On why YulChon launched its integrated technology, media and telecom (TMT) center, attorney Son Geum-joo (Judicial Research and Training Institute class 30) said, "The biggest change is that regulatory overlap has deepened." With the spread of artificial intelligence (AI), a single service can simultaneously be assessed as an AI service, a platform service, a personal information processing service, and a broadcasting and media service, she said.
In the past, broadcasting and telecommunications, personal information, fair trade, and media regulations operated relatively separately. But now, even a partial change to a recommendation algorithm by a platform company can trigger fair trade, personal information, data security, and user notice issues together. Corporations that use an external large language model (LLM) must also examine, at the same time, the source of training and input data, the basis for providing personal information, and whether there is an overseas transfer.
The YulChon integrated TMT center brings together in one organization capabilities for broadcasting and telecommunications regulation, permits and market entry, personal information and data, AI and new technologies, cybersecurity, platform fair trade, and litigation and dispute response. It is led by managing partner attorney Son Do-il (class 25), with attorney Son Geum-joo, attorney Han Seung-hyeok (class 33), and attorney Kim Sun-hee (class 36) participating. YulChon has already collaborated across fields, but it judged that in the AI transition period, case-by-case collaboration was insufficient and created a standing integrated response system. The following is a Q&A.
— What has changed the most between past TMT regulations and those now?
(Son Geum-joo, attorney) "There are changes in individual statutes, but the bigger change is overlapping regulation. A single corporate activity that used to be handled in the broadcasting and telecommunications realm can now simultaneously spill over into personal information, fair trade, the Ministry of Science and ICT, and National Assembly issues. As AI has grown in importance, it is shifting into a complex regulatory form spanning multiple regulators."
(Han Seung-hyeok, attorney) "From the perspective of corporations, the premise that 'you only need to look at the KMCC' is gone. Even issues that used to be about broadcasting and telecommunications can draw interest from the FTC or the Personal Information Protection Commission."
— For example, what risks arise if a platform company changes its recommendation algorithm?
(Son) "A platform service ultimately turns on how it gathers and uses data and connects it to user services. Even a small algorithm change can create issues not only in fair trade but also in personal information, data, and security. In this transition period where existing platform services are combined with AI, you must look, from the service design stage, at data flows, algorithmic impacts, user notices, security, and fair trade issues together."
— What problems arise if you respond separately to each regulator?
(Han) "Response logic by agency can contradict one another. An explanation crafted with only one agency in mind can cause misunderstanding or fail with another agency. That is why coordinating the overall logic is necessary."
(Son) "The National Assembly is also a key variable. Through legislative debates, data requests, and shaping public opinion, it exerts a substantial de facto influence on the regulatory environment. With logic framed only at the KMCC level, it may be difficult to mount a defense at the level of consumer groups, the FTC, or the National Assembly."
— Regarding the Basic Act on AI, what do corporations most often misunderstand?
(Kim Sun-hee, attorney) "The biggest mistake in AI compliance is looking only at the Basic Act on Artificial Intelligence. Whether something qualifies as high-impact AI is important, but on the ground, personal information, copyright, the Act on Fair Labeling and Advertising, and the Monopoly Regulation and Fair Trade Act intersect together. When introducing an AI service, you must examine not only the Basic Act on AI but also data collection and use, how outputs are labeled, consumer protection, and the potential for restricting competition."
— What should corporations be careful about when using an external large language model (LLM)?
(Kim) "Incoming and outgoing data are especially important. When bringing in data from outside, you must check whether there is a basis for collection; when providing data externally, you must check whether there is a basis for provision or for outsourcing and entrustment. Overseas transfer is particularly sensitive. If there is no domestic outsourcing contract, it may be subject to fines, but if there is an overseas transfer, it can raise a penalty surcharge issue."
(Son) "Because overseas LLMs are often used, the risk under the Personal Information Protection Act is the greatest. There are also many cases where prompt inputs or data rights relationships are unclear."
— Among AI training data, what type is most risky?
(Kim) "Sensitive information is the most important. Beyond the sensitive information defined by law, you must also be careful with information people perceive as sensitive, such as health information, genetic information, union membership, and financial information. You must manage, together as metadata, the source of collection, legal basis, and the scope of retention and use."
— What internal controls are needed in platform fair trade?
(Han) "In abuse-of-market-dominance cases, intent and purpose matter in addition to results. The FTC has assessed intent by reviewing internal documents, messenger chats, and emails. You should also have documentation showing that an algorithm change is intended to improve user convenience and service satisfaction."
— Within 24 hours of a cyber incident, what must be decided?
(Kim) "First, identify the cause and block any exfiltration path if there is one. Then determine whether a leak occurred and when, and decide whether there is a duty to report or notify. If the response is delayed, suspicions of concealment can easily arise, and the burden of addressing consumer complaints and the media also grows."
— How does the YulChon integrated TMT center differ from existing individual advisories?
(Son) "YulChon's strength has always been a collaborative culture. But for today's changes in AI and digital regulation, project-based collaboration alone is not enough. We saw the need for a standing integrated response system."
(Kim) "When you operate as a single team beyond inter-team collaboration, the speed of information sharing and the intensity of cooperation are different. From the perspective of corporations, there is the advantage of being able to have AI, data, personal information, fair trade, and cybersecurity issues reviewed within a single flow without having to explain them separately."
— What risks should TMT corporate leadership prioritize this year?
(Han) "Integration is the key. You need to view risks from multiple angles, but respond in a unified direction to deliver solutions that help clients."
(Kim) "AI and data run through the entire tech industry. Corporations need a one-stop solution."