“Is it okay for everyone to have their Ghibli profile leaked?”... ChatGPT and privacy infringement

Q&A with Kim Tae-hwan, attorney specializing in intellectual property rights at Daeryun Law Firm

These days, it's popular to create Ghibli-style profiles with ChatGPT. The cute and warm illustrations make you smile the moment you see them, but it can also be scary to think that artificial intelligence (AI) can learn the original photos and use them for other purposes. Since its launch in November 2022, generative AI ChatGPT has consistently raised issues related to personal information management. This is because AI learns and stores personal information when using the service, so there is no freedom from privacy infringement issues.

Problems with personal information protection arise during the AI ​​learning process. AI learns patterns, structures, and arrangements while processing unstructured data such as text and images. At this time, the AI ​​may not be aware that resident registration numbers, addresses, health information, etc. are sensitive personal information. Therefore, information may be exposed in the process of memorizing and reprinting learned information. Due to these factors, there is a possibility that personal information may be leaked or the rights of the information subject may be violated.

We listened to a lawyer specializing in intellectual property rights about legal issues and countermeasures related to this. This is a Q&A exchange with Kim Tae-hwan, a lawyer specializing in intellectual property rights at Daeryun Law Firm.

▶ If an AI model learned and used individual information, could it be a violation of the Personal Information Protection Act?

If an AI model learns and utilizes an individual's personal information, this may become a problem as a violation of the Personal Information Protection Act. According to the Personal Information Protection Act, a legitimate legal basis is essential for collecting, using, and providing personal information. Article 15 of the Personal Information Protection Act stipulates that the consent of the information subject or legal requirements must be met when collecting and using personal information.

Articles 15 and 17 of the same Act restrict the use or provision of personal information for purposes other than those intended. The problematic part in this case can be seen as ‘consent of the information subject.’ In order to process personal information, the consent of the data subject must be obtained first. However, if the personal information included in the data learned by the AI ​​model is already public information, there may be cases where it can be processed without consent, so review is necessary.

Another issue depends on how to recognize the legitimate interests of the personal information processor. The purpose of processing personal information must be based on reasonable and legitimate business needs, and the purpose must be assessed as having priority over the rights or interests of the information subject.

In other words, no matter how great the personal information processor's interests are, if personal information is used in a way that causes excessive infringement on the information subject or in a way that the information subject does not expect, 'legitimate interest' is not recognized. In this situation, if personal information is used for AI learning or secondary use, the likelihood of violating the Personal Information Protection Act increases.

Personal information provision notice font is illegal even if it is too small

▶ With the development of science and technology, problems with personal information processing are increasing. If you have suffered personal information leakage, what are your countermeasures?

Legal measures that can be taken to respond to damage from personal information leaks include fines or surcharges from administrative agencies, civil damage claims, and criminal charges. In fact, representative lawsuits related to AI have not yet been conducted in Korea, making it a difficult issue. As for issues related to personal information, the Homeplus case (Supreme Court decision 2016Do13263, sentenced on April 7, 2017), a representative criminal case, can be cited as an example. This is an incident in which the notices under Article 15 of the Personal Information Protection Act were not properly implemented in the process of collecting and providing personal information for the sweepstakes, and the provisions of Article 17 of the Personal Information Protection Act were also not properly followed.

In particular, the notice on provision of personal information was written in small letters, making it difficult for consumers to fully read and agree. This violates the legal requirement that clear notice and consent must be provided in the process of obtaining consent from the information subject. In the end, Homeplus and the person in charge were held criminally responsible in accordance with Article 72, Paragraph 2 and Article 59, Paragraph 1 of the Personal Information Protection Act. This case is a violation of the Personal Information Protection Act due to 'lack of consent' and 'unclear notice', and can be said to be an important precedent that sets legal standards for similar cases in the future.

▶ In the case of AI service providers that are personal information processors, what strategies should they develop to comply with related laws such as the Personal Information Protection Act?

The process of an AI model learning and using personal information has the potential to violate personal information protection laws. Therefore, AI developers and service providers must clarify legitimate legal grounds and thoroughly ensure safety and guarantee the rights of information subjects. Even when processing personal information disclosed in accordance with the Personal Information Protection Act, the legal basis and safety standards must be complied with, and it is important to clearly obtain consent from the information subject.

A specific consent procedure must be established and thoroughly managed to ensure that personal information is not used or provided for purposes other than the purpose for which it was processed. Safety measures must also be strengthened to prevent personal information leaks. Ensuring safety must include technical, managerial, and physical measures related to establishing an internal management plan and keeping access records, as specified in Article 29 of the Personal Information Protection Act.

[View full article]
"Is it okay for everyone to leak the original Ghibli profile?"... Chat GPT and personal information infringement (link)