As artificial intelligence (AI) technology spreads across various industries, the role of the Personal Information Protection Commission (PIPC) is evolving. The rise of AI-driven cyberattacks and the increasing use of data in new AI services have heightened the need for policy responses that support both personal information protection and industrial innovation.
In a recent interview with Aju Economy, Song Kyung-hee, chair of the PIPC, outlined plans to enhance technical oversight capabilities to counter AI-based cyberattacks while establishing standards to help companies safely develop new AI services and utilize data.
"When there is confidence that personal information is secure, citizens can use AI services with peace of mind, and companies can leverage data to create greater value," Song emphasized. "Ultimately, our goal is to ensure that protection serves as the foundation for innovation and competitiveness."
Song is an expert with a background in AI industrial policy and trustworthiness. She has previously served as the Director of AI Policy at the Ministry of Science and ICT and as the head of the Presidential Fourth Industrial Revolution Committee's support team, contributing to initiatives like the 'data dam' policy and the expansion of AI voucher programs. Drawing from her experience in fostering the AI industry and data utilization policies, she is advocating for a direction that supports both personal information protection and technological innovation.
The PIPC is working to secure technical expertise in AI and cybersecurity while enhancing its ability to analyze the risks of personal information breaches from new technologies and services. As AI-driven cyberattacks become more sophisticated, existing personal information protection systems are increasingly vulnerable to exploitation.
In fact, reports of personal information breaches rose to 447 last year, a 45.6% increase from the previous year. In the first half of this year alone, 432 cases were reported. Song noted, "AI is replacing tasks that previously required significant time and effort, such as vulnerability scanning, phishing email creation, and malware production. This has made widespread and repetitive attacks easier by lowering the time, expertise, and costs required for such attacks."
She added, "Recent incidents often stem from basic oversights, such as inadequate access controls, delayed updates, and poor management of outsourced vendors. AI is exploiting gaps that we have delayed addressing more quickly and extensively."
In response, the PIPC plans to improve its oversight approach by not only examining whether companies have implemented safety measures but also assessing how quickly they can identify vulnerabilities and mitigate damage.
To achieve this, the PIPC is focusing on securing technical expertise. In August, it added one AI expert to its team and is currently working to recruit four additional specialists for its 'Technology Analysis Center,' which will analyze the risks of personal information breaches from new technologies and services. Last year, the PIPC established a Digital Forensics Center, deploying three specialized personnel.
Song explained, "The Technology Analysis Center will directly assess 'where the risks lie' before new services hit the market, identifying potential hazards in advance. This center will differ from the existing Digital Forensics Center, which investigates causes after incidents occur."
The PIPC is also strengthening international cooperation to address cross-border threats to personal information breaches. In June, it launched a 'Working Group on the Illegal Distribution of Personal Information' within the Asia-Pacific Privacy Authorities (APPA), of which Korea is the chair. The group plans to establish national hotlines to share information on detecting illegal distribution of personal information and to expand practical cooperation, including requests for the removal of illegal distribution information.
Song emphasized, "Personal information protection should not be a constraint on the AI industry but rather a foundation for securing trust and competitiveness." She aims to support companies in resolving legal and technical uncertainties related to personal information before launching AI services.
To this end, the PIPC will enhance its functions to monitor the risks of personal information breaches arising from AI technologies while also supporting safe AI development and data utilization by companies.
A key initiative is the 'Preliminary Appropriateness Review System,' which allows companies to consult with the PIPC on the legality and safety of personal information processing during the development of new technologies or services. Song plans to further activate this system.
The PIPC will also expand research and development on privacy-enhancing technologies (PET), such as pseudonymization and synthetic data, to support data utilization while reducing the identifiability of personal information.
Additionally, the PIPC plans to proactively address new technologies with complex personal information processing methods, such as agent AI and smart glasses, by establishing standards that enable companies to safely utilize these innovations.
Song stated, "We will actively support both companies and citizens in utilizing new technologies without uncertainty."
During her term, Song aims to establish personal information protection as a fundamental element of corporate management and to develop the PIPC into an institution that guides the safe use of AI technologies. Her vision is to create a society where personal information protection is a basic component of management and governance.
She stressed that the perception and actions of companies regarding personal information protection and security must change. To facilitate this, she plans to strengthen the responsibilities of CEOs and Chief Privacy Officers (CPOs) and to implement 'Privacy by Design' principles from the design stage of products and services across corporate management.
Support for small and micro-enterprises will also be expanded. The budget for the upcoming year includes provisions for specialized consulting and technical support, with plans to offer tailored comprehensive consulting starting in 2027. Intensive training will be provided for young IT professionals, and basic consulting for small and micro-businesses will be enhanced to cultivate practical personnel in personal information protection.
Song also stated that the PIPC will not only impose regulations and sanctions on companies but will also strengthen its role in analyzing the risks of personal information breaches from new AI technologies and guiding safe data utilization.
"Ultimately, our goal is to ensure that protection serves as the foundation for innovation and competitiveness," she reiterated. When citizens trust that their personal information is secure, they can confidently use AI services, and companies can leverage data to create greater value.
She added, "I will strive to hear from citizens and businesses that 'thanks to the PIPC, safe AI innovation is taking place, and we can use AI with more confidence.'"
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.