South Korea National Assembly nears floor vote on PIPA amendment permitting non-consensual use of personal data for AI training

A bill amending South Korea's Personal Information Protection Act (PIPA) — approved by the National Assembly's Political Affairs Committee on 14 May 2026 and cleared by the Legislation and Judiciary Committee on 29 July 2026 with bipartisan support — is one plenary floor vote away from passage, expected as early as mid-August 2026 per IAPP reporting (published ~Aug 12-13, 2026). The new special provisions (draft Articles 28-12 through 28-15) would for the first time let data controllers use personal data — including original, non-pseudonymized data — for AI development and performance improvement without the data subject's consent and beyond the original collection purpose, subject to case-by-case approval by the Personal Information Protection Commission (PIPC). Four conditions must be met: anonymization/pseudonymization must be insufficient; safeguards must be in place; the purpose must serve public interest/data-subject protection/social benefit; and infringement risk must be markedly low. The law would take effect six months after promulgation.

This is a structural shift in Korea's data protection regime, moving the boundary-setting decision on AI training-data use from legislation to regulator discretion (PIPC case-by-case approval). It materially expands what AI developers in South Korea can use as training data without consent — directly affecting any company training AI models on Korean personal data. It arrives just as South Korea's Board of Audit and Inspection found significant quality failures (908 datasets, widespread annotation/file-matching errors) in the government's existing $1.1B AI training-data program, raising oversight-capacity concerns about the same agencies (MSIT, PIPC) that would administer the new consent-bypass regime.

AI developers and deployers using or planning to use Korean personal data for model training should monitor the floor vote (expected mid-August 2026) and prepare to apply for PIPC case-by-case approval under the new Articles 28-12 through 28-15 once the law is promulgated and takes effect (six months after promulgation).