Following its passage by the Legislation and Judiciary Committee on July 29, 2026, the bill amending the Personal Information Protection Act ("Amendment") was passed at the plenary session of the National Assembly on August 20, 2026. The Amendment introduces special provisions allowing the use of personal information for AI development or performance improvement. The key provisions of the Amendment are summarized below.
|
1.
|
Special Provisions on Using Personal Information Beyond Its Original Collection Purpose for AI Development
The Amendment permits a data controller to use personal information that had been lawfully collected for a purpose other than the original collection purpose if necessary for AI technology development, including performance improvement, provided that certain requirements are satisfied (Article 28-12(1) of the Amendment).
The special provisions apply only if all of the following three requirements are satisfied:
|
|
(1)
|
In light of the type of information being processed, such as video, audio, images, symbols, and text, and its relevance to AI technology development, such development would be difficult if the information were anonymized or pseudonymized;
|
|
(2)
|
Safeguards to be prescribed in the Enforcement Decree of the Personal Information Protection Act are in place, including processing the information in an environment equipped with technical, administrative, and physical measures to ensure the secure processing of personal information or implementing additional safeguards appropriate to the particular circumstances, such as processing in a cloud environment; and
|
|
(3)
|
The purpose of developing the AI technology is to advance the public interest, protect the interests of the data subject or a third party, or advance broader social interests, and there is a significantly low risk of unjustly infringing on the interests of the data subject or a third party.
|
|
|
If all of these requirements are satisfied and the Personal Information Protection Commission ("PIPC") conducted its review and issued its approval, the data controller may use the lawfully collected personal information for AI development. The PIPC may impose conditions to the extent necessary to guarantee the rights of data subjects and ensure the secure processing of personal information (Article 28-12(2) of the Amendment).
If the content, methods, or form of the AI technology or service are substantially identical or similar to those that have previously undergone review and approval, the Amendment also permits the review and approval procedure to be simplified (Article 28-12(4)).
If personal information is used under these special provisions, the application of a total of 10 provisions under the Personal Information Protection Act will be exempted. These include the restrictions on using or providing personal information beyond the original purpose (Articles 18 and 19), notification of the source from which personal information was collected (Articles 20 and 20-2), restrictions on processing sensitive information and unique identification information (Articles 23 through 25 and Article 25-2), and restrictions on the delegation of personal information processing overseas (Article 28-8) (Article 28-15 of the Amendment).
However, the data controller must still disclose, in its privacy policy, the specific purposes for which the personal information is used and the items of personal information collected and used (Article 28-12(5)).
|
|
2.
|
Risk Assessment and Follow-Up Management and Supervision
If the relevant information falls within the criteria to be prescribed in the Enforcement Decree of the Personal Information Protection Act, taking into account factors such as whether sensitive information or unique identification information is processed, the impact on the rights or interests of data subjects, and the degree of risk, the data controller must conduct a risk assessment before the PIPC’s review and approval for purposes of applying the special provisions. The PIPC must receive the results of the risk assessment and disclose a summary of those results (Articles 28-12(3) and (6) of the Amendment).
The PIPC must also periodically manage and supervise whether the matters subject to its review and approval have been implemented. For this purpose, the PIPC may request the relevant data controller to submit materials to the extent necessary (Article 28-13).
In addition, if the special provisions were applied through false or fraudulent means or the requirements for applying the special provisions were not satisfied, the PIPC may, following its review and approval, restrict all personal information processing by the relevant data controller (Article 28-14).
|
The Amendment is scheduled to take effect six months after the date of its promulgation. Companies pursuing the development of AI technologies or services should monitor the specific safeguard standards and the types of processing subject to risk assessment that will be prescribed in the upcoming amendment to the Enforcement Decree of the Personal Information Protection Act and consider how they can make use of these special provisions.
[Korean Version]
