Personal Information Protection Commission says AI data bill clears Assembly

The Personal Information Protection Commission said that the National Assembly passed a bill permitting limited use of legally collected personal data for artificial-intelligence development, subject to stronger safeguards and the commission's review.

The commission said there had been persistent calls for rapid, broad access to high-quality training data to strengthen the artificial-intelligence industry's competitiveness. The amendment creates a separate legal basis when artificial-intelligence development cannot rely solely on pseudonymized or anonymized information and public or social necessity is recognized. Previously, data collected through consent or a contract required separate consent or another legal basis before being used for a different purpose.

"The provision is meaningful in an era when the level of artificial-intelligence development directly translates into national competitiveness, as it reasonably expands opportunities to use personal information while building corresponding management and oversight systems with companies and institutions," Song Gyeong-hui, chairperson of the commission, said.

Some services, including artificial-intelligence voice-phishing prevention and autonomous-driving robots, had been permitted to use video or voice data containing personal information through a regulatory sandbox. Those exemptions were temporary, lasting two years initially and up to four years.

Companies and institutions using the provision must conduct advance risk assessments and draw up mitigation measures when handling sensitive or unique identification data poses a high risk to individuals' rights or interests. They must disclose key details in privacy policies, while the commission must publish the operating status of the exception on its website.

The commission said it will simplify review procedures for artificial-intelligence technologies or services that are substantially identical or similar to exceptions it has already approved. The bill will take effect six months after it receives State Council approval and is published. Before then, the commission plans to gather expert and field views and prepare an operating plan and subordinate regulations.