South Korea PIPC v. ScatterLab: First AI Training Data Consent Case in Asia

Summary

In the first application of South Korea's Personal Information Protection Act to an AI system, the PIPC found ScatterLab used roughly 9.4 billion KakaoTalk messages from 600,000 users of its other apps to train its "Iruda" chatbot without explicit consent, exposed personal data on GitHub, and collected data of over 200,000 children under 14 without parental consent.

Details

• Violation: Eight PIPA violations — unlawful data collection, child data, data exposure
• Penalty: KRW 103.3 million (~USD 93,000) plus corrective orders
• Framework: South Korea PIPA
• Status: Enforced (August 2021)

Key Takeaways

1. First case applying PIPA to an AI system in Asia
2. AI training data collection requires explicit consent under Korean law
3. Children's data in AI training requires parental consent
4. Exposing AI training data on public repositories is a violation