ZDNet Korea 2024-03-04
[Original Article] https://zdnet.co.kr/view/?no=20240304104438
[Issue Diagnosis+] Can Personalized Services and Privacy Coexist?
As artificial intelligence (AI) advances at a faster pace than expected, we enter an era where data becomes the competitiveness and weapon of nations and businesses. This is because of the combination of data and AI, enabling personalized services tailored to individuals. However, there isn't much interest in the protection of personal information, the data provided by individuals.
Currently, it seems that the focus is on collecting and processing data and improving technical capabilities. Can perfect personalized services for individuals and privacy coexist?
As the AI era progresses, the risk of personal information leakage ↑
News about personal information leakage is no longer surprising. In 2014, over 100 million pieces of personal information were leaked from three major credit card companies: NH Nonghyup Card, KB Kookmin Card, and Lotte Card. According to data released by Representative Jung Pil-mo (Democratic Party) of the National Assembly's Science, ICT, Broadcasting, and Communications Committee in 2023, SK Telecom, KT, LG U+, and LG Hellovision received sanctions for leaking personal information from 2018 to 2023, totaling over 480,000 cases.
(Photo=ImageToday)
At the present moment, where there is a greater need for data, the risk of personal information leakage can result in a more significant impact compared to the past. While in the past, personal information was primarily bought and sold for advertising or sales targeting, it has evolved into cases involving financial losses and violations of human rights. This is due to the increasing variety of personal information types, especially video and biometric data. Therefore, there is a growing awareness within the academic community about the need for proactive management and a sense of urgency regarding the risk of personal information leakage.
PIPC responded with voluntary regulations and a pre-assessment system...
The Korean government is also aware of the potential for personal information leakage due to the development of AI. In a work report released on February 15th of this year, they stated, "The rapid advancement of generative AI technology serves as a reminder of the significance of personal information," further emphasizing, "Learning data, which influences the performance of AI, is essential personal information. While social benefits are enjoyed by everyone, we will work to minimize privacy risks."
According to the report, PIPC is to establish guidelines for data that can be used without hindering companies' AI development. The foundation of the 2024 work report is the 'Policy Direction for Secure Use of Personal Information in the AI Era,' announced in August 2023. The PIPC has introduced an advanced self-regulation system to encourage agreement among multiple participants to voluntarily enhance the level of personal information protection. Additionally, they have proposed a pre-assessment system for consulting on the design of data protection processes in development and data processing procedures. If there is uncertainty about compliance with the Personal Information Protection Act in the process of developing AI and related services, companies and the PIPC will discuss it together.
While the industry has reduced legal uncertainty about data usage with guidelines and pre-assessment systems, information subjects are skeptical about these policies. Although the Personal Information Protection Act, which imposes fines on companies that leak information, is being enforced, there are doubts about whether the companies are fulfilling their responsibilities. Moreover, in the event of future leaks, information providers may have to bear the damage individually.
Essential Trusted Personal Information, Notable Zero-Knowledge Proof
As the severity of personal information leaks increases, there is a growing concern about whether it's possible to prevent personal identification while still preserving personal information. At this juncture, the concept of Zero-knowledge proof (ZKP) technology is being mentioned.
When you search for Zero-knowledge proof, it refers to a method where one can prove they know certain information or knowledge to someone else without revealing the actual content to them. For example, when purchasing alcohol at a convenience store, showing your ID card to the cashier without disclosing your name, resident registration number, address, etc., yet still being able to prove that you are of legal age.
zkrypto CEO Oh Hyun-ok.
zkrypto's CEO, Oh Hyun-ok, explained, "Zero-knowledge proof is a cryptographic concept where if there is someone (the information subject) who needs to prove something, they perform a calculation using certain data resulting in outcome A. The verifier knows that if outcome A is achieved, then the value is correct. This is the basic principle of zero-knowledge proof." He further added, "I believe it can be widely applied in areas where privacy is crucial, which is why we initiated research and service development."
He continued, "There is a growing interest in utilizing personal information effectively. Zero-knowledge proof demonstrates the potential to utilize information without revealing personal data." He elaborated, "When using zero-knowledge proof, personal information is erased, and only other information is utilized, ensuring both anonymity and transparency, where the information provided by individuals is genuine rather than false."
Oh emphasized, "It's a technology that allows proving the truth of information while preserving privacy. Hence, it can be applied in domains where trust and privacy are essential." He cited examples such as the Bank of Korea's Central Bank Digital Currency (CBDC) and its integration into elections as instances where zero-knowledge proof could be beneficial.
In November 2022, the Bank of Korea announced the results of the second phase of its pilot research project and outlined its future plans. They discussed the integration of zero-knowledge proof into CBDC. It was envisioned that this integration would enhance the anonymity of CBDC transactions by allowing individuals to prove ownership of the assets without exposing their identity.
CEO Oh Hyun-ok commented on this development, stating, "The blockchain boom was triggered by 'transparency,' but creating services solely based on transparency is challenging due to issues such as personal information leakage." He further remarked, "As we enter the mobile era, just as cloud services have advanced while ensuring the protection of personal information, it is essential to build a blockchain ecosystem that guarantees both transparency and anonymity, facilitating the exchange of reliable data. Therefore, the adoption of technologies like zero-knowledge proof is inevitable."
journalist Son Hee-yeon, kunst@zdnet.co.kr.