1.

Use of Personal Information Beyond the Original Purpose for AI Development

A data controller may use personal information for AI development, which had already been lawfully collected for another purpose, if all of the following requirements are satisfied (Article 28-12(1) of the Amendment Bill). Whether these requirements are met is subject to the review and approval by the PIPC, which may impose conditions as necessary to ensure the protection of data subjects' rights and secure processing of personal information (Article 28-12(2) of the Amendment Bill):
 

• If, in light of the nature of the personal information being processed (e.g., video, audio, images, symbols, or text) and its relevance to AI development, it is difficult to develop AI if the personal information is processed in anonymized or pseudonymized form;

• If the personal information is processed in an environment with technical, administrative, and physical safeguards in place for secure processing, or if additional safeguards appropriate to specific circumstances (such as a cloud environment) are implemented in accordance with the standards to be further detailed in the Enforcement Decree of the PIPA; and

• If the purpose of AI development includes one of the following, and there is a minimal risk of unfairly infringing upon the interests of the data subject or a third party:

"AI development" as used above includes performance improvement. If personal information is used in accordance with the provisions to be introduced by the Amendment Bill, certain regulations in the PIPA will not apply, including restrictions on the use and transfer beyond the original purpose, notification of the source of collection, restrictions on the processing of sensitive information, unique identification information, and resident registration numbers, restrictions on the installation and operation of visual data processing devices, and regulations on overseas delegation of personal information processing (Article 28-15 of the Amendment Bill). However, a data controller must disclose, in its privacy policy, the purpose of use and items of personal information being used (Article 28-12(5) of the Amendment Bill).
 

2.

Risk Assessment and Ex Post Management and Supervision

If the criteria to be further detailed in the Enforcement Decree of the PIPA are met, taking into account factors such as whether sensitive information or unique identification information is processed and the impact on the rights and interests of data subjects, the PIPC must, prior to its review and approval, require the data controller to conduct a risk assessment and submit the results (Article 28-12(3) of the Amendment Bill). In addition, a summary of the risk assessment results must be disclosed together with the outcome of the PIPC's review and approval (Article 28-12(6) of the Amendment Bill).

Further, the PIPC must periodically oversee and monitor whether the matters that it approved are properly implemented (Article 28-13(1) of the Amendment Bill) and may request the submission of relevant materials from the data controller to the extent necessary for such oversight and supervision (Article 28-13(2) of the Amendment Bill).