Type

Concept

Planning/Development Stage

• Defining the purpose of the AI service, determining the necessary data, and conducting AI model training through collection and processing of training data

Service Provision Stage

Generative AI

• A system that generates text, image, audio, video, etc., by using the users’ input and context

• Examples: ChatGPT, image generative AI

Discriminative AI

• A system that classifies users’ input into specific classes or makes predictions by scoring users’ input

• Examples: Recruiting AI, credit rating AI, Fraud Detection System (“FDS”), targeted advertisement/recommendation, medical assistant AI, autonomous vehicle sensor

Type

Major Privacy Risks

Planning/Development Stage

• Unlawful collection and use of training data

• Improper storage and management of AI training data

• Greater complexity in the data flow and guaranteeing data subjects’ rights due to diversification of AI value chain

Service Provision Stage

Generative AI

• Memorization of training data and leakage/exposure of personal information

• Infringement of data subjects’ rights due to malicious AI-generated content

Discriminative AI

• Weakened data subjects’ rights due to automated decisions

• Public surveillance and potential inference of sensitive information

Type

Details

Management of Source/History of Training Data

• Reviewing the legality of the collection and use of personal information for each source of training data

• Disclosing the standards for collection, processing, and use of training data in privacy policies, technical documents, FAQs, etc.

Safe Storage/Destruction of Training Data

• Implementing security measures, such as access control and restriction of access authority for training data

• Destroying training data in an irrecoverable manner once the purpose of processing has been achieved

Clarification of the Roles of Participants in the AI Value Chain

• Reviewing how the processing of personal information is delegated or how personal information is transferred overseas

• Considering the means for ensuring the appropriate allocation and execution of roles among various participants (e.g., contracts, licenses, guidelines)

Preparation and Disclosure of the Acceptable Use Policy (“AUP”)

• Preparing and disclosing a use policy that lists foreseeable misuses of an AI content generating system and prohibiting such misuses

Organization and Operation of AI Privacy Red Team

• Establishing and operating a red team with external experts to test and confirm the types of privacy infringement

Preparation of Means for Data Subjects to Report Incidents and Response Measures

• Preparing measures in response to requests to delete faces, voices, etc., generated in AI output against the intent of the data subject and implementing a function to report inappropriate output

Compliance with Automated Decision-Making Related Obligations

• If a decision made using an AI system is an automated decision, preparing a plan to guarantee the data subject’s right to refuse, request explanation and request review

Privacy Impact Assessment

• Conducting an impact assessment for AI services whose training data are highly likely to contain sensitive information or that may have a significant impact on the rights and obligations of data subjects

Type

Details

Processing of Training Data

• Minimizing the collection of training data, and if possible, using and retaining training data through anonymization or pseudonymization immediately after collection

• Removing redundant sentences, words, etc., in the training data using de-duplication

Use of Synthetic Data

• Training AI model using synthetic data (i.e., simulated or artificial data generated by learning the format, structure, and statistical distribution characteristics and patterns of the original data for a specific purpose)

Fine-Tuning

• Using fine-tuning techniques, such as supervised fine-tuning (“SFT”) and reinforcement learning from human feedback (“RLHF”)

Input and Output Filtering

• Refusing to create a response or providing a pre-determined response to a prompt that induces personal profiling or privacy-infringing responses

• Applying a filter technology that detects and removes personal information generated in the output

Differential Privacy Techniques

• Applying a differential privacy technique that adds noise to a specific database to protect information in individual data while maintaining meaningful statistical queries

Measures to Track Data from Sources and Detect Synthetic Content

• Preparing measures to record metadata (attributes) of synthetic content and detecting synthetic content in order to prevent damage caused by misuse of synthetic content

Pseudonymization or Anonymization of Biometric Information

• Applying various pseudonymization and anonymization technologies to video information, video, voice, etc.