"AI Agents' Access to and Use of Personal Information Must Be Controlled... Common Technical Rules Needed"

Public Forum of the Personal Information Technology Forum
Recommendations to Control Agent Permissions and Establish Common Rules
Cyberattacks: Block Lateral Movement Within Internal Networks After a Breach

It was suggested that a trust-based ecosystem should be developed to support the safe use of artificial intelligence (AI) agents by advancing privacy-protection technologies and establishing common standards.

Song Kyunghee, chairperson of the Personal Information Protection Commission, delivers welcoming remarks at the Personal Information Technology Forum held at the President Hotel in Jung-gu, Seoul, on the 5th. Personal Information Protection Commission.

On November 5, the Personal Information Protection Commission held a public forum for the 4th-term Personal Information Technology Forum at the President Hotel in Jung-gu, Seoul, under the theme “Privacy-Protection Technologies and Safe Use in the Era of Agent and Physical AI.” The forum focused on ways to control AI agents’ access to and use of personal information as they perform tasks on behalf of users.

Professor Choi Daeseon of Soongsil University said that while the focus of privacy protection has shifted from “data” to “behavior,” institutions and technologies have failed to keep pace. He went on to recommend assigning agents their own identities and limiting their permissions and validity periods according to the purpose of their work. “When agents access external systems, they should be required to go through a designated proxy server, and indelible logs should be kept of what information they accessed and transmitted,” Professor Choi said.

Professor Shin Hyeondeok of Hansung University drew attention to the fact that companies and platforms differ in their policies for handling agents’ personal information and in how they verify permissions. He explained that when agents from different companies and platforms connect in an environment where multiple agents collaborate, it should also be possible to verify the purposes for which information is used, delegated permissions and conditions for transferring information. He recommended establishing common technical rules that allow conditions for agents’ use of personal information and their permissions to be expressed and verified in the same way.

Another recommendation was to respond to cyberattacks that are accelerating with AI. Kim Jinguk, CEO of Plainbit, a company specializing in cyber incident response, said, “In the past, attacks were costly, so once attackers succeeded in breaking in, they tried to remain in the system as long as possible and obtain as much information as they could. Now, however, the cost of breaking in again is far lower than the cost of sustaining an attack.” Kim said that, given the faster pace of attacks enabled by AI, organizations should assume attackers may breach their systems, block their movement across internal networks and grant key permissions only to the extent and for the duration required for the work. He also stressed the need for systems to preserve logs and evidence so that the causes of incidents and the extent of damage can be identified quickly.

Song Kyunghee, chairperson of the Personal Information Protection Commission, said, “To support innovation in AI technology while building a trust-based privacy-protection framework, advances in technologies that strengthen privacy protection must complement preventive safeguards.” She added, “We will work to foster an ecosystem for privacy-protection technologies so that companies can use data safely, backed by the public’s trust.”

This content was produced with the assistance of AI translation services.