The Personal Information Protection Commission and South Korea's three mobile carriers agreed to strengthen their cooperation to prevent personal data breaches. They will push for CEO-centered accountability and expanded investment in data protection, and will jointly work on regulatory improvements so that personal data can be used safely in developing and operating artificial intelligence services.
The commission held a roundtable with the chief executives of the three carriers at the Korea Press Center in central Seoul on the 28th to discuss the public-private cooperation plan. It was the first formal meeting between PIPC Chairperson Song Kyoung-hee and the three CEOs — Chung Jae-hun of SK Telecom, Park Yoon-young of KT and Hong Beom-shik of LG Uplus — since she took office.
"Protecting personal data in the telecommunications sector is about safeguarding people's daily lives and trust in a digital society," Song said in her opening remarks. "We must shift to a prevention-focused protection system that identifies risks in advance and responds preemptively." She also urged the companies not to leave data protection to a single department, but to treat it as a core management task overseen directly by the CEO.
In a "Joint Declaration for an AI and Digital Society That Citizens Trust," the three carriers said they would make personal data protection their top management priority. Specifically, they pledged to establish an accountability structure centered on the CEO and the board, expand investment and specialist staffing in data protection, embed privacy protection into the development and operation of AI services while ensuring transparency and accountability, and broaden development of privacy-enhancing technologies (PET).
"In line with the shift toward a prevention-focused protection system, SKT is carrying out 700 billion won ($500 million) in information security investment over five years," Chung said. "We have made 'privacy first' a working principle for all employees, and we are changing our culture so that data protection is the starting point of our work, from service planning through development and operation."
"KT has made personal data protection its top management principle and is investing 2.2 trillion won ($1.57 billion) over five years to fix the fundamentals of security, including the IT modernization that underpins it," Park said. "Together with a privacy advisory committee made up of outside experts, we will continue to review and upgrade how well we are carrying out the shift to a prevention-focused system."
"All of our executives, including the CEO, will strengthen our preventive protection system," Hong said. "We will design a data protection framework into every stage of our services — what is called 'privacy by design.'"
The roundtable also covered overhauling internal controls to prevent a recurrence of breaches, tightening management of telecom distribution networks and training specialists. The commission asked the carriers to conduct self-inspections and staff training in line with the amended enforcement decree of the Personal Information Protection Act, which took effect on the 11th, and to strengthen oversight of their distribution networks. The two sides also agreed to cooperate on developing privacy-enhancing technologies and on training specialists in data protection and cybersecurity, including through the selection of students for contract-based university programs.
The participants also discussed regulatory changes to support AI innovation. Industry representatives asked the commission to set up a prior-consultation system so that the AI exemptions introduced earlier can work effectively. The commission said it is drawing up plans for operating the exemptions in a way that offers practical help to data-driven research, and that it will continue to gather input from the field as the system operates.
Industry representatives also said there was a need to clarify standards for using publicly available and pseudonymized data in AI development and for processing personal data on the basis of "legitimate interest," and to improve the related rules. They also called for guidelines on AI agents that reflect how companies actually handle personal data. The commission said it will pursue the related regulatory changes and plans to produce a tentatively titled guide on personal data handling by agentic AI within this year.
The three carriers also proposed a public-private communication channel to respond quickly to personal data issues. The commission said it would work with industry to remove unreasonable regulation and regulatory uncertainty and to support corporate AI innovation.
"I hope today's joint declaration by the three carriers' chief executives leads to real change and improvement on the ground," Song said. "The commission will also continue to conduct inspections and provide the regulatory support needed so that people's personal data can be protected more securely."
