Korean Privacy Commission’s Approach on the Processing of Video Data for AI Learning
In October 2024, the Personal Information Protection Commission (PIPC) of the Republic of Korea issued explicit guidance permitting the processing of video data containing personal information for AI learning purposes.
The guidelines, titled "Guidelines for Protection and Utilization of Personal Video Information for Mobile Video Information Processing Devices," primarily address the use of mobile video data processing devices from a privacy perspective. Notably, they include a section on utilizing video data for AI learning, stating that such data can be used through pseudonymization without obtaining the data subject’s consent. This interpretation is grounded in the view that AI learning constitutes scientific research. Under the Personal Information Protection Act (PIPA), personal data may be used without consent through pseudonymization if it serves purposes such as scientific research.
In the following analysis, I will examine the practical implications of this interpretation for AI development by comparing it with the GDPR, particularly the European Data Protection Board’s (EDPB) Guidelines 1/2024 on the Processing of Personal Data Based on Article 6(1)(f) GDPR, published in October 2024, and the CNIL's recent report titled “Relying on the Legal Basis of Legitimate Interests to Develop an AI System,” issued in June 2024.
1. AI Learning with Pseudonymized Data under Korean Law
Article 28-2 of the Personal Information Protection Act stipulates:
Article 28-2 (Processing of Pseudonymized Information, etc.)
1. "A personal information controller may process pseudonymized information without the consent of the data subject for purposes such as compiling statistics, scientific research, and the preservation of records for the public interest."
2. "When providing pseudonymized information to a third party pursuant to Paragraph 1, the personal information controller shall not include information that can be used to identify a specific individual."
The PIPA lists lawful bases for processing personal information, including the consent of the data subject, legal obligations, performance of a contract, protection of vital interests, and clear interests of the data subject. Article 28-2 introduces pseudonymization for certain purposes as an additional lawful basis for processing.
Regarding "scientific research" in Article 28-2, the PIPC provides the following interpretation:
“Scientific research refers to cases for industrial purposes such as technology development and demonstration, basic research, applied research, as well as the development of new technologies, products, and services. Therefore, it can include AI technology development and AI algorithm learning.”
Given the use of expressions like "scientific research, including AI learning" in other parts of the guidelines, it is evident that the Commission has effectively recognized that AI learning involving video data generally constitutes scientific research. Consequently, such data can be processed without the data subject’s consent through pseudonymization. This reflects the Commission's proactive stance in encouraging the utilization of video data for AI learning.
2. AI Learning and Legitimate Interests in GDPR
2.1 EDPB's Guidelines 1/2024 on the Processing of Personal Data Based on Article 6(1)(f) GDPR.
Under the General Data Protection Regulation (GDPR), personal data can be used for scientific research without the data subject's consent under certain conditions. Article 6(1)(f) of the GDPR cites "legitimate interests" as a lawful basis for processing personal data:
“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular where the data subject is a child.”
The EDPB's Guidelines 1/2024 provide detailed guidance on legitimate interests as a legal basis for processing but do not offer specific guidelines regarding AI learning or AI systems. Within these guidelines, "historical or other kinds of scientific research" are cited as examples of interests pursued under legitimate interests. Although the GDPR does not explicitly define "scientific research," Recital 159 states:
“For the purposes of this Regulation, the processing of personal data for scientific research purposes should be interpreted in a broad manner, including, for example, technological development and demonstration, fundamental research, applied research, and privately funded research.”
The EDPB guidelines reference the European Court of Justice (ECJ) decision in Gesamthochschule Duisburg v. Hauptzollamt München-Mitte (Case 234/83), which states:
“Scientific activities must be interpreted as including activities carried on by a public or private establishment engaged in education or research for the purpose of furthering the acquisition, development, exposition, or dissemination of scientific knowledge [...].”
Based on these interpretations and the lack of specific clarification, it seems that the EDPB adheres to conventional definitions of scientific research and may not generally classify AI learning as part of this category, in contrast to the approach adopted by the Korean Commission. In other words, unlike the PIPC, the EDPB does not explicitly categorize AI learning as scientific research that can be justified under legitimate interests.
2.2 CNIL's "Relying on the Legal Basis of Legitimate Interests to Develop an AI System
For processing personal data to be lawful under the legitimate interests ground pursuant to GDPR Article 6(1)(f), it must be "necessary for the purposes of the legitimate interests," and such interests must not be "overridden by the interests or fundamental rights and freedoms of the data subject."
The CNIL(Commission Nationale de l'Informatique et des Libertés)'s recent report titled “Relying on the Legal Basis of Legitimate Interests to Develop an AI System” follows this approach, requiring necessity and a balancing test in accordance with GDPR Article 6(1)(f). It states
“The commercial purpose of the development of an AI system is not in itself contradictory to the use of the legal basis of legitimate interests,”
while emphasizing legitimacy, necessity, and balancing with the data subject’s rights.
This approach aligns with the standards of the GDPR. However, there remains a lack of specific clarity regarding AI systems, especially in the training phase involving personal data. In practice, AI developers in the EU must navigate legal uncertainties when training AI using personal data, particularly video data that includes biometric information such as facial and voice characteristics.
3. Key Takeaways
Article 28-2 of Korea’s Personal Information Protection Act establishes pseudonymization as a lawful basis for processing personal information for certain purposes, including scientific research. The Personal Information Protection Commission has further clarified in its guidelines that using pseudonymized data for AI learning is generally exempt from requiring consent from data subjects, as it is typically classified as scientific research. This regulatory framework reflects Korea’s supportive stance on leveraging personal data for AI development.
4. References