Building Privacy Protection Safeguards in AI Development... Strengthening Qualification Requirements for Responsible Personnel

With the advancement of artificial intelligence (AI), the rights of data subjects are being specified in the process of 'automated decision-making' carried out without human intervention. Automated decision-making refers to decisions made by processing personal information through fully automated systems such as AI.

On the 6th, the Personal Information Protection Commission announced that the "Enforcement Decree of the Personal Information Protection Act," which includes these provisions, was approved at the Cabinet meeting, and some regulations regarding rights related to AI and other automated decisions will be enforced starting from the 15th of this month.

As a result of this approval, even in areas where decisions are made by processing personal information through fully automated systems without human intervention, standards and procedures must be transparently disclosed. Additionally, if requested by the data subject, explanations must be provided on the standards and procedures used to process personal information and make decisions, or whether and how submitted opinions were reflected, along with notification of the results.

The Personal Information Protection Commission expects that this will establish social safeguards and create a virtuous cycle that allows innovative AI services based on personal information to spread.

Furthermore, to enable Chief Privacy Officers (CPOs) to perform personal information protection duties based on expertise and independence, qualification requirements have been strengthened, and a CPO council has been established to facilitate mutual cooperation. To enhance expertise, personal information processors meeting certain criteria must have at least four years of combined experience in personal information protection, information security, or information technology. For independence, new compliance requirements have been introduced, including establishing a reporting system to regularly report to representatives or the board of directors, guaranteeing access to information related to personal information processing, and providing human and material resources.

In addition, legal grounds for "personal information protection level evaluation" have been newly established to assess the level of personal information protection in public institutions, allowing for the disclosure of results and recommendations for improvement. Also, based on evaluation results, provisions for awarding outstanding institutions and affiliated employees have been prepared.

As the responsibility for compensating damages to data subjects has been changed to apply to all personal information processors, the criteria for revenue, personal information holdings, and exemption obligations have been revised to alleviate the burden on small business owners and ensure accountability. Previously, online businesses with "annual sales of 50 million KRW or more" and "1,000 or more users" were subject, but the criteria have been adjusted to personal information processors with "annual sales of 1 billion KRW or more" and "10,000 or more data subjects."

The Personal Information Protection Commission plans to release a draft guide containing detailed standards and examples focusing on newly established or amended items within this month and to reflect field opinions through briefings and other means.

Ko Hak-su, Chairperson of the Personal Information Protection Commission, stated, "The amendments, including automated decision-making using AI technology and strengthening the expertise and independence of CPOs, are very important as social safeguards in the safe utilization of personal information. We will focus on field promotion and guidance activities to ensure the revised system functions properly and establish it as a system that benefits both the public as data subjects and companies through active communication with the public sector."

This content was produced with the assistance of AI translation services.