In September last year, the Personal Information Protection Act (“PIPA”) was amended to introduce a new provision governing mobile visual data processing devices, such as autonomous vehicles, drones, and bodycams (please refer to our previous newsletter dated September 20, 2023 for details, Link). Article 25-2 of the PIPA outlines the specific situations in which mobile visual data processing devices can be used to record videos of identifiable individuals (data subjects) in public spaces for business purposes (the “Personal Visual Information”), and provides guidelines on how to notify data subjects of such recording.

Following the publication of the “Guide on Amendments to the PIPA and its Enforcement Decree” on December 29, 2023, which outlines the criteria for determining whether the conditions for exceptional use are met and the permissible scope of Personal Visual Information usage, among other topics, the Personal Information Protection Commission published the “Guide on the Protection and Use of Personal Visual Information for Mobile Visual Data Processing Devices” (the “Guide”) on October 14, 2024, to address regulatory uncertainties surrounding Article 25-2 of the PIPA and to facilitate the development of advanced technologies, such as AI.

This Guide sets forth the compliance requirements when a person or entity operating a mobile visual data processing device for business purposes (the “Device Operator”) processes Personal Visual Information at each stage of processing. It also recommends that these requirements be taken into account when planning, designing, and/or manufacturing products or services related the operation of such devices or the processing of Personal Visual Information, as well as when using such devices for personal purposes.

The key items included in the Guide for Device Operators to follow at each stage of processing are outlined below.
 

• Device Operators must first confirm the existence of a legal basis for recording, as specified in each subparagraph of Article 25-2 (1) of the PIPA, and clearly define the purpose of processing Personal Visual Information to ensure that only the minimum amount of Personal Visual Information for that purpose is recorded.

• In particular, subparagraph 2 of Article 25-2 (1) of the PIPA requires that the recording of Personal Visual Information should (i) not unfairly infringe on the rights of data subjects, and (ii) stay within a reasonable scope. The Guide offers criteria for determining whether these conditions are met as follows:

• Article 25-2 (3) of the PIPA and Article 27-2 of the Enforcement Decree of the PIPA require Device Operators to clearly notify data subjects about the fact that recording is in progress by means of lights, sounds, signboards, written statements, announcements, or other similar means and methods. In this regard, the Guide outlines the recommended standards for providing notification when recordings are made through autonomous vehicles, service robots, drones, and bodycams.

• When notifying that the recording is in progress, Device Operators must use more than one method (i.e., multi-channel notifications), considering the characteristics of the mobile visual data processing device and the available methods given the specific recording circumstances, among others. Once the recording has been clearly notified to data subjects, no further actions, such as verifying that the data subjects are fully aware of the recording, are required.

• Subparagraph 2 of Article 25-2 (1) of the PIPA stipulates that Device Operators may not proceed with recording in public spaces for business purposes if data subjects express their refusal to be recorded. This provision does not intend to create a new “right to refuse recording” of data subjects, but instead implements an opt-out mechanism, where recording is allowed by default. Should a data subject communicate his/her objection, the Device Operator is legally obligated to respect and cease the recording of such individual.

• Personal Visual Information recorded under Article 25-2 of the PIPA must be used and provided in accordance with Articles 15, 17, and 18 of the same law. When such information is transferred overseas, Article 28-8 of the PIPA must be complied with.

• When an autonomous vehicle or robot records video for the purpose of safe navigation, and a traffic accident occurs, the use and provision of that footage to determine the cause of the accident or for insurance purposes would be deemed reasonably related to the original purpose of collection, and likely foreseeable from the data subject’s perspective. Therefore, there is room for such additional use and provision under Articles 15 (3) and 17 (4) of the PIPA. However, utilizing footage recorded during test operations for autonomous vehicle technology research, such as AI training, without pseudonymization or anonymization, would not likely be considered foreseeable to the data subject.

• If Device Operators wish to use the raw video footage for purposes such as AI research and development without the consent of the data subjects, they must do so through a “regulatory sandbox for implementation (regulatory sandbox).”
   

• Device Operators must appoint a Visual Information Protection Officer (who may also serve as the Chief Privacy Officer) and establish and implement an operation and management system for Personal Visual Information.

• Device Operators must take steps to protect Personal Visual Information by implementing technical, administrative, and physical security measures, ensuring proper training and oversight of personal information handlers, and establishing clear procedures for data subjects to exercise their rights, among others necessary safeguards.

• Device Operators must establish a policy for the operation and management of mobile visual data processing devices (which can be integrated into their privacy policy) and are encouraged to make this policy available on their websites.

• Device Operators must set an appropriate retention period for Personal Visual Information and, once this retention period has elapsed, must either destroy or separately store such information.
   

The Guide explains that recordings via mobile visual data processing devices with an opt-out mechanism are allowed as a more practical and feasible regulatory approach, despite concerns about potential privacy violations arising from the use of such devices, provided that the rights of data subjects are protected both before and after the recordings take place.
 
That said, for those currently operating or planning to operate mobile visual data processing devices, it is recommended not only to secure a legal basis for recording in line with the Guide but to adequately safeguard the rights of data subjects before (e.g., clearly notifying data subjects of the recording) and after the recording (e.g., establishing procedures for access, review, and deletion of Personal Visual Information) by taking relevant measures.

[Korean Version]