“Personal information is not a public resource!”
- We oppose the proposed amendment allowing the use of original personal data beyond its intended purpose for AI development.
The government and the National Assembly are currently pushing for revisions to the Personal Information Protection Act, which would allow public institutions and companies to use personal information in its original form beyond its intended purpose without the consent of the data subject. This is because high-quality original data is essential for AI development, a key national priority for the Lee Jae-myung administration, which has prioritized Korea's advancement into one of the top three AI-related sectors. The Personal Information Protection Commission and industry are united in pushing for the passage of these amendments, proposed by Democratic Party of Korea Representative Min Byung-duk and People Power Party Representative Koh Dong-jin. Our organizations strongly oppose these revisions to the Personal Information Protection Act, which would strip data subjects of their rights for the sake of AI industry development, and demand the withdrawal of Representatives Min Byung-duk and Koh Dong-jin's amendments.
The so-called "AI Special Act," proposed by Representative Min Byung-deok on January 31st and by Representative Koh Dong-jin on March 13th, both under the same title, "Processing of Personal Information for the Development of Artificial Intelligence Technology," allows the use of personal information in its original form without the consent of the data subject (newly established Article 28-12). The essence of these two amendments is to unilaterally authorize the use of original personal information beyond its intended purpose for AI technology development, provided data controllers take technical, administrative, and physical measures under the supervision of the Personal Information Protection Commission. Furthermore, Representative Koh Dong-jin's bill adds provisions aimed at reducing the authority of the Personal Information Protection Commission and alleviating the obligations of data controllers. This abruptly strips away the data subject's right to self-determination of their personal information, which is the legislative intent of the Personal Information Protection Act. We feel a sense of betrayal that the Personal Information Protection Commission, which should be working to protect personal information, is instead spearheading the revision of the Personal Information Protection Act.
The incident of AI chatbot Iruda leaking personal information such as real name, address, and mobile phone number could happen again.
AI has become deeply embedded in our daily lives, transforming into diverse generative tools like chatbots, images, and videos, as well as self-driving cars and industrial robots. There are growing voices hoping that AI will bring positive changes to our lives and work, and the government is pursuing various policies to support the AI industry. However, the source of the data utilized by AI is people. It is also people who are the subjects of predictions and decisions. Therefore, AI will inevitably have a significant impact on the jobs and rights of ordinary people. As we race toward becoming an "AI powerhouse," we must consider the impact that AI and its data will have on people and society.
AI can learn on its own through data learning, make inferences based on this data, and generate output. However, trained AI models may contain personally identifiable information, run the risk of being memorized, and personal information contained in the training data may be leaked or exposed through prompt attacks. In other words, there is a real risk that personal information may be output as is during the AI service stage, or that it may be misused for personal identification or sensitive information inference purposes. We have experienced the "Iruda Chatbot Incident," where an AI chatbot trained on non-anonymized personal information leaked intimate personal information such as real names, phone numbers, and addresses, and engaged in discriminatory and hateful remarks.
The "right to self-determination of personal information" is recognized as a fundamental right under the Constitution, granting individuals the right to protect their personal information and control its processing. Under the current Personal Information Protection Act, which embodies this fundamental right, data controllers may only process legally collected personal information within the scope of the original collection purpose. Any use beyond that purpose, in principle, requires separate consent from the data subject. By way of exception, the special provisions regarding the processing of pseudonymized information allow for pseudonymized processing without the consent of the data subject only for purposes such as statistical compilation, scientific research, and public interest record keeping. In other words, currently, even if a data controller has lawfully collected personal information, it cannot use that information for AI training without the data subject's consent.
However, Representative Min Byung-deok and Representative Koh Dong-jin's bills, with the extremely abstract and comprehensive purpose of "developing AI technology and improving its performance," allow public institutions and companies that process personal information to use original personal information without pseudonymization as AI learning data. This does not require the consent of the data subject; only deliberation and approval by the Personal Information Protection Commission are required. If the bills pass, the information I provide to receive specific services can be used as AI learning data without my consent. As a result, individuals would be compelled to accept the risks—without their intent or consent—that personal data may be memorized during the training process and that such memorized data may be leaked or disclosed.
Does the development and improvement of AI technology justify the use of personal information without consent?
Moreover, the bill doesn't clearly specify whether data subjects can exercise their right to refuse or stop the use of their personal information as learning data. The original personal information that could be used and even sold in this way encompasses virtually all personal information generated and collected in our lives, workplaces, and online. Furthermore, if Representative Kim Tae-sun's bill, which would allow the collection of personal information disclosed on social media services without the consent of the data subject, is passed, online personal information will indiscriminately be turned into AI learning materials.
The amendment to the Personal Information Protection Act proposed by Representatives Min Byung-deok, Koh Dong-jin, and Kim Tae-seon treats citizens' personal information as if it were a public resource. Because it is a public resource, they argue, even the original data can be readily utilized for the national goal of AI development. They are broadly permitting the use of personal information in the name of industrial development, ignoring the numerous privacy infringements that AI technology has yet to overcome. If the Personal Information Protection Act is amended to allow such practices "for the development and performance improvement of AI technology," a social atmosphere could emerge where the use of personal information is taken for granted whenever new technologies emerge.
Few countries in the world have laws explicitly permitting the use of original data without the consent of the data subject "for the development and performance improvement of AI." This is because everyone agrees on the principle that protecting the fundamental human right to personal information is crucial even in the development and use of AI. What's needed now is not legislation specifically addressing the use of personal information, but rather strengthening data subjects' right to refuse the indiscriminate use of their information by the data industry and to control their own information.
If artificial intelligence brings us a beautiful future, that future must be created through a balance between technology and people. We have historically agreed that human rights must not be neglected in the pursuit of national development. Economic development unilaterally pursued by the state and corporations, disregarding human rights, is inevitably a regression of democracy. The revision of the Personal Information Protection Act, which unilaterally deprives data subjects of their constitutional rights on the grounds that government agencies are acting as deliberation agencies, must be withdrawn.
The government and the National Assembly must stop attempting to revise the Personal Information Protection Act to strip data subjects of their right to consent under the pretext of the AI industry!
We oppose the bill that would allow the use of original data without anonymization, including shopping information, hospital records, communication information, and credit information!
We condemn the use of sensitive biometric information, such as face, voice, and movement, without the consent of the data subject!
Representatives Min Byeong-deok and Koh Dong-jin must withdraw the AI Special Act, which abandons information subjects solely for the sake of the AI industry!
2025. 12. 2.
Center for health and social change
Citizen's Mediation Center Seoul YMCA
Civil society organizations in korea
Consumers union of Korea
Cultural Action
Daejeon People's Solidarity Participatory
Digital Justice Network
Federation of Korean Trade Unions (FKTU)
Headquarters of the Movement to Stop Healthcare Privatisation and Achieve Free Healthcare
Human Rights Education Center 'Deul'
Human Rights Education Center ONDA
Ilsan Hospital Labor Union
Institute for Digital Rights
Jeju Solidarity for participatory
Korean Confederation of Trade Unions (KCTU)
Korean Federation of Medical Groups for Health Rights (Korean Nurses association for Health Rights, Korean Pharmacists for Democratic Society, Korean Dentists Association for Healthy Society, Solidarity for Worker's Health, Association of Physicians for Humanism, Doctors of Korean Medicine for Health Rights)
Korean House for International Solidarity
Korean Metal Workers' Union (KMWU)
Korean Pharmacists for Democratic Society
Korean Public Service and Transport Workers' Union (KPTU)
Korean Teachers' Union (KTU)
Korean Women’s Federation for Consumer
MINBYUN – Lawyers for a Democratic Society
National Health Insurance Workers' Union
National Union of Mediaworkers
PeaceGround
People's Coalition for Media Reform
People's Health Movement Korea
People's Solidarity for Participatory Democracy (PSPD)
Republic of Korea Human rights archive
Saebyeokjigi Center for Independent Living
Solidarity for Child Rights Movement 'Jieum'
The Center for Freedom of Information and Transparent Society
The Democratic Legal Studies Association
Ulsan people‘s solidarity
WomenLink
(a total of 36 organizations, contact: idrsec@proton.me)