The government will push to introduce a special case that allows the use of original personal data for public-interest AI development to support AI transformation (AX). It will also strengthen personal data protection, including by implementing punitive penalty surcharges of up to 10% of revenue on corporations that leak personal data or commit serious legal violations starting in September.
The Personal Information Protection Commission announced its second-half work plan with these measures at a briefing held at the Blue House on the 16th.
To strengthen competitiveness in the AI industry, the Personal Information Protection Commission will pursue the introduction of a special case for using original AI training data that allows original personal data to be used for AI training for public-interest and social-purpose AI technology development, contingent on tailored safety measures. This reflects industry calls that original data must be used to improve AI training performance.
It will prepare field-specific guidelines, including for agentic AI and public AX, and establish an "AX assurance support system" that integrates existing innovation-support schemes such as prior adequacy review, no-action letters, proactive legal interpretation, and a regulatory sandbox. It plans to link optimal support tools for each case to resolve regulatory uncertainty and support lawful and safe AX in the public and private sectors.
It will also overhaul the framework for the safe overseas transfer of personal data in line with expanding cross-border data flows. In addition to the current consent and adequacy recognition, it will introduce transfer methods using the Personal Information Protection Commission's standard contractual clauses (SCCs) and corporations' binding corporate rules (BCRs), and expand cooperation with countries that have high demand for data exchange, including in the Asia-Pacific region.
At the same time, personal data protection will be further strengthened. Starting in September, the Personal Information Protection Commission will implement punitive penalty surcharges of up to 10% of revenue on corporations that seriously or repeatedly violate the Personal Information Protection Act. In line with the launch of the penalty surcharge system, it will revise related enforcement decrees and notices and strengthen investigation and disposition systems.
It will also increase the enforceability of investigations into personal data breach incidents. It will establish new penalties for concealing or destroying evidence and introduce a program to pay rewards to internal whistleblowers who provide tips helpful to investigations. To address the current structure in which corporations that diligently report breaches end up bearing a heavier burden, it will provide incentives for prompt reporting and early response, and increase penalty surcharges for corporations that delay reporting or intentionally leave incidents unattended.
It will expand prevention-centered protection systems as well. It will conduct regular and ad hoc inspections in areas closely tied to people's daily lives and require about 600 major corporations and institutions to designate and report professional chief privacy officers (CPOs). In the public sector, it will strengthen preemptive prevention systems by requiring at least one vulnerability assessment and penetration test per year.
It will also expand the protection of people's rights and interests. It will strengthen the damage-compensation system for victims of personal data breaches and pursue ways to use penalty surcharge funds for relief and recovery. It also plans to build an AI-based "comprehensive support service for personal data infringements" that provides counseling, reporting, relief, and support for personal data deletion in one place.
It will pursue personal data regulatory reforms suited to the AI era. It will establish personal data processing principles that reflect new technologies such as smart glasses and expand the functions of regional support centers for pseudonymized data use to include unstructured data such as video, audio, and images. It will also train data privacy professionals by providing education on personal data laws and technology to local youth.
Song Kyung-hee, chair of the Personal Information Protection Commission, said, "We are shifting the personal data protection system toward prevention while increasing the effectiveness of sanctions, prompted by last year's large-scale breach. In the second half, we will strengthen institutional support so that preventive investment and protection efforts take root on the ground and swiftly push forward safe data-use innovation to deliver results that people can feel."