Personal Information Protection Act | A Court's Determination That Using Collected Message Data to Train an AI Chatbot Constituted Processing of Personal Information Without Genuine Consent

The court determined that a merely formal and blanket consent procedure cannot be regarded as satisfying the obligation of genuine consent required by the Personal Information Protection Act.

The court found that obtaining consent through a checkbox stating only "I agree to the terms and the privacy policy" and then providing access to the privacy policy by way of a link does not make it possible to conclude that users clearly recognized how their personal information would be used and consented to it.

In doing so, the court set out a standard that consent must be disclosed with its content and scope clearly distinguished and must be explained in a manner that allows users to recognize it sufficiently.

The court determined that the data the defendant company used in the course of AI training did not meet the standards for anonymized or pseudonymized information under the Personal Information Protection Act.

Because the conversation sentences contained not only individually identifying information such as names, contact numbers, addresses, passwords, and account numbers, but also content from which social relationships and personal details could be inferred, the court found that the risk of identifying a specific individual was substantial if additional information were combined with it.

The court also determined that the measure of encrypting only part of the information while storing a substantial portion without de-identification did not satisfy the pseudonymization standard required by Article 28-2 of the Personal Information Protection Act.

The court found that the functions provided by the existing app service and the AI chatbot service were fundamentally different in purpose, character, function, and usage environment, so using the data as training data without consent constituted a use exceeding the scope of the collection purpose provided for in Articles 15 and 18 of the Personal Information Protection Act.

The court determined that the mere fact that the privacy policy stated "development of new services" cannot be assessed as showing that the data subjects anticipated or consented to the training of AI algorithms.

The court also found a violation with respect to the defendant's failure to comply with the legal obligation to separately store or destroy the personal information of long-term non-users and withdrawn members.

The court determined that this constituted a violation of Articles 21 and 39-6 of the Personal Information Protection Act.

On the ground that, although the conversation sentences contained content falling under the sensitive information set out in Article 23(1) of the Personal Information Protection Act, such as health information, content relating to sexual life, and ideologies and beliefs, no separate explicit consent had been obtained, the court found a violation of the laws relating to sensitive information.

Accordingly, the court, using the risk of harm and the degree of infringement as criteria, divided the victims into groups according to whether their personal information had been leaked, their sensitive information had been leaked, or both, and recognized differentiated consolation money of 100,000 won, 300,000 won, and 400,000 won.

Daeryun Law Firm LLP provides the following response services for platform service companies and AI service operators.

First, it provides compliance modeling that reviews in advance whether the Personal Information Protection Act is being complied with at the service-planning and early-development stages.

Second, it presents disclosure and consent procedures regarding the purposes of personal information collection and use, the retention period, and the scope of use, based on the standard of what users can understand.

Third, during service operation, it supports responses to investigations by supervisory authorities such as the Personal Information Protection Commission and the Korea Communications Commission, and the development of improvement measures.

Fourth, when a personal information leak or infringement incident occurs, it designs both the criminal response (filing complaints, responding to investigations, and strategies for a finding of no charge and for mitigation of punishment) and the civil response (strategies for defending against claims for damages) together.

Fifth, it provides risk-prevention systems, including training for officers and employees within companies and institutions, vulnerability management, and the analysis and collection of evidence through digital forensics when a violation of the Personal Information Protection Act occurs.

If you need legal advice regarding the Personal Information Protection Act, you are welcome to book a 🔗corporate attorney legal consultation at any time.