Apology from 'Iruda' Developer After 5 Days of Controversy: "Personal Data Will Be Deleted Only for Users Who Request It"

[Asia Economy Reporter Seolginna Cho] Scatter Lab, the developer of the AI chatbot 'Iruda,' apologized and stated that it will sincerely cooperate with the investigation regarding allegations of personal information leakage. This is the first official apology issued five days after the controversy surrounding Iruda erupted. Scatter Lab also acknowledged that it failed to properly implement personal information protection measures while sharing development records related to Iruda on the open-source sharing platform 'GitHub.' The company stated that it will delete personal information from the database only for users who request it.

In an apology statement released around 11 p.m. on the 13th, Scatter Lab said, "We are sincerely cooperating with the investigation by relevant authorities regarding personal information processing. We sincerely apologize to all users who have used our service."

Scatter Lab emphasized, "We will form a fact-finding committee to thoroughly investigate all controversial matters, establish a permanent personal information protection system including external experts, and conduct enhanced security training to prevent recurrence." It added, "We hope this incident does not cause harm to our fellow companies, researchers, and partners in the AI industry," and "We will strive to comply with social consensus on AI ethics."

Scatter Lab is under suspicion of violating the Personal Information Protection Act by collecting users' KakaoTalk data through the dating analysis app 'Yeonae-ui Gwahak' (Science of Dating) during the development of Iruda, an AI with the personality of a 20-year-old female college student. Key issues include failing to properly obtain consent for the use and utilization of personal information from users of the Science of Dating app and their partners, and not properly anonymizing (de-identifying) the data used as material for Iruda.

Additionally, it was confirmed that Scatter Lab did not properly anonymize data when sharing development records related to Iruda on the open-source sharing platform 'GitHub.'

In materials distributed along with the apology, Scatter Lab admitted, "It was confirmed that internal test samples were included in the open source published on GitHub," and "Although real names were automatically de-identified, some parts were not filtered during the process." The research reportedly included 100 data samples (100 sessions, approximately 1,700 individual sentences) extracted for internal testing purposes.

Furthermore, Scatter Lab bowed its head, saying, "We were not careful in managing data. We sincerely apologize for the exposure of potentially sensitive information." The GitHub post in question has been set to private.

Scatter Lab stated that it will delete information of users who do not want their data to be used for AI training from the database in accordance with the Personal Information Protection Act and will take active measures to ensure that such data is not used in the Iruda database going forward. However, specific deletion request procedures were not mentioned. Regarding the insufficient consent obtained during the collection of KakaoTalk conversations, the company maintained its previous stance that "there is no legal issue." Users are demanding that Scatter Lab completely destroy the KakaoTalk data.

Some users of the Science of Dating app are preparing a class-action lawsuit, claiming that Scatter Lab leaked personal information. On the same day, the Personal Information Protection Commission and the Korea Internet & Security Agency (KISA) visited Scatter Lab’s office in Seongdong-gu, Seoul, to begin a full-scale investigation into the personal information leakage allegations.

Organizations such as the Jinbo Network Center, the Digital Information Committee of the Minbyun (Lawyers for a Democratic Society), the Information Rights Research Institute, and the People's Solidarity for Participatory Democracy called the 'Iruda' incident "a disaster caused by the violation of 10 billion pieces of personal information" and urged the prompt establishment of specific and clear legal regulations.