The spread of 'Ageotic AI'... Prepare personal information standards

As agent services in which artificial intelligence (AI) works on behalf of users spread, the government has also started to prepare standards for processing personal information. It is judged that practical protection is difficult with the existing method of obtaining consent or conventionally relying only on initial consent whenever AI inquires and utilizes users' personal information between various tools inside and outside the platform.

According to the information technology (IT) industry on the 15th, the Personal Information Protection Committee plans to release a "Ageatic AI Personal Information Processing Guide" (tentative name) and a direction for innovation in the personal information system that improves repeated and formalized consent-oriented regulations such as platforms in line with the AI era.

To this end, the Personal Information Committee formed a "Personal Information System Innovation Task Force" last summer and received national policy proposals. It was pointed out that the practice of pressing the consent button without properly reading the long consent form rather weakens the control of personal information. In addition, new privacy issues of real AI such as robots, drones, and smart glasses are also subject to improvement in international joint research using pseudonym information.

The guidebook tailored to the agentic AI is based on field opinions. At the 'AI Privacy Public-Private Policy Council' held on the 23rd of last month, KAIST Professor Kim Byung-pil announced the results of interviews with 15 domestic and foreign AI development and introduction organizations. Participating organizations cited "prompt injection" that induces unexpected behavior by planting malicious commands in data read by AI and the issue of giving AI more authority than necessary as major risks.

Criteria are already being applied to individual services. Naver's search AI agent "AI Tab" went through a preliminary adequacy review by the Personal Information Commission before its official launch this year.

In May, the Personal Information Commission guided users to easily refuse to use data for personalized answers and imposed conditions on them not to infer or use sensitive information under the law, such as political views and health.

Song Kyung-hee, chairman of the Personal Information Committee, said at the "Global AI Privacy Forum" on the 29th of last month, "If you have asked 'what personal information AI can process', you should now ask 'how much personal information and authority can be entrusted to AI'. "The method of making users click 'agree' step by step does not give users practical control and causes fatigue."

[Reporter Ko Min-seo]