In a move poised to set a new standard for the responsible use of video data in artificial intelligence (AI) development, South Korea’s Personal Information Protection Commission (PIPC) has released the Guide to the Protection and Use of Personal Video Information for Mobile Video Information Processing Devices. Published on October 14, 2024, the guide focuses on safeguarding personal information captured by autonomous vehicles, service robots, and other mobile video processing devices, addressing growing privacy concerns as AI technology continues to advance.
The PIPC’s guide provides specific standards for the use of personal information, such as facial images, captured by mobile devices operating in public spaces. It also clarifies obligations under Article 25-2 of the Personal Information Protection Act (PIPA), which governs mobile video processing for business purposes in public spaces. This includes the use of personal data in AI development for autonomous driving systems and delivery robots—critical areas where the protection of individuals’ privacy is paramount.
The guide outlines eight core principles that must be followed by businesses and AI developers using video information for commercial or research purposes. These principles are designed to balance technological innovation with privacy rights:
- Proportionality: The purpose of data processing must be justified, and the methods used should minimize risks to individuals’ rights.
- Legality: Data collection and processing must be based on legal frameworks.
- Transparency: The data collection process and its purpose must be clearly communicated to the public.
- Safety: Businesses must implement measures to prevent unauthorized access or misuse of personal data.
- Accountability: Operators are responsible for complying with regulations and ensuring trust.
- Purpose Limitation: Data collection should be limited to what is necessary for the intended purpose.
- Guaranteeing Control: Individuals must be given ways to exercise their rights over their personal data.
- Privacy Protection: Steps must be taken to minimize any invasion of privacy.
In addition to outlining principles, the guide provides step-by-step processes to ensure compliance with these standards. Businesses and developers are urged to incorporate privacy-by-design principles at each stage of product development, from planning to deployment. Operators of mobile video information processing devices must carefully consider where and how personal information is collected, and inform the public of their practices through clear and accessible means.
The guide addresses different technologies used in autonomous vehicles, delivery robots, drones, and other mobile devices. It highlights that while some technologies collect pseudonymized information, others may capture identifiable personal data. The PIPC provides recommendations for businesses on how to disclose the collection of personal data and ensure public awareness, especially in cases where personal information is collected in public areas.
AI development relies heavily on data, and video data is often crucial for training AI systems. The guide stipulates that when using autonomous vehicles or mobile devices for AI training, personal information must be pseudonymized, such as by blurring or anonymizing individuals’ faces. However, if the data is being used for research purposes, the original video can be utilized under specific conditions, as long as safety measures are followed.
The guide offers additional recommendations for using video data in AI training, such as managing access, maintaining records of processing activities, and conducting periodic inspections. Compliance with PIPA is required throughout the process to ensure that data handling adheres to legal standards.
To ensure the long-term safety of video information, the guide outlines methods for securely storing and managing data. It includes best practices for preventing data breaches and outlines procedures for exercising the rights of individuals whose personal data has been collected. Businesses are encouraged to establish clear data retention schedules and policies for the safe destruction of unnecessary video information. For companies that outsource data processing, the guide emphasizes strict oversight and regular audits to ensure that third parties adhere to the same high standards.
Need Help?
If you’re wondering how South Korea’s AI strategy, or any other AI strategies and laws worldwide could impact you and your business, don’t hesitate to reach out to BABL AI. Their Audit Experts can address your concerns and questions while offering valuable insights.
