en.Wedoany.com Reported - The Personal Information Protection Commission (PIPC) recently released the "Third Basic Plan for Personal Information Protection (2027-2029) to Promote Trust-Based Artificial Intelligence Innovation," aiming to shift the personal information protection system from a post-sanction-oriented approach to a prevention-centered one, in response to the reality of increased data utilization demand and the risk of large-scale leaks in the era of artificial intelligence.

The basic plan was released as a joint agenda item at the Economic Relations Ministers' Meeting on the 3rd, covering four major strategies and 12 implementation tasks. According to the plan, the personal information protection system will shift from uniform regulation to a principle centered on risk proportionality, eliminate on-site uncertainty by operating an "AI Transformation (AX) Peace of Mind Support Center," and establish data linkage hubs at key points nationwide. The second phase of MyData will be promoted to build infrastructure for solving social challenges such as welfare and healthcare. The plan also includes establishing a rights protection normative system adapted to the proliferation of autonomous and physical AI, as well as advancing institutionalization to prevent deepfake data tampering.

In terms of prevention, the plan upgrades the regular inspection system by applying AI technology to information protection and the Personal Information Protection Management System (ISMS-P). Companies that make preemptive protection investments will receive discounts on fines for leak incidents, while enhancing the responsibility of representatives and the status of Chief Privacy Officers (CPOs). For violations, the plan introduces compulsory performance fines, establishes new criminal penalties for illegal distribution, provides customized consulting and recovery support for small and medium-sized enterprises, rebuilds resilience infrastructure, and cultivates specialized talent.

The whole-of-government cooperation system and cross-border data transfer network will also be upgraded. In the communications, education, and employment sectors, joint management with competent authorities will be implemented, and an early warning system will be established. Through cooperation with regulatory bodies such as those for finance and fair trade, overlapping regulations will be reasonably adjusted. Building on the Korea-EU mutual equivalence framework, the data transfer network will be diversified to include the UK, Japan, and the US. Cross-border transfer methods will be expanded to include Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs), and a new cross-border transfer impact assessment will be introduced to manage risks in parallel. Additionally, the plan aims to establish a one-stop rights remedy system linking infringement reporting to damage compensation, promote rapid compensation through the construction of an AI-based personal information management platform and the introduction of a damage recovery consent resolution system. Regulations on sensitive information such as video and biometric data will be improved, and the protection system for children and adolescents will also be strengthened.