Trusting the regulator, not the rules: South Korea's AI data amendment

South Korea is one plenary vote away from rewriting the legal basis for artificial intelligence training data. Only the floor vote remains, expected as early as mid-August; the law takes effect six months after promulgation.

But it is also more consequential: a structural decision about where trust resides in South Korea's data protection system. Rather than trusting accountable controllers within enforceable limits, the amendment relocates the decision itself to the regulator.

What Happened

That relocation revives a question data protection law exists to answer, not to provoke. The new special provisions, draft Articles 28-12 through 28-15, let lawfully collected personal data be used for AI development, performance improvement included, on a case-by-case PIPC resolution.

• Access to the expertsConnect with top thinkers in privacy, AI governance and cybersecurity for fresh ideas and insights.

• A global networkMake valuable professional connections through more than 160 local IAPP KnowledgeNet chapters in 70 countries.

• Four conditions frame the discretion: Anonymization or pseudonymization must not suffice; safeguards must be in place; the purpose must include public interest, protection of data subjects or third parties, or social benefit; and the.

What Reports Say

Coverage of the story so far points to:

• Continued reporting by IAPP as more details emerge