Personal Information Commission: "Deepfake and Synthetic Content Will Be Deleted Upon Request by the Subject"

2025 Major Policy Initiatives
Innovation of Personal Information System for the AI Era
Selection and Implementation of Six Core Tasks

The Personal Information Protection Commission (PIPC) will improve the personal information regulatory system this year in line with the era of artificial intelligence (AI). It will establish regulations allowing the use of original data after safety measures if research purposes are difficult to achieve through pseudonymization.

On the 13th, the PIPC announced its major policy promotion plan for 2025 centered on "Safe Personal Information, Trusted AI Era." Through this, it plans to prepare strengthened AI and data policies, including the revision of personal information legislation to meet the AI era, while proactively responding to infringement threats to secure social trust in personal information processing. It will implement three major strategies and six core tasks.

First, it plans to innovate the personal information regulatory system for the AI era. By establishing a legal foundation that allows valuable personal information to be safely utilized for AI development, it will support the development of the domestic AI and data ecosystem.

In cases where achieving research objectives is difficult with pseudonymization alone, such as autonomous driving AI development, it will establish special provisions under the Personal Information Protection Act that allow the use of original data under the premise of appropriate safety measures and review and resolution by the PIPC. It will expand the grounds for legally processing personal information, considering the legitimate interests or public interest of AI developers and others.

It will also prepare AI and data processing standards by major fields, concretizing the principle-based personal information regulatory system established last year through public-private cooperation so that it can be applied in the field. It plans to introduce legal rights for data subjects to request deletion of synthetic content misused by deepfakes and to prohibit and punish personal information synthesis acts that damage personal dignity.

To establish a sustainable foundation for new business innovation, it will promote the enactment of the "Tentative Act on Installation and Operation of Video Information Processing Devices," considering the special nature of personal video information where unspecified many people are filmed and prior consent of data subjects is difficult. In response to the spread of biometric recognition technologies such as facial and fingerprint recognition, it will specify principles for processing biometric information and measures to guarantee data subject rights.

It will legalize the review committee that judges the appropriateness of pseudonymization and activate the use of pseudonymized information by adding pseudonymization functions for unstructured data to the "Pseudonymized Information Support Platform." It will also focus on supporting the development of Privacy-Enhancing Technologies (PET). For technologies that have been developed, it will prepare technology transfer targeting small and medium-sized enterprises and micro-enterprises to commercialize enhanced technologies.

A PIPC official stated, "There are concerns about personal information infringement by mobile video devices such as autonomous vehicles, drones, and robots, but since there are various aspects that require preparation, including industry promotion, we are consulting with the National Assembly for the enactment of a financial law." He added, "We are considering allowing some use under strict safety measures when it is for research and development purposes."

There is also a task to secure leadership in global privacy norm discussions. Taking advantage of the global privacy conference to be held in Seoul this September, it plans to lead the formation of new norms reflecting the perspectives of Asia and other regions.

With the full-scale implementation of the MyData system starting from the medical, telecommunications, and energy sectors, it will strive to produce results accordingly.

First, it plans to gradually launch five leading services: in the medical field, "Customized Chronic Disease Prevention and Management," "Linking Overseas Residents' Domestic Medical Records," and "Medication Management and Prescription Support"; in the telecommunications field, "Optimal Communication Fee Tracking"; and in the autonomous field, "Optimal Travel Destination and Travel Expense Design Proposal."

It will expand information senders and transmission items in the medical and telecommunications fields and discuss expanding to various fields such as education, employment, and leisure, considering national convenience. It will open a "MyData Support Platform" to assist the exercise of personal information transmission rights, designate personal information management specialized institutions through strict screening, and conduct continuous on-site inspections. It also plans to prepare guidelines to prevent improper inducement or solicitation of transmission.

In addition, the PIPC will strengthen its role as a personal information control tower by enhancing preventive inspection functions and investigation capabilities, revising investigation and disposition systems, and conducting proactive focused inspections on three vulnerable sectors of personal information protection: areas closely related to citizens' lives, new technologies and new industries, and the public sector.

It will prepare measures to secure enforcement power against non-cooperation by problematic overseas businesses and plan to mandate overseas businesses to designate domestic corporations as domestic agents first.

Furthermore, efforts to build a personal information safety net encompassing both public and private sectors will continue.

It will expand pilot certification of privacy-by-design for IT devices used in daily life and promote statutory certification through amendments to the Personal Information Protection Act. In multi-use facilities, it will mandate the use of IP cameras with certified security.

It will implement a full disclosure system for legal violations by public institutions, and public institutions that have experienced large-scale leakage incidents will be obligated to undergo additional on-site inspections within three years after investigation and disposition.

To strengthen the protection level of personal video information such as CCTV video monitoring facilities, it will conduct a nationally certified private qualification exam for video information managers to enhance the expertise and capabilities of personnel working in public and private monitoring facilities.

Ko Hak-su, Chairperson of the PIPC, stated, "Along with the rapid development of new technologies including generative AI, voices demanding innovation in personal information regulation and concerns about potential privacy infringement threats are appearing simultaneously." He added, "By enhancing the completeness of the principle-based personal information regulatory system in line with changes in the AI environment, we will alleviate public anxiety and actively support the development of the domestic AI ecosystem."