South Korea privacy watchdog flags AI digital textbook privacy gaps
South Korea's privacy watchdog released findings from a preliminary inspection of the AI Digital Textbook system deployed in March 2025, identifying inadequate transparency in how student personal information was collected and protected. The regulator recommended the Ministry of Education and KERIS improve security standards, clarify data processing policies, and ensure information subjects understood how their data was being used.
What happened
The AI Digital Textbook, introduced in March 2025 by South Korea's Ministry of Education and operated by KERIS, collects students' personal information including academic performance and learning history to provide customized educational content.
South Korea's Personal Information Protection Commission (PIPC) conducted a preliminary inspection of the system and published findings on May 15, 2025, identifying gaps in personal information protection measures.
Reported impact
The PIPC found that KERIS inadequately disclosed the categories, purposes, and retention periods of personal information being processed in consent forms and privacy policies, leaving information subjects unaware of how their data was being used.
The system stored student learning data in a centralized learning data repository for future AI-based analysis without clearly stating what personal information was being processed or for what purposes.
Index analysis
The AI textbook met basic security standards including National Intelligence Service security review and cloud security certification, but security controls were focused narrowly on cloud infrastructure.
System integration between the centralized portal and individual development companies presented potential security vulnerabilities that required ongoing monitoring and inspection.
The PIPC noted that security standards and developer guidelines emphasized cloud security at the expense of compliance with data protection law requirements.
Governance controls
The PIPC recommended that the Ministry of Education and KERIS obtain Personal Information Protection Certification (ISMS-P) and ensure security measures met legal standards.
The PIPC recommended that KERIS clarify personal information processing policies and consent forms, explicitly state how personal information was handled, and ensure information subjects could exercise their rights.
The PIPC advised the Ministry of Education to embed data protection law requirements into AI textbook approval standards, guidelines, and post-deployment inspection systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.