Analysis of AI regulatory frameworks in South Korea

In an era where digital innovation is reshaping our world, artificial intelligence (AI) is emerging as a pivotal force, revolutionising industries and societal structures. In recent years, there has been a global movement towards greater clarity in AI regulatory approaches. South Korea has also been an active participant in this trend, marking significant milestones in AI policy and regulatory framework development.

Starting with the announcement of the National Strategy for Artificial Intelligence in December 2019, followed by the issuance of a Roadmap for Improving AI Law, System and Regulation in December 2020, and then the unveiling of the Digital Bill of Rights in May 2023, the nation has been vigorously engaged in shaping its AI regulatory landscape.

AI regulation is primarily executed through legislation and supplemented by guidelines from sector-specific regulatory bodies. This article examines Korea’s current legislative status concerning AI and explores the pivotal issues of AI, focusing on the protection of personal information and intellectual property rights. This will illuminate South Korea’s strategic approach in managing the complexities and dynamics in AI regulation.

AI LEGISLATION

While there is no specific framework act for AI at present, several legislative bills related to AI have been introduced in the National Assembly since 2022. A notable bill under review is the Act on Promotion of AI Industry and Framework for Establishing Trustworthy AI (AI Act), which consolidates and adjusts previously introduced fragmented bills.

Although the details are yet to be finalised, this legislation, unlike the EU’s AI Act, is known to be based on the principle of “adopting technology first and regulating later”, aiming to support the development and industrial activation of AI technologies. It also proposes specific obligations for high-risk AI areas including mandatory prior notification to users, ensuring trustworthiness, and safety.

However, the debate has brought suggestions to include regulations on generative AI and deepfakes, and there has also been opposition from civil groups to the regulatory approach, indicating that the finalisation of legislation remains to be seen.

Additionally, various laws in South Korea include provisions for regulating AI-related matters. For instance, the Credit Information Use and Protection Act provides rights for credit data subjects to demand explanations regarding automated evaluations and decisions, including the right to submit favourable information, as well as to request corrections or deletions of basic information.

The Personal Information Protection Act (PIPA) also grants data subjects the right to refuse automated decisions that significantly impact their rights or obligations, and to request explanations for such decisions. It is noteworthy that the right to request an explanation for automated decisions can be exercised even if the automated decision does not significantly impact the data subject’s rights or obligations.

Furthermore, when a data subject refuses such automated decisions, or requests an explanation, the data controller must not apply the automated decision unless there is a compelling reason to do so, or shall take necessary measures such as reprocessing through human involvement and providing explanations.

The Framework Act on Promotion of Data Industry and Data Utilisation, while not exclusively tailored for AI, contains applicable provisions for the use of data in AI training, emphasising the protection of “data assets” that are created through significant human or material investment.

POLICY, REGULATORY DEVELOPMENTS

(1) Protection of Privacy.
The development of AI technology has generated new privacy issues in the personal information sector. To address these evolving privacy risks, the Personal Information Protection Commission (PIPC) — South Korea’s primary enforcement authority for privacy matters — announced a policy direction in August 2023 titled “The safe use of personal information in the AI era”. This policy aims to stimulate the AI industry while minimising the risks of personal information breaches, with an emphasis on a principle-based regulatory approach.

The PIPC’s policy establishes comprehensive data processing standards and protective measures across all stages of the AI model/service life cycle, including planning, data collection, training, and provision. It advocates for the use of original video data to bolster AI quality and introduces a “privacy safe zone” system to facilitate the secure development and testing of AI technologies.

In addition, the policy initiates a regulatory sandbox for AI and a pre-adequacy assessment system. This pre-adequacy assessment system forms a co-operative framework where regulators and business entities collaborate to devise PIPA compliance strategies for new services and technological advances. Operators in adherence to these compliance plans are safeguarded from administrative action as long as the operational landscape remains unchanged.

To further enable AI innovation, the PIPC issued guidelines in February 2024 for the anonymisation of unstructured data, aimed at assisting its deployment in AI development. The PIPC intends to release several pivotal guidelines, such as the Guidelines for the Use of Public Personal Information, throughout the year to strengthen the regulatory framework pertaining to AI.

These initiatives demonstrate South Korea’s commitment to adapting its privacy regulations to the evolving landscape of AI, balancing innovation with the protection of a data subject’s rights.

(2) Intellectual Property.
Intellectual property (IP) issues regarding AI can be broadly categorised into three areas:

1. IP protection in AI model training;
2. IP infringement by AI outputs; and
3. IP protection of AI outputs

In the realm of AI training, challenges often arise during data collection, particularly with methods like web scraping to gather online content. This practice potentially infringes on the copyrights of original works such as images, texts or programs.

Given that the Copyright Act does not explicitly allow the use of copyrighted materials for AI training, the applicability of the fair use provision, which permits the “fair” use of copyrighted works without unduly harming the author’s legitimate interests, often raises a key point of contention.

However, there is ongoing discourse in the academic community, with differing views on whether the fair use provision should apply to data used in AI training. This area of the law is still developing and direct legal precedents are yet to be established.

Concurrently, an amendment to the Copyright Act, which would introduce text and data mining (TDM) regulations, is being considered. This amendment aims to allow the use of copyrighted works for AI training under specified conditions without the need for explicit permission from copyright holders. This legislative proposal is currently under review in the National Assembly, reflecting efforts to adapt copyright laws to the evolving landscape of AI technology.

Regarding the potential IP issues with AI-generated works, it is anticipated that AI creations may inadvertently infringe on pre-existing IP rights such as trademarks, or the likeness of public figures. However, currently there is a lack of clear regulations or legal precedents that address these concerns.

As for the protection of AI-generated works as IP, legal interpretation in South Korea does not recognise the outputs created solely by AI as having copyright. Nevertheless, it is worth noting that in December 2023, the Ministry of Culture, Sports and Tourism, together with the Korea Copyright Commission, published the Copyright Guide for Generative AI, where the ministry posited that if human creativity is involved in modifying, enhancing or arranging AI-generated works, then those contributions may be eligible for copyright protection.

This stance reflects an ongoing effort to reconcile the nuances of AI’s capabilities with traditional frameworks of IP law.

(3) Establishment of the Collective Industrial Standards for AI Trustworthiness.
In December 2023, the Ministry of Science and ICT, in collaboration with the Telecommunications Technology Association, established the Requirements to Enhance Trustworthiness for AI Systems as a collective industry standard.

A collective industrial standard is one established by the government and government-appointed entities, under the Industrial Standardisation Act, aimed at securing public safety, protecting consumers, and facilitating member convenience by setting standards for symbols, terminology, performance, procedures, methods and technology applicable to specific fields of expertise.

The collective industrial standards include 15 requirements that must be met by stakeholders throughout the entire life cycle of AI systems, from risk management planning and implementation to providing explanations about the scope of service and the subjects of interaction. These requirements are designed to foster trustworthiness in AI systems by ensuring comprehensive management and transparent operations.

CONCLUSION

South Korea is proactively evolving its legislative and regulatory environment to enhance the AI sector’s global competitiveness and manage emergent risks. The impending AI Act promises a transformative shift in the regulatory framework with far-reaching implications.

The provisions regarding automated decision-making under the amended PIPA, which will become effective in March 2024, are set to make a significant impact on industries employing AI. As the country prepares for the introduction of the AI Act and further industry-specific guidelines in 2024, close monitoring and analysis of these advances will be crucial.