PIPC Unveils AI Privacy Risk Management Model... "Minimizing Uncertainty"

The government has presented a management framework that can systematically manage personal information risks when developing or providing artificial intelligence (AI) models or systems.

On the 19th, the Personal Information Protection Commission announced the release of the "AI Privacy Risk Management Model for Safe AI and Data Utilization (Risk Management Model)."

Since December last year, the Personal Information Protection Commission has been preparing the Risk Management Model. The model provides guidance by comprehensively covering AI data processing characteristics, types of privacy risks, risk mitigation measures and management systems, and corporate case studies. Reflecting voices that there is a lack of reference materials on privacy risks for frontline workers, the commission has taken steps to establish a model for autonomous management.

The Risk Management Model identifies specific types and cases of AI and pinpoints concrete risks. It performs qualitative and quantitative risk assessments such as likelihood of occurrence, severity, priority, and acceptability. Subsequently, it supports systematic management by preparing safety measures appropriate to the risks.

The commission stated that for early detection and mitigation of risks, it is recommended that AI models and systems be planned and developed from the perspective of privacy protection by design, and that periodic reviews be conducted in response to environmental changes such as system advancement.

The model also presents examples of AI risk types in the context of privacy. It focuses on newly emerging risks such as infringements of data subject rights and violations of personal information protection laws due to the unique characteristics, functions, and data requirements of AI technology identified through domestic and international literature reviews and corporate interviews.

Specifically, risks occurring during the AI lifecycle are categorized and disclosed according to the planning and development stages of AI models and systems, and the service provision stage. The service provision stage is further specified by distinguishing between generative AI and discriminative AI.

Administrative and technical safety measures to reduce the risk of personal information infringement are also provided.

Administrative safety measures include managing the source and history of training data, establishing permissible usage policies, testing and addressing types of personal information infringement through AI privacy red teams, and preparing reporting methods. Additionally, it is recommended to conduct personal information impact assessments when training data is likely to contain sensitive information or large-scale personal data.

Technical safety measures include preprocessing AI training data, adding safety devices through fine-tuning AI models, and applying input/output filtering. The commission has conducted policy research to analyze the effectiveness of privacy risk mitigation technologies for Korean language models, striving to establish policies based on scientific evidence.

Furthermore, the Risk Management Model proposes a management system. It emphasizes the leading role of the Chief Privacy Officer (CPO), the formation of a dedicated organization capable of conducting risk assessments, and the establishment of policies that ensure systematic risk management.

Accordingly, the Personal Information Protection Commission plans to continuously update the Risk Management Model considering future AI technology developments, amendments to personal information-related laws, and global trends. Detailed guidance materials specialized for specific targets and areas such as small organizations, startups, and AI development types will also be concretized soon.

In addition, through innovation support systems such as prior appropriateness review, regulatory sandbox, and personal information safe zones, the commission intends to communicate frequently with AI companies to monitor technological development trends and corporate difficulties. Based on accumulated cases and experiences, efforts will also be made to revise the Personal Information Protection Act.

Ko Hak-su, Chairperson of the Personal Information Protection Commission, said, "The AI domain, where personal and non-personal information are comprehensively utilized and technological development continues, involves high uncertainty. Therefore, rather than uniform regulation, it is necessary to minimize risks comprehensively through rational and proportional management." He added, "I hope the Risk Management Model will help AI companies and others understand and systematically manage privacy risks."

This content was produced with the assistance of AI translation services.