Law note · South Korea
Personal Information Protection Act, Art. 15(1)(vi), as applied by the PIPC's publicly-available-data AI guideline
What it asks of an app
- Specify a legitimate, defined purpose for the AI model before relying on this ground to process publicly available personal data.
- Limit the personal data you collect and use to what is adequate and necessary for that stated purpose.
- Document a balancing assessment showing your interest clearly overrides the affected individuals' rights, and adopt the named technical and procedural safeguards, including a disclosure, impact assessment, and an erasure or objection mechanism.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
Article 15(1)(vi) lets a personal information handler process personal information without consent where necessary to achieve the handler's legitimate interest and that interest clearly overrides the data subject's rights, provided the interest is substantially related to the handler's legitimate interest and does not exceed a reasonable scope.
The Personal Information Protection Commission's July 18, 2024 guideline, non-binding but currently the operative practical standard, clarifies that publicly available data can be used for AI training and service development under this ground, provided the processor meets three requirements: a specified, legitimate purpose for the AI model; necessity, meaning collection is limited to adequate and relevant data for that purpose; and a documented assessment that the processor's interest clearly overrides data subjects' rights, backed by named technical safeguards (examining training-data sources, de-identification, secure storage) and procedural ones (privacy-policy disclosure, impact assessment, an erasure or objection mechanism).