Chapter 2. Evaluations, Interviews, and Automated Decisions

Learning objectives

• Define an "Automated Decision" under the Personal Information Protection Act (PIPA), and distinguish between fully automated decisions and decisions substantially reviewed by a human.
• Distinguish the requirements and exceptions for the right to refuse, the right to request an explanation or review, and the obligation to disclose standards and procedures, and select the necessary procedures for each recruitment stage.
• Design a procedure to handle an applicant's request for refusal, explanation, or review within the statutory deadline.
• Formulate questions to verify the validity and explainability of AI interview and evaluation tools, and provide reasonable accommodation to applicants with disabilities.
• Explain the high-impact areas (recruitment) and operators' responsibilities under the AI Basic Act, and select items to verify with vendors.
• Design review methods so that human review does not remain a mere formality.

Introduction

Suppose that in an open recruitment drive, an AI competency assessment automatically eliminated the bottom 40% of applicants. The next day, an email arrived from an eliminated applicant: "Please tell me why I was rejected." The HR team weighed three possible responses: replying that the model is a trade secret and cannot be disclosed, using a boilerplate phrase stating that "a comprehensive evaluation was made," or providing an explanation that individually laid out the results and criteria. Which was correct? And would the answer differ if a human had read all original texts and made the decision, as in the same company's recruitment for experienced hires?

The core of this chapter is distinguishing between "AI was involved" and "AI made the decision." The Personal Information Protection Act gives data subjects special rights regarding decisions made by fully automated systems. If a decision was substantially determined by a human, it might not be subject to those rights, but in return, whether the human's judgment was truly substantial becomes a new question.

First, we outline the definition of an Automated Decision, its determination factors, and the three rights and their exceptions. Next, we cover the procedures for disclosure and handling requests, as well as the conditions for a good explanation. After that, we look at the validity, explainability, and accessibility of AI interview and evaluation tools, and examine the significance of the AI Basic Act designating recruitment as a high-impact area. Finally, we cover designs that make human review genuinely substantial.

Key concepts

Definition of an Automated Decision

Article 37-2 (1) of the Personal Information Protection Act defines an Automated Decision as "a decision made by processing personal information through a fully automated system (including systems applying artificial intelligence technology)." Automatic dispositions by administrative agencies pursuant to Article 20 of the Framework Act on Administration are excluded.

This definition can be read as consisting of three constituent elements and one scope exclusion. (1) It must be a fully automated system. Because artificial intelligence systems are merely "included" and the definition is not limited to them, rule-based programs are also covered if they are fully automated. (2) It must process personal information. (3) It must be a decision. Unlike simple provision of information or recommendations, a judgment must be rendered concerning the data subject. And as a scope exclusion, automatic dispositions by administrative agencies are excluded here.

A representative example in recruitment is a feature that finalizes the rejection of low-scoring applicants without human review. Conversely, if an AI summarizes applications and the person in charge reads the original text to determine whether an applicant passes or fails, it is a human who made the decision.

The boundary between full automation and human-reviewed decisions

The boundary is not always clear. If the person in charge merely clicks a "batch approve" button on a screen, can that be considered a decision made by a human? Article 6 (1) of the Personal Information Protection Commission Notification, "Standards for Measures by Personal Information Controllers Regarding Automated Decisions," requires comprehensive consideration of all of the following matters when determining whether a decision constitutes an Automated Decision:

1. Whether the decision was made by a fully automated system without substantial and meaningful intervention by a human with legitimate authority
2. Whether the system extracts meaningful information through individual processing steps, such as analyzing and processing the personal information of the data subject
3. Whether, as a decision made by a personal information controller, it affects the rights or obligations of the data subject
4. Whether the decision is a final decision affecting rights or obligations
5. Whether there is a substantial relationship between the system's processing of personal information and the decision
6. Whether special provisions exist in other statutes

The first element is the most important in practice. The mere fact that a person pressed a button is insufficient; the key is whether that person had the authority to change the outcome and actually conducted a review.

Three rights and exceptions

The rights and obligations granted by Article 37-2 must be divided into three parts to be read accurately.

The most common point of misunderstanding is that exceptions apply only to the right to refuse. If an applicant consented to the processing, including the AI evaluation and automatic elimination, the right to refuse falls under an exception, but the right to request an explanation or review and the company's disclosure obligation remain intact. The judgment that "since consent was obtained, no procedures are required" is incorrect. The Personal Information Protection Commission explains this exception as applying when the fact that an Automated Decision will be made was clearly notified in advance through consent, contract, etc., or where there are clear provisions in statutes (press release dated September 26, 2024). Because there may be dispute over whether item 4 (the process of concluding a contract) applies to the application stage, it is safer to clearly specify the fact and scope of the Automated Decision in the consent form.

When a data subject refuses or requests an explanation, etc., the personal information controller must, unless there are justifiable grounds, take necessary measures such as not applying the Automated Decision, reprocessing it through human intervention, or providing an explanation (Paragraph 3).

Determining significant impact

The right to refuse arises when there is a "significant impact." Article 6 (2) of the Commission Notification requires comprehensive consideration of the following: whether it is a right or obligation related to human life or bodily safety; whether a right is stripped or rendered impossible to exercise; whether an obligation exceeding normally acceptable limits is imposed; whether continuous restrictions on rights or obligations arise; and whether there is a possibility of recovering to the pre-impact state or avoiding the impact.

Elimination from recruitment is a decision that results in the loss of that employment opportunity at the company, making it a representative scenario where whether a significant impact exists must be carefully scrutinized. However, because the conclusion depends on the specific facts, it is advisable for a company to document in writing its determination regarding these five elements for each recruitment stage. If an explanation is requested regarding an Automated Decision that does not have a significant impact, the company may, pursuant to the proviso of Article 44-3 (2) of the Enforcement Decree and Article 4 (3) of the Notification, concisely provide information by selecting from the matters disclosed in advance the relationship between the major types of personal information and the decision, the considerations, and the processing procedures.

Matters that must be disclosed in advance

Article 37-2 (4) requires the standards and procedures for Automated Decisions and the manner in which personal information is processed to be disclosed so that data subjects can easily verify them. Article 44-4 (1) of the Enforcement Decree specifies the matters to be disclosed via an internet homepage or other means:

1. The fact that an Automated Decision is being made, its purpose, and the scope of targeted data subjects
2. The major types of personal information used in the Automated Decision and their relationship with the Automated Decision
3. The considerations in the Automated Decision process and the procedures through which major personal information is processed
4. Where sensitive information or personal information of children under 14 years of age is processed, the purpose and specific items
5. The fact that the data subject may make a request for refusal, explanation, etc., and the methods and procedures therefor

When making disclosures, standardized and systematized terminology should be used, and visual methods such as videos, pictures, or diagrams may be utilized (Paragraph 2). Disclosure does not mean releasing the source code or raw training data. It is sufficient if it reaches a level where an applicant can understand "based on what, and how, they are being evaluated." Organizing these five items onto a single screen on the recruitment website's application guide page is the starting point in practice.

Procedures for handling requests received

Requests by data subjects are made in accordance with the methods and procedures established and disclosed by the personal information controller (Enforcement Decree Article 44-2). The measures to be taken differ depending on the type of request.

Deadline. Measures must be taken in writing or through similar methods within 30 days from the date of receiving the request. If there are justifiable grounds making it difficult to process within 30 days, that reason may be notified and the deadline extended up to two times, by up to 30 days each (Enforcement Decree Article 44-3 (5), Notification Article 8 (1)).

Rejection. When rejecting a request on justifiable grounds, such as concern over unjustifiably infringing upon another person's life, body, property, etc., the reason must be notified without delay in writing or through similar methods (Enforcement Decree Article 44-3 (4)), and Article 8 (2) of the Notification requires notifying the reasons for rejection and the methods and procedures for raising an objection within 10 days from the date of receiving the request, unless there are justifiable grounds. Justifiable grounds are determined on a case-by-case basis by weighing the disadvantage to the data subject against the interests of the controller or third parties (Notification Article 7 (1)).

Stating the processing procedure in practical operational order yields the following:

1. Verify whether the request was submitted through the disclosed method and whether the requester is the person in question.
2. Classify the type of request (refusal, explanation, review, or a combination thereof) and record the processing deadline.
3. Compile the details of the decision regarding the applicant (the outcome, major types of personal information used and their impact, and processing procedures), or review whether the submitted opinions can be reflected.
4. Draft an explanatory statement or review findings and have it reviewed by a responsible manager. If there are grounds for rejection, manage the deadline for rejection notification separately.
5. Dispatch it within the deadline in writing or through similar methods, and retain processing logs to reflect them in subsequent audits.

Conditions for a good explanation

The Enforcement Decree requires a "concise and meaningful explanation," and the Notification instructs controllers to select meaningful information for data subjects and provide it in an easily understandable manner. There are two bad extremes. One is boilerplate phrasing such as "The AI comprehensively evaluated multiple factors." It lacks individual results and criteria, failing to serve as an explanation. The other is presenting model weights or hundreds of feature values verbatim. There is a lot of information, but it is meaningless.

Trade secrets or the security of test items can serve as reasons not to disclose source code, weights, or raw test items, and can also provide grounds for calibrating the depth of an explanation. However, to reject an individualized explanation altogether on these grounds, one must individually balance the disadvantage to the data subject against the interests of the controller as specified in Article 7 of the Notification, and if rejected, the reasons and the method for filing an objection must be notified. Responding to every request with the same boilerplate phrase means this balancing was never performed.

Validity of AI interview and evaluation tools

Scores used in hiring evaluations must have objective evidence that the score is related to job performance. The NIST AI RMF, a voluntary risk management framework, defines validation as "confirmation, through the provision of objective evidence, that the requirements for a specific intended use or application have been fulfilled" (citing ISO 9000:2015), and cites "Valid and Reliable" as the first characteristic of trustworthy AI. MEASURE 2.5 in the Core calls for demonstrating that deployed AI systems are valid and reliable.

Validity is not an intrinsic property of a tool, but is confirmed with respect to specific jobs and applicant pools. A study conducted on overseas university graduate entry-level office workers cannot be transferred as-is to domestic experienced maintenance technicians. When receiving vendor materials, ask three questions: What was the relationship demonstrated with (actual job performance, or scores on another test)? What were the jobs and applicant pools? How large was the sample size, and what were the group-level results? If internal data exists, re-verify using your own organization's jobs. The validity of selection tools is commonly examined across correspondence with job content (content validity), relationship to actual performance (criterion-related validity), and whether it actually measures the trait it purports to measure (construct validity).

Even for scores whose validity has been confirmed, group-level results must be reviewed separately (Chapter 5). In particular, features that infer internal traits such as 'Stress Tolerance', 'Emotional Stability', and 'Friendliness' from overt signals like facial expressions or voice tremors require rigorous scrutiny of their evidentiary basis. Because such emotion- and internal-state estimation features often have weak scientific grounding, make it the default not to adopt them unless there is validation data appropriate for the specific job and applicant pool. The weaker the grounding of a number, the more it sways human judgment. Lowering its weighting or displaying it "for reference only" is not a solution. As long as it influences the decision, the validity problem remains intact. Nor does applicant consent establish the validity of a score. Furthermore, examine the fact that reflecting appearance-related cues in scores can result in introducing physical appearance criteria not required for the job into the evaluation (Article 7 (2) of the Equal Employment Opportunity and Work-Family Balance Assistance Act).

Explainability and interpretability

The NIST AI RMF distinguishes explainability as a representation of the underlying mechanisms of the AI system's operation, and interpretability as the meaning of the output in the context of its designed purpose. It also states that accountability presupposes transparency.

What a Recruiter primarily needs is interpretability. One must be able to answer "What does this score mean regarding this applicant?" to explain it to the applicant. Prior to adoption, request that the vendor provide an actual sample sentence answering: "If this score were explained to a single applicant, what sentence would it be?" A tool that cannot formulate that sentence will struggle to satisfy the explanation required by law.

Accessibility and reasonable accommodation

AI interviews often mandate formats such as voice, video, and time limits. The Act on the Prohibition of Discrimination against Persons with Disabilities regards the refusal to provide reasonable accommodation to persons with disabilities without justifiable grounds as discrimination (Article 4 (1) 3), and prohibits employers from discriminating against persons with disabilities in recruitment and hiring (Article 10 (1)). Reasonable accommodation refers to human and material means and measures—such as convenience facilities, equipment, tools, and services—taking into account the type, degree, and characteristics of the disability so that persons with disabilities can participate in the same activities on an equal basis with persons without disabilities (Article 4 (2)).

If an applicant with a hearing impairment requests an alternative method instead of a voice interview, and verbal communication is not an essential requirement for that job, the established principle is to provide written responses or a sign-language interpreted interview that assesses the same competencies, and score them using the same competency evaluation rubric applied to other applicants. Because algorithms that read vocal features cannot be used for alternative formats, scoring procedures tailored to the alternative format (e.g., rubric scoring by trained evaluators) must be established in advance. Disproportionate burden, substantially difficult circumstances, or inevitability due to the nature of performing a specific job may constitute justifiable grounds (Article 4 (3)). Verifying what alternative methods the vendor supports during the procurement contracting phase ensures you will not be caught unprepared during the selection process.

High-impact areas and recruitment under the AI Basic Act

Article 2, Item 4 of the AI Basic Act defines high-impact artificial intelligence as AI systems that have a significant impact on, or pose a concern of causing risk to, human life, bodily safety, and fundamental rights, and are utilized in enumerated areas. Sub-item (g) is "determinations or evaluations that have a significant impact on an individual's rights and obligations, such as recruitment or loan screening." Both requirements are examined together: belonging to the enumerated area and having a significant impact or concern of risk. Even within recruitment operations, interview scheduling is not a determination or evaluation and is therefore far removed from this sub-item.

The obligations under this Act fall upon AI business operators. The Act defines business operators as developer business operators who develop and provide artificial intelligence, and deployer business operators who provide AI products and services using artificial intelligence provided by developer business operators (Article 2, Item 7); it defines those who receive products and services as users (Item 8), and those whose life, bodily safety, or fundamental rights are significantly affected thereby as affected persons (Item 9). An HR solution company selling hiring evaluation services to corporate clients is a business operator. The status of a company that uses that service for its own internal hiring can be determined differently depending on what is provided to whom, so this should be clarified through legal review at the time of adoption.

What is practically important for a Recruiter is the vendor checklist. Prior to contracting, verify whether the tool's classification as high-impact has been reviewed, what the explanation measures and human supervision/oversight plans under Article 34 are, and where the supervisor's contact details are posted. Article 27 (4) of the Enforcement Decree allows deployer business operators to request materials necessary to fulfill their responsibilities from developer business operators, and developer business operators must endeavor to cooperate.

Designing meaningful human review

The mere formality of a human making the final decision guarantees nothing on its own. When an AI score appears at the very top of the screen, the reviewer's judgment is drawn to that number. The tendency to overly trust and follow the outputs of an automated system is called automation bias, and the tendency for judgment to be anchored to a number seen first is called the anchoring effect; the two easily manifest together. The NIST AI RMF recommends policies delineating roles and responsibilities between humans and AI (GOVERN 3.2) and managing operator proficiency (MAP 3.4).

The specific conditions determine which countermeasure to choose. If there is time to read all original texts, having evaluators assess first with scores blinded is the most robust method. If time is lacking, having evaluators verify the rationales against the original text is practical. If the score itself has not been validated, use AI only for objective tasks such as verifying eligibility criteria, and leave qualitative content evaluation to humans.

Going deeper

What consent resolves and what it does not resolve

Consent is a powerful but limited tool. Under the proviso to Article 37-2, Paragraph 1 of the Personal Information Protection Act (PIPA), an Automated Decision based on consent constitutes an exception to the right to refuse. However, there are three things that consent does not resolve. The right to request an explanation or review and the obligation of disclosure remain. Consent cannot serve as evidence that scores are related to job duties. And imposing disadvantages on applicants who do not consent effectively becomes coercion. If the evaluation method diverges depending on whether consent is given, the fairness of comparing applicants against the same criteria is also undermined.

There is another point to keep in mind. For the exception to the right to refuse to apply, the decision must be made "pursuant to" consent. Because consent to the collection and use of an application may not be the same as consent to automated AI evaluation and rejection, the fact that an Automated Decision is being made and its scope must be clearly stated in the consent form.

Recruitment agencies and the accountability of Automated Decisions

If document screening is entrusted to a recruitment agency and the agency executes automated rejections using its own AI, who provides the explanation? Article 26 of the Personal Information Protection Act (PIPA) requires an entruster to educate and supervise a trustee, and Article 26, Paragraph 8 applies provisions including Article 37-2 mutatis mutandis to the trustee as well. This means neither the entruster nor the trustee can escape responsibility. Unless the entity responsible for disclosure, the request intake channel, processing deadlines, and the responsibility for reviewing explanation statements are established in advance in the consignment document, the 30-day deadline will pass while the two companies push responsibility onto each other. If the agency places received applications into its own talent database and uses them to recommend candidates to other client companies, that constitutes provision to a third party rather than consignment (Chapter 3).

Changing the degree of automation also changes obligations

The legal character of the same tool varies depending on how it is used. Even if automated rejections of the bottom 40% are reduced to the bottom 20%, it is still an Automated Decision for those who are rejected. Conversely, changing the process so that a human re-reads and decides on all rejected candidates may mean it is not an Automated Decision, but it requires that much more review personnel and time. Altering the cutoff line or the review method during operation alters the scope of legal obligations; therefore, it must undergo change-approval procedures (Chapter 5), and the disclosed criteria and procedures must also be amended accordingly.

At work

Camellia Pharmaceuticals' adoption of an AI competency assessment

When introducing an online AI competency assessment for open recruitment of research support positions (approximately 4,000 applicants), the pharmaceutical company 'Camellia Pharmaceuticals' intended to automatically reject the bottom 35%. The HR team first created an Automated Decision determination table. They determined that it was a fully Automated Decision because rejections were finalized without human review, and that it had a significant impact because it caused applicants to lose employment opportunities. The processing basis was consent obtained during the application stage, which encompassed both the AI assessment and automated rejections.

Three points were established from this determination. Because the decision was made pursuant to consent, it fell under the statutory exception to the right to refuse, meaning a re-examination procedure following a refusal was not legally mandatory. However, procedures for requesting explanation and review, as well as disclosure, were established without exception. In addition, the five disclosure items were organized onto a single screen within the selection process guide on the recruitment website. However, recognizing that applicants had no choice but to consent in order to participate and that disputes could arise over whether that consent constituted a genuine choice, the company voluntarily established a path where a human re-evaluated applicants who raised objections to the results, even though the law did not require it.

There were also options that were discarded. The proposal that "notifying all applicants of their individual scores would fulfill the explanation obligation" was discarded because it was not an explanation containing the results, key criteria, and procedures. The proposal to "create procedures only when a request arrives" was discarded because it was dangerous considering the disclosure obligation and the 30-day deadline. Finally, in preparation for review requests, the HR team established and announced in advance during the notice stage which reference date would apply to information that changed after the application deadline, such as "expected certification acquisition → certification completed." This was because the obligation regarding a review request was to review whether the information could be reflected and notify the applicant of the results, while whether to actually reflect it would be determined based on the previously disclosed criteria and equity with other applicants.

Sand Grain Games' AI video interview

The gaming company 'Sand Grain Games' decided to use AI video interviews for hiring customer support personnel. In addition to evaluating responses by question, the vendor tool included a feature that scored 'Empathy' based on facial expressions. When the HR team requested validation materials, the vendor sent client satisfaction surveys and adoption case studies. The HR team determined that this was not evidence that the Empathy score was related to customer support performance, and disabled the feature. They decided to use the per-question response evaluation only after undergoing a pilot validation comparing it against the company's internal consultation quality evaluation data.

During the selection process, an applicant with a hearing impairment requested to participate in the interview through written responses. Because the primary duties of the customer support role consisted of chat and email correspondence, voice communication was not an essential requirement. The HR team received written responses to the same questions, set conditions such as response time appropriate for the alternative method, and had two trained evaluators independently evaluate them using the same rubric. An internal draft stating that "applicants who cannot participate in the AI interview will be scored zero for the relevant section" resulted in exclusion on the grounds of disability and was scrapped. In the contract, they added provisions verifying the alternative methods supported by the vendor, the review results on whether it constituted high-impact AI, and contact information for supervisory managers.

Common mistakes

• "There is no need to explain because consent was obtained." A decision based on consent is merely an exception to the right to refuse. The right to request an explanation or review and the obligation of disclosure remain.
• "It is not an Automated Decision because a human presses the final button." Without the authority to change the outcome and substantive review, it is merely formal intervention. The Notification looks first at whether there was substantive and meaningful intervention.
• "Because AI was involved even slightly, the right to refuse must be guaranteed to all applicants." If a human read the original text and made the determination in the selection process, it may not be an Automated Decision. Over-application creates another error of indicating that AI made the decision.
• "It cannot be explained because it is a trade secret." Even if source code does not need to be disclosed, an individualized explanation containing the results, key criteria, and procedures must be provided.
• "Unvalidated features may be used if the score weighting is lowered." As long as it influences the decision, the issue of validity remains unchanged.
• "Validity is confirmed because a vendor study exists." If the target job and applicant pool differ, it must be re-verified using the company's own data.
• "Applicants who cannot take the AI interview are rejected." Reasonable accommodation must be provided unless it is an essential requirement of the job.
• "Fulfilling the obligations under the AI Basic Act also resolves the obligations under the Personal Information Protection Act (PIPA)." These are obligations under different laws.

Summary at a glance

Check the official docs

• Personal Information Protection Act, Article 37-2 — Read the original text of the right to refuse, right to request explanation, disclosure obligations, and provisos.
• Enforcement Decree of the Personal Information Protection Act, Article 44-3 — Check measures for each type of request, the 30-day deadline and extensions, and notice of refusal.
• Enforcement Decree of the Personal Information Protection Act, Article 44-4 — Check the five items to be disclosed in advance.
• Standards for Measures by Personal Information Controllers Regarding Automated Decisions — Read the determination factors for applicability and significant impact, as well as the deadline for notice of refusal.
• AI Basic Act, Article 2 — Read the definition of high-impact artificial intelligence and the definitions of business operators, users, and affected persons.
• AI Basic Act, Article 34 — Check the six obligations of high-impact artificial intelligence business operators.
• Act on the Prohibition of Discrimination against Persons with Disabilities, Article 4 — Check the definition of reasonable accommodation and justifiable reasons.
• NIST AI RMF — Core — Locate and read GOVERN 3.2, MAP 3.4, and MEASURE 2.5.

Self-check

2-1. State the three constituent elements of an 'Automated Decision' defined by the Personal Information Protection Act (PIPA) and its exclusions from application, and explain why a rule-based program can fall under this definition.

2-2. Among the right to refuse, the right to request an explanation or review, and the disclosure obligation, state which one is subject to exceptions based on the legal basis for processing (consent, statutory provisions, or contract), and explain why the remaining two still apply.

2-3. State the single most important factor in practice among those that the Personal Information Protection Commission Notification requires to be considered when determining whether something constitutes an Automated Decision, and explain how it relates to a formal approval button.

2-4. Summarize the action deadline and extension rules for an explanation request, as well as the notification rules when refusing a request.

2-5. State three questions that must be asked before accepting a study as is when a vendor submits a validity study for an evaluation tool.

2-6. In the AI Basic Act, write one line each explaining what an AI developer, an AI deployer, a user, and an affected person are, and state which category an HR solution company that sells recruitment evaluation services falls under.

2-7. (Design) An issue was identified where reviewers follow AI scores almost as they are. Divide the scenario into cases where review time is sufficient and cases where it is insufficient, design an appropriate review method for each, and state two metrics to verify whether the method is effective.

Hands-on tasks