South KoreaPersonal Information Protection Act, Art. 15(1)(6), legitimate interests
Personal Information Protection Act (Act No. 10465, as amended by Act No. 19234), Art. 15(1)(6)
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- Collect and use personal information without consent on this ground only where it is necessary to attain your legitimate interests and those interests are manifestly superior to the data subject's rights.NIST AI RMFMEASURE 2.10
- Keep that processing substantially related to your legitimate interests and within a reasonable scope.NIST AI RMFMAP 1.6
These lines are LexLint's reading of the law's text. Also read by: PIPC Guideline on Processing Publicly Available Data for AI Development and Services (guidance from the Korean Personal Information Protection Commission, issued ); Personal Information Protection Commission (개인정보보호위원회) (guidance, recorded ); Supreme Court of Korea, judgment of , case no. 2014Da235080 (recorded ).
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://pipc.go.kr/np/cmm/fms/FileDown.do?atchFileId=FILE_000000000558005&fileSn=0
- Case citation
- Supreme Court of Korea, judgment of , case no. 2014Da235080
- Guidance body
- Personal Information Protection Commission (개인정보보호위원회)
- Open questions
- May the legitimate-interests ground in Article 15(1)(6) of the Personal Information Protection Act be relied on to crawl publicly available personal information for a purpose other than developing or serving AI, given that the Commission's guideline sets out its criteria only for "AI 개발·서비스 목적으로 공개된 개인정보를 수집·이용하는 경우에 한하여" ("only where publicly available personal information is collected and used for AI development and service purposes")?
What it makes you log
Logging duty
Article 15(1), item 6, allows collection and use of personal information without consent where it is necessary for the controller's legitimate interests, manifestly superior to the data subject's rights, and only to the extent substantially related to those interests and within a reasonable scope. It imposes no duty to create, keep, produce or review a log or record. The Act's separate provisions on notice, access-record keeping and safety measures are outside the item this row cites and are not part of this row, and the item carries no territorial hook.
- Kind
- None
- As of
What this law does
Article 15(1)(6) of the Personal Information Protection Act lets a personal information controller collect and use personal information without consent "where it is necessary to attain the legitimate interests of a personal information controller, which such interest is manifestly superior to the rights of the data subject", and only to the extent the processing is substantially related to those interests and does not go beyond a reasonable scope.
The Personal Information Protection Commission's guideline on publicly available data sets out how the Commission reads this ground for AI training and service development; it binds nobody by itself and is listed with this law as guidance.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- PIPC Guideline on Processing Publicly Available Data for AI Development and Services, the Korean Personal Information Protection Commission
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .