal information, such as excluding information beyond a reasonable scope, should be avoided.
Third, the legitimate interest of the personal information processor must clearly override the rights of the data subject. . When determining this, various factors must be comprehensively considered, including whether the data subject is a public figure, the public and public interest of the personal information, the scope of the original disclosure, the appropriateness and necessity of the purpose, procedure, and form of utilization of personal information processing, and the nature and content of the benefits that could be infringed by personal information processing (refer to Supreme Court Ruling 2016. 8. 17, 2013da235080).

Practical Response Measures for AI Companies
As mentioned above, AI developers and service providers should carefully review and apply the three requirements of Article 15(1)(6) of the Personal Information Protection Act, the Legitimate Interest Clause, to minimize legal risks in advance and to prepare evidence that can be used in the event of future legal disputes or risk occurrence.
Furthermore, the reliability of the personal information source must be thoroughly verified, technical protection measures must be implemented to prevent leakage or exposure of personal information, and security must be strengthened internally and externally through measures such as encryption and access restrictions for stored personal information.

Innovation in artificial intelligence and personal information protection are not contradictory concepts but can develop together by complementing each other. Securing social trust and transparency regarding personal information protection is important for the sustainable development of AI technology. Therefore, AI development companies and service providers should rigorously manage potential legal risks arising from personal information processing while continuing to achieve technological innovation.

Law firm Veat provides professional legal advice and consulting services to AI development and service providing companies to effectively manage potential legal risks arising from personal information processing. In particular, we provide legal advice related to IT, AI, and personal information, focusing on IT and personal information protection committee consultants, and in the event of legal issues such as personal information infringement disputes, personal information leakage, or IT litigation, we provide systematic legal support based on abundant experience and expertise to help minimize the legal risks of companies. Please feel free to contact Law firm Veat for any questions or consultations.

Thank you.
Law firm Veat