South KoreaPIPC Guideline on Processing Publicly Available Data for AI Development and Services
Guidance, not a law: the Korean Personal Information Protection Commission's reading of Personal Information Protection Act, Art. 15(1)(6), legitimate interests. It binds nobody by itself; the law it reads does.
Guidance on a comprehensive regime rule, addressed to public and private bodies.
- Instrument type
- guidance published by a regulator
- Audit expectation
- none
What the regulator expects
- An app training AI models on personal data scraped from publicly accessible Korean web sources must rely on and document PIPA Art. 15(1)(6)'s legitimate interest basis, since publicly available data is not exempt from PIPA.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
This row is itself a Commission guideline, so its guidance entry is the Commission’s integrated guide on the provision the guideline applies, Article 15(1)6.
- As of
- Guidance link
- https://www.pipc.go.kr/np/cmm/fms/FileDown.do?atchFileId=FILE_000000000559860&fileSn=1&fileExtsn=pdf
- Case citation
- Supreme Court of Korea, judgment of , Case No. 2014Da235080
- Guidance body
- Personal Information Protection Commission (PIPC), Republic of Korea
- Open questions
- Does the legitimate-interest test, which the guideline limits to collecting and using publicly available personal information for AI development and services, also govern other processing of the same data, such as keeping it after training?
What it makes you log
Logging duty
The guideline recommends that a business assess the requirements it sets out and store the basis for that assessment, but the same release says that businesses "do not need to implement every safeguard stipulated in the guideline" and may pick among them. A recommended, optional step is not a duty, so the row carries no logging duty. The release names no period or reader for a record and no purpose for keeping one. It addresses AI developers and service providers generally and states no territorial test, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
PIPC guidance interprets PIPA Art. 15(1)(6)'s legitimate interest ground as the lawful basis authorizing an AI developer to collect and use publicly available personal data from the open web for AI training and service development, provided the controller's interest clearly overrides data subjects' rights. It treats such data as remaining within PIPA's scope, not exempt, given the privacy risk from addresses, unique identifiers, and financial data mixed into public web content.
The guideline's own text addresses AI developers and service providers generally, with no stated limit to private-sector controllers.
Back to the example · Lint your app
Page updated .