Korea privacy watchdog, industry group discuss AI threat response

The Personal Information Protection Commission said Monday it co-hosted a privacy policy forum with the Korea Chief Privacy Officers Council in Seoul, where the two sides discussed how a shift toward prevention-based oversight and rising AI-driven breach threats should reshape corporate security investment.

The 2026 Privacy Policy Forum, held under the theme of building a privacy protection system grounded in trust and responsibility, drew about 450 people, including privacy officers from companies and public institutions as well as academics, to the Grand Hall of EL Tower in Yangjae, southern Seoul.

In his opening remarks, Yang Cheong-sam, secretary general of the commission, said the watchdog is stepping up policy efforts so that the public can enjoy the benefits of AI development without concern and companies can pursue innovative growth without legal risk. "As trust becomes the asset itself in the era of AI transformation, we will take the lead in building a safe AI ecosystem by establishing effective protection principles, including risk-based discipline and a prevention-oriented protection system," he said.

Yum Heung-yeol, the council's chairman, said AI-based cyberattacks have become routine and that institutions and companies need to rebuild their systems for securing personal data using AI. He called on organizations to move preemptively on prevention-centered protection and to expand investment, and stressed that privacy officers must be guaranteed standing within their organizations.

In the first session, Ko Nak-jun, the commission's prevention and coordination review officer, set out the direction of the wider overhaul of the privacy framework, including a preemptive inspection system, more effective sanctions and remedies, and a data-use system built on trust. Lim Jong-cheol, who heads the commission's public sector inspection team, described tighter preemptive checks on public institutions' personal data systems and new prevention-centered indicators for assessing their protection levels. Kang Dae-hyeon, head of the commission's investigation division, explained planned changes to the penalty system, including punitive fines of up to 10 percent of total revenue for serious and repeated violations, alongside mandatory reductions for companies that have invested in prevention.

The second session turned to industry. Lee Chang-bok, chief privacy officer at Viva Republica, shared the company's approach to responsible management and autonomous security under the revised law. Kim Yu-seok, head of the information protection division at the Korea Social Security Information Service, presented a strategy for institution-wide risk management by public bodies, and Park Chan-am, chief executive of Stealien, proposed autonomous security agents to defend against automated AI attacks. Kim Jae-gi, a director at S2W, argued for shifting from checklist-based security reviews to continuous monitoring from the attacker's perspective.

A panel discussion chaired by lawyer Kim Jin-hwan followed, with participants including Soongsil University professor Choi Dae-sun, LG Uplus security center head Hong Gwan-hee, J&Security chief executive Kim Kyung-ha, lawyer Jeon Seung-jae and Hwang Ji-eun, head of the commission's autonomous protection policy division. They discussed how to make the investment-reduction incentives work in practice, ways to share information on breach threats, and the direction of security technology and services.

The commission said it will use the opinions and policy suggestions from the forum to build a flexible management system proportionate to risk levels as AI spreads, and to make the preventive framework work in practice at industrial sites.