I. Overview
The Personal Information Protection Commission (the “PIPC”) and the Korea Communications Commission (the “KCC”) announced the key work promotion plan for 2025 on January 13, 2025 and January 14, 2025, respectively. This newsletter summarizes the AI-related aspects of these plans and examines their implications.
II. Main Contents of the 2025 Key Work Promotion Plans of the PIPC and the KCC
1. The PIPC’s Key Work Promotion Plan for 2025
1) Work Promotion Conditions and Directions in 2025
- As AI and digital transformation accelerate, data collection, utilization, and convergence are becoming more widespread. In response, the PIPC has raised concerns over increasing privacy violations and misuse of personal information, which threaten individual rights. Specific risks highlighted include deepfake-generated synthetic content, identity impersonation on social media, and the unauthorized distribution of personal information online.
- While supporting innovation in AI-based industries, the PIPC stresses the need to minimize privacy threats and has outlined its vision as an “era of secure personal information and trusted artificial intelligence.”
- To realize this vision, the PIPC has identified six core tasks :
(i) Innovating the personal information governance framework for the AI era
(ii) Establishing a foundation for innovation in sustainable new industries
(iii) Securing leadership in global personal information standards
(iv) Delivering tangible results in the MyData initiative
(v) Strengthening its role as the control tower for personal information protection
(vi) Building a robust personal information safety net
2) AI-Related Contents in the 2025 Key Work Promotion Plan
① Innovating the Personal Information Governance Framework for the AI Era
- Reforming personal information legislation to align with the AI era
- For AI development cases where pseudonymization alone is insufficient (e.g., autonomous driving AI), the PIPC plans to introduce exceptions that allow the use of original data, subject to PIPC review and approval. This will include mandatory safety measures and post-implementation inspections.
- The PIPC also intends to expand the legal basis for processing personal information under “legitimate interests” or “public interests” to facilitate AI innovation while maintaining privacy safeguards.
- Addressing legal challenges in AI data processing
- To support rapid AI ecosystem growth, the PIPC plans to establish AI and data processing standards across major areas. In 2025, new standards will be developed specifically for SMEs and small business operators, building upon prior regulations on unstructured data, publicly available information, and mobile video footage processing announced in 2024.
- In parallel with legislative reforms, the PIPC aims to bridge the gap between legal frameworks and technological advancements by adopting flexible legal interpretations and regulatory sandboxes.
- In order to solve legal uncertainties for companies, it plans to provide clearer guidance on the application of personal information protection laws in specific business settings by implementing a one-stop window for supporting innovation and a preliminary appropriateness review system.
- Securing user confidence in new technologies
- Expanding the personal information impact assessment AI-related activities in the private sector and providing incentives for voluntary compliance
② Establishing a Foundation for Innovation in Sustainable New Industries
- Developing a legal framework responsive to technological advancements
- Recognizing the unique challenges of video information, where prior consent is often impractical, the PIPC plans to create usage standards and introduce the (tentatively named) Act on the Installation and Operation of Video Information Processing Devices. This legislation will address large-scale video surveillance safety and expand personal rights protections.
- Enhancing biometric data regulations, including the development of processing principles and data subject protection measures to address growing applications of facial and fingerprint recognition technology.
- Promoting AI-driven industries through expanded use of pseudonymized information
- Establishing Personal Information Innovation Zones, enabling flexible and secure pseudonymization for AI research and user convenience.
- Enhancing pseudonymized information support platforms, incorporating capabilities for processing unstructured data (videos, images, and voice recordings), which are critical for AI development.
- Developing a secure AI data infrastructure
- Advancing AI safety and privacy-enhancing technologies (PETs), including the detection and mitigation of various types of personal information risks. This includes research and development of de-identification technologies, privacy vulnerability assessments for large language models (LLMs), and technologies for protecting multi-modal data, such as text, voice, and video. Additionally, efforts will be made to develop solutions for preventing deepfake-related crimes.
- Supporting the establishment of industry standards for personal information protection in key sectors such as AI, autonomous driving, and blockchain, with a focus on leading international regulatory frameworks and ensuring their adoption in domestic industries.
③ Strengthening Global Leadership in AI and Privacy Standards
- Influencing global AI and privacy regulatory frameworks
- Leveraging Korea’s hosting of the GPA Seoul 2025 to drive discussions on global AI privacy standards, ensuring Asia’s perspectives are reflected alongside U.S. and European regulatory frameworks.
- Expanding international cooperation through MOUs, policy sharing, and regulatory capacity-building initiatives for Asian supervisory authorities.
- Enhancing oversight of AI-related privacy risks
- Conducting targeted inspections in high-risk areas for privacy violations, particularly in sectors closely linked to daily life, emerging technologies, and industries heavily reliant on AI. This includes scrutinizing AI-powered services such as virtual assistants and other applications that process large volumes of personal data.
- Performing in-depth evaluations of companies’ personal information processing policies, focusing on approximately 50 companies across key industries, including AI, home IoT, edutech, broadcasting, and telecommunications, to ensure compliance with evolving privacy regulations.
2. The KCC’s Key Work Promotion Plan for 2025
1) Work Promotion Conditions and Directions in 2025
- The KCC recognized that AI and digital technologies are increasingly integrated into all aspects of content production, consumption, and distribution, driving significant innovation across society and the economy. This transformation has enabled easier content creation and distribution while expanding business convergence, as telecommunications providers enter AI and media sectors, and SNS service providers expand into big data, AI, and network-related businesses.
- However, the KCC also expressed concern over the growing risks associated with deepfake videos and AI-generated content, which can be easily produced and widely disseminated through digital platforms. These risks include user harm, as well as the potential distortion of individuals’ free thinking and decision-making due to algorithmic manipulation, confirmation bias, and exposure to false or misleading information.
- In response to these challenges, the KCC has set forth its vision for 2025 as “realizing a trusted and inclusive digital and media society.” To achieve this, it has identified three key policy objectives:
(i) Creating a trusted digital and media environment
(ii) Establishing a dynamic digital and media ecosystem
(iii) Building a people-centered digital and media society
3. AI-Related Contents in the 2025 Key Work Promotion Plan
① Creating a Trusted Digital and Media Environment
- (Establishing a comprehensive plan for protection of AI users) Developing a mid- to long-term AI user protection roadmap, aimed at safeguarding users’ rights and ensuring harmonious AI industry development.
- (Preparing AI user protection regulations) Promoting the enactment of the (tentatively named) AI Service User Protection Act and the development of Generative AI User Protection Guidelines as part of a minimal but necessary regulatory framework to ensure AI user safety.
- (Ensuring the reliability of AI-utilized broadcast) Conducting an assessment of AI-integrated broadcasting content production and establishing guidelines for AI content utilization, aiming to mitigate negative side effects arising from AI-driven transformations in broadcast planning, production, and transmission.
- (Building an AI-related damage relief system) Establishing a centralized platform for reporting, verifying, and addressing risks associated with generative AI, providing one-stop services for damage analysis, consultation, and relief through the Online Damage 365 Center.
② Establishing a Dynamic Digital and Media Ecosystem & Building a People-Centered Digital and Media Society
- (Establishing broadcast innovation strategies) Establishing a vision for next-generation broadcasting that integrates AI, big data, and emerging digital technologies to foster sustainable and innovative industry growth.
- (Enhancing digital literacy and accessibility for vulnerable groups) Expanding education and awareness programs on digital platforms, AI applications, and damage prevention strategies, with a particular focus on the elderly and individuals with disabilities. Supporting digital ethics education for socially vulnerable groups, including low-income children, students with disabilities, and older adults, to help mitigate the risks of digital dysfunction and misinformation.
III. Implications
The 2025 key work promotion plans of the PIPC and KCC are significant as they provide a detailed government roadmap for the protection of personal information and the development of a stable digital and media environment in the AI era. These plans introduce policies that will have direct implications for AI technology development, particularly in areas such as reforming AI-related legal frameworks, expanding data utilization, enhancing user protections, and regulating AI-driven services.
While both agencies recognize the importance of supporting new industries through regulatory innovation, they also emphasize the need for stronger safeguards against privacy violations, deepfake-related harm, and algorithmic abuse. Their approach reflects a dual focus: promoting technological advancement and business growth, while simultaneously ensuring that AI-driven transformations do not compromise user rights or data security.
As the Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation of Trust, Etc., passed earlier this year, does not provide detailed AI user protection measures, the PIPC and KCC are expected to introduce additional safeguards to address privacy concerns and further push for regulatory reforms aimed at preventing AI-related user harm.
Companies that develop AI technology or intend to provide services by using the technology need to closely monitor the enactment and amendment of relevant laws and guidelines, etc. and the implementation trends of each commission. Businesses involved in AI development and AI-powered services should closely monitor upcoming legislative changes, regulatory amendments, and enforcement trends from both commissions to ensure compliance and proactively address potential risks.
[Korean Version]
