Kakao has determined that before the release of its artificial intelligence (AI) service 'Kanana', safety measures to prevent the disclosure of user personal information need to be established, and separate consent must be obtained when user conversations are used for internal learning.
The Personal Information Protection Commission noted on the 13th that it voted on the preliminary review results of Kakao's AI assistant service 'Kanana' at an overall meeting the day before.
The preliminary review system exempts administrative action if the business planning and developing a new service has established compliance measures for the Personal Information Protection Act together with the commission and applied them appropriately, provided there are no changes in circumstances.
This is the first time the Personal Information Protection Commission has held a public briefing related to the system to discuss the results and future action plans.
Kakao applied for a preliminary review to ensure that the Kanana service, which was set to launch in December of last year, could be designed and operated in compliance with the Personal Information Protection Act.
'Kanana' is an AI friend service that understands the context of conversations to provide answers and will be launched separately from the existing KakaoTalk. It consists of 'Kana', which answers user questions based on group chat conversations, and 'Nana', which answers user questions based on private conversations with users.
While it is mainly built around a language model (LLM) developed by Kakao, the ChatGPT model from the U.S. OpenAI will also be used as a complementary tool.
During the preliminary review process, Kakao and the Personal Information Protection Commission agreed to enhance technical safety measures to prevent Kanana and Nana from disclosing participants' personal information learned in chat rooms to others in different chat rooms.
Data within the chat rooms will be stored in a separate database within Kakao and will not be stored on the OpenAI side.
If any unique identification information or personal identifiable information such as account or card numbers is included in the conversation data, it will be processed only in Kakao's own language model or encrypted to ensure that OpenAI cannot recognize it.
Additionally, to strengthen protection of the data processed by OpenAI, it will be specified in the entrusted contract that relevant conditions must be clearly stated.
The entrusted contract will stipulate that the data is to be used only for the tasks assigned to Kakao, it is forbidden for OpenAI to use it for business purposes, and technical measures will be taken to ensure that it is not separately stored by OpenAI after a response from ChatGPT.
If Kakao uses user conversation data as training data for its own language model, it must obtain separate consent from customers.
If users do not wish this, they can refuse.
In addition, to address the risk of exposure of personal information contained in user conversations, Kakao has decided to establish automatic filtering, human review procedures, public disclosure, and feedback processes.
Furthermore, Kakao's Chief Privacy Officer (CPO) will operate a constant risk management system and report significant risk management plans and execution details regularly to the board.
The Personal Information Protection Commission plans to check compliance with these measures once the Kanana service is launched.
Jeon Seung-jae, head of the investigation team 3 at the Personal Information Protection Commission, said, "The safety measures were refined in consultation with the commission based on the concepts that Kakao had envisioned earlier," and emphasized that "all mentioned safety measures must be implemented before the launch of Kanana."
The head of the team explained, "The preliminary review system has received few press releases in the past due to concerns that the trade secrets of corporations would be exposed since it accepts applications for services prior to launch. In the case of Kanana, it signifies that Kakao has consulted with the commission to ensure users can safely use the service by establishing safety measures, which is why we held this briefing."