Binding law — in force
Controllers must explain fully automated (including AI) decisions on request and publish their criteria and procedures (South Korea PIPA)
A data subject may ask for an explanation of a decision a controller made by a fully automated system, including AI (Art. 37-2(2)); the controller must, absent justifiable grounds, provide the explanation (Art. 37-2(3)), and must publish the criteria and procedure of its automated decisions and how personal information is processed so data subjects can easily check them (Art. 37-2(4)). Under the Enforcement Decree, an explanation must be concise and meaningful and give the result, the main types of personal information used, the main criteria including how those types affected the decision, and the procedure (Art. 44-3(2)); a request to have added information considered must be reviewed and answered (Art. 44-3(3)); both within 30 days (Art. 44-3(5)); and the controller must publish on its website that it makes automated decisions with their purpose and the data subjects covered, the main personal-information types and how they relate to the decision, what the process considers and how the data is processed, the purpose and items where sensitive data or a child under 14's data is processed, and how to refuse or request an explanation, in standardised terms (Art. 44-4). Detect an automated-decision service with no published criteria or no explanation handler.
kr-pipa-adm.explanation-and-published-criteria · 개인정보 보호법 제37조의2 (Art. 37-2, rights over automated decisions) · official source · jurisdictions: KR