The Personal Information Protection Commission determined that Naver can lawfully operate its search artificial intelligence (AI) agent service "AI Tab," provided it guarantees user control and implements safety measures.
The Personal Information Protection Commission said on the 31st that it held its 10th plenary meeting on the 27th and deliberated and resolved the results of a preliminary adequacy review of Naver's AI Tab. The preliminary adequacy review system is a scheme in which, when it is difficult to find ways to comply with the Personal Information Protection Act based only on existing legal interpretations or precedents at the planning and development stage of new technologies and services such as AI, an application method of the law is prepared in consultation with the Personal Information Protection Commission.
AI Tab is a search AI chatbot service provided on the Naver search screen. Instead of listing webpages like traditional search, it summarizes and analyzes key content and provides it in a one-on-one chat format. Naver believes that when the AI selects what to answer, using a user's past service usage history, gender and age group, and interests can deliver more relevant search results.
Naver is pushing to use not only search service usage records but also activity records for blog and cafe posts and shopping history—usage histories related to Naver services—to generate personalized answers. Blog and cafe activity records include "likes and shares" on posts, and the target is content that is publicly available. Content that ordinary users cannot access or view, such as partially public or private posts, is excluded from the scope of collection.
The Personal Information Protection Commission resolved that the AI Tab service can be operated on the condition that three consultation items are implemented. First, for users who do not want personalized answers, Naver must provide easy-to-understand guidance on the existence and meaning of the option to refuse data use. It also said Naver should continue to improve measures to ensure practical post-use control, reflecting user feedback.
It also demanded transparency in the processing of personal information. The Personal Information Protection Commission instructed Naver to disclose, through the privacy policy and other means, the items and key details of customized information used in the AI Tab service, and to establish additional safety measures to prevent the misuse and leakage of personal information.
Measures to prevent sensitive information and key identifying information from being included in AI answers were also included among the consultation items. In analyzing users' service usage histories, Naver must ensure that sensitive information regarding ideology or beliefs, labor union or political party membership or withdrawal, political views, health, and sex life is not inferred or used. Unique identifying information, account numbers, and credit card information must also not be included in AI agent responses.
The Personal Information Protection Commission plans to check whether Naver is actually implementing the consultation items when AI Tab is officially launched. The resolution is a case that presents standards for user data utilization and personal information protection in personalized AI agent services.
Since October 2023, the Personal Information Protection Commission has approved a total of 20 preliminary adequacy review results, including two cases involving overseas operators. The Personal Information Protection Commission noted that as AI technology spreads and data processing methods become more complex, corporations' need to review lawful processing grounds under the Personal Information Protection Act and safety measures before launching new technologies and services is increasing.