SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
Further Details Details such as the scope of AI-related obligations will be determined by the subordinate laws and regu - lations. As the subordinate laws and guidelines for the AI Framework Act have not yet been finalised as of the date of this article, it is necessary to continue monitoring legislative developments. The AI Framework Act relies on the existing PIPA regu - lations when it comes to personal information. The PIPC plays a key role in shaping these regulations. • The PIPC is actively developing AI-related policies, having published various guidelines that define the application principles and standards of the PIPA. These guidelines cover topics including generative AI, privacy risk management model for safe use of AI, publicly disclosed information, unstructured data, biometric information, synthetic data, mobile image devices and transparency. • In 2023, the PIPA was amended to introduce regulations on automated decisions made by fully automated systems, such as AI. Under these regulations, data subjects have the right to request explanations of automated decisions and, in some cases, the right to refuse them. Data controllers must disclose the standards and procedures for these decisions and how personal information is processed, ensuring that data subjects can easily understand this information. The PIPC believes that applying the principle of per - sonal information protection in a balanced manner is essential for maximising the benefits and opportuni - ties of using AI, while minimising the risk of personal information infringement potentially caused by AI. In particular, the PIPC seeks to promote the use of data by resolving legal uncertainties through the following systems: • regulatory sandbox – under certain conditions, products or services using new AI technologies can first be released, tested and verified without being subject to all or part of the existing personal information regulations, thereby promoting the use of data necessary for the development and provi - sion of AI; and
• preliminary adequacy review system – if it is uncer - tain whether a service provider can comply with the PIPA in the course of planning new technologies or services such as AI, the service provider and the PIPC can work together to come up with a plan to resolve legal uncertainties. 1.6 Data Breach Requirement A data controller is required to: • report a data breach to the PIPC or the Korea Inter - net & Security Agency (KISA); and • notify the affected data subjects within 72 hours from the time it becomes aware of the breach. While the reporting obligation to the authorities is trig - gered only when certain statutory thresholds are met, notification to data subjects is mandatory in all cases where a data breach has occurred. Separately, even where no data breach has occurred, online service providers may be subject to additional reporting obligations under other applicable laws. For example, if a cybersecurity incident affecting informa - tion networks or related systems is identified, a report must generally be filed within 24 hours. Depending on the interplay between applicable laws, certain reporting or notification obligations may be exempt - ed. Accordingly, in practice, business operators must carefully review the laws applicable to each incident and determine whether they bear reporting or notifica - tion obligations. In the event of a data breach or a cybersecurity inci - dent, investigations are typically conducted by the PIPC and the MSIT, with the assistance of the KISA. If necessary, the MSIT may also form a public-private joint investigation task force for the investigation. In addition, the National Assembly may conduct audits or hold hearings, and the National Policy Agency may carry out witness investigations. Such investigations by different authorities often proceed simultaneously. When a data breach takes place, data subjects may file an application for collective dispute mediation under the PIPA. Although the PIPA does not provide for a class action mechanism for damages, data subjects may individually bring civil claims for damages before
437 CHAMBERS.COM
Powered by FlippingBook