South Korea Personal Information Protection Act (PIPA) — AI Provisions: AI Compliance Requirements

Against: Meta Platforms (Facebook/Instagram Korea)

PIPC fined Meta ₩21.6232B for: (1) unlawfully collecting sensitive personal information (political/religious views, same-sex marital status) from ~980,000 Korean users and using it, alongside behavioral data (Facebook likes, ad clicks), to create advertising "topics" tied to sensitive categories, without adequate consent (Meta's broad privacy-policy language was found insufficient); (2) sharing this data with ~4,000 advertisers for targeted ads (including on religious affiliation, gender identity, North-Korean-defector status) without adequate disclosure. R{cycle6}: penalty figure corrected from a rounded "≈$16M" to the precise KRW/USD figures verified this cycle (multiple converging sources). Established that behavioral advertising AI using sensitive categories requires explicit opt-in consent.

Against: ScatterLab, Inc. (Iruda chatbot)

The FIRST case where PIPA was applied to an AI system. PIPC found ScatterLab violated PIPA by using ~9.4 billion KakaoTalk messages from 600,000 users to train its "Iruda" AI chatbot without valid consent (a generic "New Service Development" clause in its terms of service was insufficient for users to anticipate this use). ScatterLab also failed to delete/encrypt personal information (names, phone numbers, addresses), posted AI models on GitHub containing 1,431 messages with identifiable user information (violating pseudonymization requirements), and collected data from 200,000+ children under 14 without parental consent. ScatterLab agreed to implement PIPC's corrective actions. This is the foundational Korean precedent for AI training-data consent requirements — squarely on point for this registry's audience and previously entirely absent.

Against: Kakao Pay Corp. + Apple Distribution International Limited (data transferred to Alipay, an Alibaba affiliate)

Between April-July 2018, Kakao Pay transferred Korean users' personal data (24 categories — phone numbers, email addresses, account balances, and more) to Alipay (an Alibaba affiliate) without proper consent, covering all Kakao Pay users even though only ~20% had registered Apple Pay, to calculate "NSF" (Non-Sufficient Funds) risk scores as part of Apple Pay's payment-evaluation process — affecting ~40 million users. PIPC's most significant remedy: it ordered Alipay to DESTROY the NSF-scoring AI model itself, trained on the unlawfully transferred data — not merely a fine, but deletion of the AI asset built from the violation. This is a directly on-point precedent for this registry's audience: an AI model itself can be ordered destroyed as a PIPA remedy, not just penalized with a fine.

Against: Google LLC + Meta Platforms, Inc.

PIPC's first-ever investigation into behavioral-data collection and use by online advertising platforms, and (at the time) the largest PIPA penalty ever imposed. Google was fined for a 6-year failure to clearly inform users at sign-up that it would collect and use behavioral data for targeted advertising. Meta was fined for a 4-year failure to display mandatory consent-notification information in an easily viewable manner and for not obtaining actual user consent to collect/use behavioral data during Facebook/Instagram sign-up. Directly relevant precedent for AI-driven ad-personalization/profiling systems processing Korean users' behavioral data.