(Seoul = Yonhap News) Reporter Cha Min-ji = Should artificial intelligence (AI) obtain user consent every time it uses personal information, or is it enough to notify users in advance and allow them to refuse at any time?
As the use of personal information becomes routine due to the development of AI technology, citizens are putting their heads together on how to improve the existing prior consent-centered system.
The Ministry of Public Administration and Security and the Personal Information Protection Committee held the 3rd 'Everyone's Debate' on the 1st at Baekyangnuri, Yonsei University, Seodaemun-gu, Seoul, under the theme 'How to protect and utilize personal information in the AI era.'
About 200 citizens and experts selected through open recruitment attended the debate.
Song Kyung-hee, Chairman of the Personal Information Protection Committee, Kim Min-jae, Vice Minister of Public Administration and Security, Lee Hae-min, Senior Secretary to the Blue House for AI Future Planning, and Senior Secretary to the President for Intelligence and Integration Jeon Seong-hwan also attended and listened to the public's opinions.
The current Personal Information Protection Act allows personal information to be processed if certain requirements are met, such as fulfillment of contract, statutory obligations, and legitimate interests of the personal information processor, in addition to the consent of the information subject.
However, in an environment where AI connects multiple services to fulfill user requests, problems that are difficult to solve using only existing personal information processing standards may arise.
For example, when you ask an AI assistant to make a restaurant reservation, the AI must transmit the user's name, phone number, reservation time, etc. to the external reservation platform or restaurant.
At this time, there are conflicting opinions as to whether the mere fact that a user has requested a reservation can be seen as allowing the provision of personal information, or whether separate consent must be obtained each time information is passed on to another company.
Those who value prior consent argue that the information subject must personally check where and how their information is used and decide whether or not to allow it.
On the other hand, there is also a view that repetitive consent procedures can actually weaken users' real choice.
If the consent screen appears too frequently, users may press the consent button perfunctorily without fully checking the contents.
Accordingly, in cases where there is a legally reasonable and justifiable basis, an opinion was also presented to inform users in advance of the purpose and content of personal information processing and to allow users to refuse or stop processing at any time if they wish.
However, this method also has limitations in that it is difficult to properly exercise control over personal information if the user cannot confirm prior information or the refusal process is complicated.
Even in actual group discussions, there were mixed opinions on how to handle personal information.
One group of presenters who preferred prior consent said, “It seems that our society does not yet have a strong level of trust in AI or the use of personal information,” and added, “I think it would be good to proceed in a way where we can notify people in advance and discontinue it while trust is secured.”
A presenter from another group expressed concern, saying, “Among the information we give to AI, there is more sensitive information than we think,” and added, “As the scope of information use is so wide, the scope of abuse is also wide, making it difficult to predict to what extent it will be used.”
On the other hand, one group of presenters who preferred the prior notice-and-reject method said, “We cannot keep up with the speed of industrial development and AI processing,” and added, “I think there are advantages in terms of data utilization structure and national technological development.”
Another group's presenter preferred the prior notice-and-refusal method considering convenience in the AI era, but emphasized that "legal and institutional safety measures must be supported."
The debate on this day also included discussions on the roles of companies, governments, and citizens in protecting personal information.
Kim Do-seung, a professor at Chonbuk National University Law School, emphasized, "In order to effectively guarantee an individual's right to self-determination, not only must companies take responsibility for the legality and safety of personal information processing, but the state must also establish and effectively operate a system to prevent risks and remedy rights violations."
The government plans to use public opinions and expert suggestions from the debate to review policies to improve the personal information system in the future.
Song Kyung-hee, Chairman of the Personal Information Protection Committee, said, "Now is the time to fundamentally redesign the personal information protection system so that personal information can be used safely and properly protected for the benefit of the people in line with the changed environment of the AI era. We will do our best to ensure that the results of deliberation lead to actual system improvement."
Jeon Seong-hwan, Senior Secretary to the Blue House for Listening and Integration, also said, "It is expected that numerous personal information issues will emerge in the AI era," and added, "We will collect the valuable opinions and thoughts you have given us today and reflect them in our policies."
