South Korea's PIPC to Overhaul Privacy Rules for AI by Year-End

What participants said

In the survey, 29.2% wanted the system rebuilt from its basic framework, while 60.5% preferred keeping the framework and adding rules suited to AI. Experts argued that simply increasing the number of consent requests does not strengthen protection. They also pointed to the limits of today's consent model in AI agent settings, where services combine conversation history with information from outside services.

An online pre-discussion held from October 15 to 29 drew 1,333 people. Of them, 88% said they had clicked through repeated consent requests as a formality, and 94% said clear notice and the ability to refuse at any time matter more than prior consent. Some 90% also backed stricter handling of data that would cause serious harm if leaked and more flexibility for other data.

In the group discussions, 20 of 25 groups (80%) preferred a "notify in advance and stop at any time" approach, provided the right to refuse is firmly guaranteed. The other four groups (16%) favored prior consent each time, citing fears of leaks and misuse and a lack of trust in AI and companies.

Responsibility and next steps

Survey respondents named corporate risk checks and protection duties (75.4%) and government standard-setting and oversight (74.9%) as the most important roles for safe use of data. Questions from the public touched on whether personal data used in AI can be deleted and on how Korean law compares with foreign rules.

The PIPC says it will reflect these views in its reform plan, aiming to protect privacy rights in practice while letting companies and institutions use data responsibly. The ministry will hold a fourth forum on the 26th, on building a society where no one is isolated.