2024.07.17. The Fair Economy — Government-level standards have been established for the safe processing of 'publicly available data on the internet' used in developing generative artificial intelligence (AI) models.
The Personal Information Protection Commission (PIPC) announced on the 17th that it has prepared and published the 'Guidelines for Processing Publicly Available Personal Information for AI Development and Services' to ensure that public data essential for AI development can be processed lawfully and safely within the current personal information regulatory framework.
Public data refers to data that anyone can legally access on the internet and serves as a core ingredient for training data used to develop generative AI such as ChatGPT. AI companies collect public data from common crawl, Wikipedia, blogs, websites, and other sources through methods like web scraping and use it as AI training data.
Common Crawl is a public repository (http://commoncrawl.org) that automatically collects data from the internet and stores, maintains, and manages it so that anyone can access and analyze it. Web scraping is a technique for automatically extracting needed data from websites.
Such public data may contain various personal information (publicly available personal information) such as addresses, unique identification numbers, and credit card numbers, raising significant concerns about privacy infringement. However, the current Personal Information Protection Act lacks clear standards applicable to the processing of such publicly available personal information.
For example, in situations where public data is processed on a large scale for AI training, it is practically difficult to apply provisions such as individual consent from data subjects or contract conclusion under the current Act. Furthermore, because AI training differs from traditional personal information processing methods, there were limitations in applying regulations such as security measures under the Act as they are.
Accordingly, the PIPC stated that it has prepared guidelines to clarify the legal standards for collecting and using publicly available personal information and to provide minimum standards that companies can refer to regarding what safety measures are appropriate at the AI development and service stages. The aim is to minimize personal information infringement issues for companies using publicly available personal information while resolving legal uncertainty to support corporate innovation and growth.
Since announcing the 'Policy Direction for Safe Personal Information Utilization in the AI Era' in August last year, the PIPC has been discussing the guidelines through the 'AI Privacy Public-Private Policy Council' while also engaging in extensive opinion gathering with academia, industry, and civic groups.
The policy council is composed of 30 next-generation experts in the AI field from academia, the legal profession, industry, and civic groups. It operates three subcommittees: data processing standards, risk assessment, and ensuring transparency.
In particular, considering that major overseas countries such as the European Union (EU) and the United States, which seek a balance between AI innovation and safety, have recently been forming personal information protection regulatory frameworks for AI and data processing in general, including public data processing, the PIPC focused on establishing internationally interoperable standards.
First, it clarified that publicly available personal information can be utilized for AI training and service development under the 'legitimate interest' provision of Article 15 of the Act.
Additionally, for this 'legitimate interest' provision to apply, three requirements must be met: the legitimacy of the AI development purpose, the necessity of processing public personal information, and a concrete balancing of interests. The PIPC also explained the content and application examples of these three requirements in the guide.
Thus, establishing a reasonable interpretation standard for the 'legitimate interest' provision enhances interoperability with global standards such as the European Union's General Data Protection Regulation (EU GDPR) and recent AI safety norm discussions.
Furthermore, the PIPC specifically outlined technical and managerial safety measures and data subject rights protection measures that AI companies can consider when processing public personal information based on 'legitimate interest'.
However, considering rapid AI technological changes, the guide allows for flexible adoption and implementation of detailed safety measures. AI companies are not required to mandatorily implement all safety measures; they can autonomously select and implement an 'optimal combination of safety measures' tailored to their characteristics, taking into account the benefits of various measures, potential drawbacks such as AI performance degradation and bias, and the maturity of the technology.
In March, the PIPC provided actual safety measure implementation cases of major large language model (LLM) operators identified through a preliminary AI status inspection, enabling companies to refer to them when determining their 'optimal combination'.
Finally, the guidelines emphasized the roles of AI companies and Chief Privacy Officers (CPOs) in processing training data for AI development.
It recommended that companies autonomously establish and operate a provisional 'AI privacy management organization' centered on the CPO, assess compliance with the guide's standards, and document and retain the evidence. It also advised periodic monitoring of risk factors such as significant technical changes that could improve AI performance or concerns about personal information breaches, and preparing swift remedies for infringement incidents such as personal information leakage.
The guide will be continuously updated in consideration of future revisions to personal information-related laws, trends in AI technological development, and overseas regulatory developments.
In addition, the legal basis and standards for the lawful processing of user personal information, which along with publicly available personal information constitutes a major source of AI training data, will be further specified through opinion gathering from academia, industry, and civic groups.
Furthermore, the PIPC plans to communicate frequently with AI companies through innovation support systems such as the preliminary adequacy review system, regulatory sandbox, and personal information safe zones, while monitoring technological developments and market conditions. Based on accumulated cases and experiences, it will also work to revise the Act to fit the AI era.
Kim Byeong-pil, a professor at KAIST Business and Technology Management who participated in discussions on these guidelines (head of the data processing standards subcommittee of the Public-Private Policy Council), emphasized, "These guidelines are part of an effort to find an appropriate balance between faithfully protecting personal information and encouraging AI innovation. I believe they will serve as a good reference for the development and use of trustworthy AI. However, given the rapid pace of AI technology change, I hope people keep in mind that the contents of these guidelines will also need to continuously evolve."
Bae Gyeong-hun, co-chair of the Public-Private Policy Council and head of LG AI Research, said, "The publication of these guidelines is an important step forward and a first step toward achieving both AI technology advancement and personal data protection. By providing standards for safely processing personal information in public data, legal uncertainty in AI technology development has been reduced, allowing for safe data use. This will serve as a foundation for the public to enjoy the benefits of AI technology in a trustworthy data processing environment."
Ko Hak-su, chair of the PIPC, said, "AI technology is advancing rapidly, but whether public data training, a key element of AI development, is lawful and safe under the Act has been a gap. Through these guidelines, I hope companies will establish AI and data processing practices that the public trusts, and that best practices accumulated in this way will be continuously reflected in the guidelines."
0 Comments
No comments yet.