South Korea - Public Data Processing Guide

Overview

The Personal Information Protection Commission (PIPC) published the Guide on 17 July 2024 to clarify how "publicly available personal data" may be lawfully processed for AI development and services under South Korea's Personal Information Protection Act (PIPA). The document frames publicly available personal data as information that is lawfully accessible by anyone (for example, data on public websites, blogs, online repositories such as Common Crawl, public filings, press and broadcast media). While publicly accessible, such data remains protected under PIPA; thus the Guide provides interpretive criteria for a legal basis (notably the "legitimate interests" basis), minimum safety measures, governance expectations and concrete examples of acceptable and unacceptable practices. The Guide is expressly advisory (non-binding) but is intended to reduce legal uncertainty and to inform both compliance and enforcement conversations at the PIPC. PIPC press material and the Guide's distribution are published on the Commission's site and the national privacy portal (see Sources).

Definitions

The Guide defines several core terms in a practical manner: "publicly available personal data" (data lawfully accessible to anyone without circumvention), "collection and use for AI development" (ingest, cleaning, labeling, training, validation, and deployment of AI models), "identifiable personal data" (data allowing identification of a natural person), "sensitive personal data" (health, biometric, unique identifiers, minors), and "legitimate interests" (the legal basis assessed through purpose legitimacy, necessity, and interests balancing). The Guide distinguishes publicly available data from non-public or restricted-access information (e.g., private communications, content behind authentication, paid-content behind contractual terms) and treats the latter as not covered by its permissive examples.

Governance and Institutional Framework

The Guide places responsibility on organizations to establish AI privacy governance structures centered on a designated privacy lead (e.g., Chief Privacy Officer) or an "AI privacy team" with cross-functional representation (legal, security, ethics, product, engineering). It recommends adoption of policies and standard operating procedures for dataset sourcing, retention, access control, and de-identification. The Guide calls for documented Legitimate Interest Assessments (LIAs) or Data Protection Impact Assessments (DPIAs) tailored for AI use-cases, with versioning and executive sign-off. Reporting channels and lines of accountability to senior management must be in place, and organizations are encouraged to integrate privacy-by-design and privacy-by-default into model development lifecycles. The Guide's governance blueprint aligns with PIPC's broader policy work on AI privacy risk management and transparency guidance, as articulated on the PIPC site (PIPC).

Key Focus Areas

The Guide identifies several thematic priorities: (1) Legal bases and interpretive criteria (chiefly legitimate interests) for collection and use; (2) Risk-based safeguards commensurate with the nature of data and AI use; (3) Technical measures to remove or protect direct identifiers prior to ingest and to minimize model memorization of personal data; (4) Data subject rights, transparency and remediation channels; (5) Special protections for sensitive categories (including default restrictions and higher scrutiny); and (6) Documentation and auditability to demonstrate compliance. Each focus area is explained with concrete examples and flowcharts for decisions, including how to assess whether content scraped from a public website can be retained for training or must be removed/reduced because of high identifiability or sensitivity.

Implementation Framework

The Guide recommends a lifecycle approach to implementation: (i) Purpose specification and planning (record purpose, reuse limits, retention); (ii) Source evaluation and pre-ingest filtering (exclude restricted or sensitive sources; adopt robots.txt and terms-of-service checks where relevant); (iii) Data processing controls (token removal, identifier scrubbing, pseudonymization/anonymization where feasible); (iv) Model training safeguards (techniques to limit memorization and to detect model exposure of training personal data); (v) Post-deployment monitoring (user-facing filters, output sanitization, and human review); and (vi) Continuous governance (documented LIAs/DPIAs, audits and incident response). The Guide sets expectation for demonstrable, repeatable processes rather than one-off decisions.

Monitoring and Evaluation

The Guide urges organizations to implement monitoring metrics and evaluation protocols for privacy risks. Recommended practices include periodic privacy risk re-assessments coinciding with model retraining, membership inference and data-exposure testing on models, logging and metrics for attempted access to sensitive datasets, and annual or event-triggered independent audits. The Guide suggests specific test methods (e.g., probing models for memorized personal data, evaluating differential privacy parameterization) and encourages publication of transparency reports summarizing data sources, mitigation measures, and redress channels to foster public confidence.

Penalties, Liability, and Appeals

Although the Guide itself is interpretive and non-binding, PIPC clearly signals that failure to meet standards may lead to enforcement under the Personal Information Protection Act. Potential regulatory actions under PIPA include administrative orders to suspend or correct processing, mandatory remedial measures, and civil or criminal liability where specified statutory thresholds are met. The Guide highlights the importance of maintainable documentation because lack of records or demonstrable safeguards increases enforcement risk. The PIPC's enforcement posture is also discussed in other PIPC materials linked from the Guide.

Relationship to Other Instruments

The Guide situates itself among broader PIPC initiatives and other sectoral and international instruments: it references previous PIPC materials (e.g., AI privacy risk management model, transparency guidance, and related safety guides), the national privacy portal, and international supervisory developments (e.g., CNIL and UK regulator approaches to web-scraped data). The Guide is intended to complement — not supplant — statutory obligations under PIPA, sectoral rules and contract law (including website terms-of-service), and other public guidance on secure AI development.

International Alignment

The Guide expressly compares South Korea's interpretive approach with contemporaneous rulemaking and guidance in the EU, France, the UK, and other supervisory authorities that are addressing the legality of using web-scraped or publicly available data for AI training. It recommends practitioners to align with recognized international privacy frameworks and to adopt technical and governance measures consistent with global best practices, for example, minimizing exportability of identifiable data, adopting strong access control, and documenting cross-border transfer mechanisms when models or datasets move across jurisdictions. The Guide also notes ongoing PIPC dialogues with international counterparts.

Implementation Timeline

Milestone	Date
Guide published by PIPC (announcement)	2024-07-17
Public briefings/FAQ and Q&A published	2024-07–08-2024 (Q&A materials circulated July–Aug 2024)
PIPC publishes AI privacy risk management model (complementary materials)	2024-12 (risk model release)
Further consolidated guidance on generative AI lifecycle	2025-08 (PIPC: generative AI processing guide)

Sources and References

Source	Type
Personal Information Protection Commission - Announcement: 인공지능(AI) 개발·서비스에 이용되는 ‘공개 데이터’ 처리 기준 제시	Primary Source
South Korea Privacy Portal - 자료: AI 개발·서비스를 위한 공개된 개인정보 처리 안내서 (자료 게시)	Primary Source