거대 언어모델 인공지능과 개인정보보호: 한국의 사례와 정책

Abstract

In the training of large language model AIs, various data including personal data are used. Users may insert personal data in the AI prompt intently or inadvertently, which may be added to the data base for the AI. This paper analyzes two cases delivered by the Personal Information Protection Commission of Korea (PIPC): The Ruda Lee chatbot and ChatGPT cases. The PIPC imposed a total fine of 100 million Won on ScatterLab, the developer of Ruda Lee, convicting the developer’s liability due to intentional or gross negligence in the collection of personal data through its affiliated services without consent of users. PIPC, however, imposed only 3.6 million Won fine on OpenAI, stating that it cannot investigate and impose fines on some problematic behaviors of OpenAI due to lack of relevant information. This author notes that PIPC had equal information in both cases on the issue of collection of personal data from minors and use of the data in the development of artificial intelligence without consent of data subjects, but punished ScatterLab only. The author also notes that the following characteristics of the case required that PIPC should had taken a softer approach towards ScatterLab. First, the scope of exposed personal data in the Ruda Lee case were minimal (1 address, 3 cell phone numbers) compared to that of the ChatGPT case (the names, email addresses, payment places, last four numbers and expiring dates of credit cards of 687 Koreans) Second, the Ruda Lee case predated the ChatGPT case by two years. Third, ScatterLab is a small company compared to OpenAI. PIPC has rapidly strengthened personal data protection during the last decade and responded to the challenges of the AI era. The Korean AI industry however is in its infancy. PIPA is expected to guide rather than restrict the infant industry.