Shin & Kim LLC discussed personal data protection and artificial intelligence (AI) security response measures for online shopping corporations with the Korea Online Shopping Association.
Shin & Kim LLC said on the 16th that it co-hosted a seminar titled “Personal data protection and incident response strategies for online shopping corporations in the AI era” with the Korea Online Shopping Association at D Tower in Jongno-gu, Seoul, on the 15th.
Choi Gwang-hee, a senior advisor at Shin & Kim LLC who gave the first presentation, cited evidence preservation, reporting and notification within statutory deadlines, and routine checks of incident response systems as the top items that corporations should prioritize when a cyber incident occurs.
Choi noted that as AI advances accelerate the pace of cyberattacks, there are limits to preventing all incidents in advance, and said a response system that can minimize the spread of damage after an incident occurs should be established in advance. Choi added that it is necessary to check, through drills that assume real incident scenarios, whether response procedures operate properly.
Attorney An Jeong-ho of Shin & Kim LLC explained the obligations of and regulatory changes for online shopping corporations following recent revisions to the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection. An pointed out that while corporations’ duties for preventive measures are being strengthened, the level of sanctions such as the penalty surcharge after incidents is also increasing.
An emphasized that personal data protection and information security should not be confined to the work of individual departments, and said the entire organization, including management, should reexamine internal control systems and incident response procedures.
New security risks stemming from the spread of AI agents were also discussed.
Professor Choi Dae-seon of Soongsil University said the automation of cyberattacks using AI is reducing the time and expense required for attacks, and explained that in addition to external attacks, the permissions and data access of AI agents used inside corporations must also be managed.
Choi said AI agents may act contrary to a corporation’s intent or expose personal data externally, and noted that complete control is difficult with only access restrictions or human preapproval. Choi suggested that it is necessary to establish a system to record and continuously review what tasks AI agents actually perform and what information they access.
Lee Tae-hee, a senior advisor at Shin & Kim LLC, said, “The online shopping industry connects a variety of stakeholders, including consumers, sellers, and platforms, so if a personal data leak or incident occurs, the impact can spread widely,” and added, “Corporations need to substantively examine their personal data protection and cybersecurity response systems.”
※ This article has been translated by AI. Share your feedbackhere.
