Chapter 3. Applicant and Employee Data

Learning objectives

• Distinguish the legal bases for processing applicant and employee personal information (consent, statutory provisions, contracts, etc.), and determine whether AI utilization falls within the original purpose.
• Classify HR data items by distinguishing the processing requirements for sensitive information, uniquely identifiable information, resident registration numbers, and pseudonymous information.
• Distinguish between entrustment of processing, provision to third parties, and overseas transfer, and select data use terms to verify in AI vendor contracts.
• Design retention periods, return procedures, and destruction procedures for hiring documents and AI analysis results.
• Apply a decision-making procedure to determine whether specific HR data may be entered into a specific AI tool.

Introduction

The human resources (HR) team is the department that holds the largest amount of the most sensitive data in a company. Application forms contain work experience and educational background, time and attendance records contain reasons for sick leave, payroll materials contain bank accounts and deduction details, and interview recordings contain faces and voices. There is much that generative AI can do with this data: summarizing hundreds of exit surveys, organizing interview transcripts, verifying payroll calculations, and predicting turnover risk.

The problem lies in the distance between "can do" and "may do." Even with the same attendance records, using them to verify payroll serves the original purpose, but using them to evaluate work attitude when that was not among the purposes notified to employees can constitute use beyond the original purpose. Even with the same facial photo, printing it on an employee ID badge makes it general personal information, but generating feature information for identity verification turns it into sensitive information. Even with the same vendor, having them handle work solely on the company's behalf constitutes entrustment, but if they use the data to improve their own service, it becomes provision to a third party.

Starting from the processing principles and legal bases under the Personal Information Protection Act (PIPA), this chapter covers, in order, use beyond the original purpose, special categories of information (sensitive information, uniquely identifiable information, and resident registration numbers), entrustment, third-party provision, overseas transfer, and retention and destruction. Finally, it establishes a decision-making procedure and a vendor contract checklist for determining "whether this data may be entered into this AI tool."

Key concepts

Personal Information and Combinability

Article 2, Subparagraph 1 of the Personal Information Protection Act (PIPA) defines personal information as information relating to a living individual, consisting of information that can identify a particular individual by name, resident registration number, image, etc. (Item (a)); information that cannot by itself identify a particular individual but can easily be combined with other information to identify the individual (Item (b)); and pseudonymous information (Item (c)). Whether information can be easily combined is determined by reasonably considering the availability of other information, as well as the time, cost, and technology required to identify the individual.

The reason this definition is critical in HR data is the misconception that "if you simply remove the name, it is no longer personal information." Even if names are removed from an interview transcript, a statement such as "my experience building an inventory system for three years at a logistics startup" makes it easy to surmise who the person is within the company. In survey responses from a department of twelve people, the author can be revealed by writing style alone. Deleting names is merely a starting point; it is not equivalent to anonymization or pseudonymization.

Processing Principles: Purpose, Minimization, Anonymity

Article 3 establishes the principles of personal information protection. Five of them are particularly important for HR AI.

Paragraph 7 is used most frequently in practice. If the analysis involves survey analysis to identify department-level improvement tasks, respondent identities are unnecessary, so the analysis must be conducted on anonymized data. Conversely, tasks that involve payments to individuals, such as payroll verification, inevitably require identifying individuals.

Legal Bases for Processing: On What Grounds Is Data Collected and Used?

Article 15, Paragraph 1 specifies seven circumstances in which personal information may be collected and used. The following four are deeply relevant to HR operations:

When obtaining consent, the controller must inform the data subject of the purpose of collection and use, the items collected, the period of retention and use, and the right to refuse consent along with any disadvantages resulting from refusal (Article 15, Paragraph 2); in certain cases, matters requiring consent must be differentiated and consented to separately (Article 22). Controllers must inform data subjects that they may choose not to consent to information beyond the minimum required, and may not refuse to provide services on that basis (Article 16). For personal information that can be processed without consent, its items and legal bases must be disclosed or notified separately from matters subject to consent (Article 22, Paragraph 3).

The legal basis for processing is also used again in Chapter 2 regarding Automated Decision. This is because if a decision is made pursuant to Subparagraph 1, 2, or 4, it qualifies as an exception to the right to refuse. If the legal basis is not documented in writing, it is impossible even to determine what procedures are required.

Use and Provision Beyond the Original Purpose

The first aspect to examine is additional use reasonably related to the initial purpose. Article 15, Paragraph 3 and Article 17, Paragraph 4 provide a pathway to use or provide personal information without the data subject's consent within the scope reasonably related to the initial purpose of collection. Article 14-2 of the Enforcement Decree lists criteria for this determination, including relevance to the initial purpose, predictability in light of the circumstances of collection and processing practices, whether it unfairly infringes on the interests of the data subject, and whether safety measures such as pseudonymization or encryption have been applied. Any use outside this scope constitutes use beyond the original purpose.

Article 18, Paragraph 1 prohibits using personal information beyond the scope provided under Article 15, Paragraph 1, or providing it to a third party beyond the scope provided under Article 17, Paragraph 1, etc. Exceptions are established in Paragraph 2; those primarily applicable to private companies (non-public institutions) include the data subject's separate consent, special provisions in other Acts, and urgent interests of life, bodily integrity, or property. When obtaining separate consent, the controller must inform the recipient, the purpose of use, the items, the period of retention and use, and the right to refuse along with resulting disadvantages (Paragraph 3).

Scenes where use beyond the original purpose frequently arises in HR AI are as follows:

The fact that "the information already exists in the company system" is not a legal basis for processing. Each time data is used, the purpose and the necessary scope must be reconfirmed. Furthermore, use beyond the original purpose is an issue of trust before it is an issue of law. If it becomes known that HR chatbot conversations are being used for evaluations, employees will not ask the chatbot candid questions, and the very purpose of introducing it will collapse.

Sensitive Information

Article 23 defines information regarding ideology, belief, admission to or withdrawal from a labor union or political party, political opinions, health, sexual life, etc., along with information prescribed by Presidential Decree, as sensitive information, and prohibits its processing in principle. Article 18 of the Enforcement Decree adds genetic information obtained from genetic testing, criminal history records, information regarding an individual's physical, physiological, or behavioral characteristics generated through specific technical means for the purpose of identifying a particular individual, and information regarding race or ethnicity.

Sensitive information may only be processed when separate consent is obtained apart from consent for other processing, or when statutes specifically require or permit the processing (Article 23, Paragraph 1); when processed, measures necessary to ensure safety must be implemented (Paragraph 2).

In HR operations, sensitive information is closer than one might think. Reasons for sick leave and health checkup results constitute health information. Union membership status is sensitive information in and of itself. If feature information for identity verification is generated from facial photographs for access control, it becomes biometric feature information. To input such information into AI analysis, the legal basis must be reconfirmed from the ground up, and as a rule, it should not be included if the model is used for personnel actions. Article 81, Paragraph 1, Subparagraph 1 of the Trade Union and Labor Relations Adjustment Act prohibits unfavorable treatment against a worker on the grounds of union membership as an unfair labor practice; therefore, if union membership status is fed into a model that can influence assignments or evaluations, it becomes problematic even if consent forms exist.

Uniquely Identifiable Information and Resident Registration Numbers

Article 24 allows the processing of uniquely identifiable information—prescribed by Presidential Decree among identification information assigned to uniquely distinguish individuals pursuant to statutes—only when separate consent is obtained or when statutes specifically require or permit it, and mandates safety measures such as encryption. Article 19 of the Enforcement Decree designates resident registration numbers, passport numbers, driver's license numbers, and alien registration numbers.

Resident registration numbers are subject to even stricter rules. Article 24-2, Paragraph 1 prohibits their processing except where Acts or Presidential Decrees specifically require or permit the processing, where it is manifestly necessary for the urgent interests of life, bodily integrity, or property, or in cases deemed inevitable corresponding thereto as determined and publicly notified by the Personal Information Protection Commission (PIPC). Unlike other uniquely identifiable information, the consent of the data subject cannot serve as a legal basis for processing. Even when processed, they must be stored in encrypted form (Paragraph 2).

Therefore, requiring applicants to enter their resident registration numbers on application forms under the pretext of "preventing duplicate applications" cannot be done even with a consent form, unless statutes specifically require or permit processing at that stage. Duplicate checks must be performed through other means, such as contact information or identity verification. If processing is specifically required by statutes after hiring, it must be processed strictly within the scope of that legal basis.

Pseudonymous Information and Its Limitations

Pseudonymization is the processing of personal information to make it impossible to identify a specific individual without additional information by deleting or replacing part of the personal information (Article 2, Subparagraph 1-2), and the result is pseudonymous information. Pseudonymous information is still personal information. This is because if a correspondence table linking replacement keys to original names exists anywhere, an individual can be identified again by combining it with that table.

Article 28-2 permits the processing of pseudonymous information without the data subject's consent for purposes such as statistical compilation, scientific research, and record preservation in the public interest. Scientific research refers to research applying scientific methods, such as technological development and demonstration, fundamental research, applied research, and privately funded research (Article 2, Subparagraph 8). However, this special exception is not a legal basis for the purpose of taking personnel actions against a specific individual. Because an analysis aimed at selecting employees flagged with high turnover risk for interviews has the objective of identifying individuals, pseudonymization does not turn the data into material where "anything can be done without consent." Article 28-5 prohibits anyone processing pseudonymous information from processing it for the purpose of identifying a specific individual.

Dividing the process into stages provides clarity. In the stage of developing and validating a predictive model by pseudonymizing past HR data, there is room to examine the scientific research exception; however, because it is uncertain whether model development for internal HR management qualifies as scientific research, obtain expert review and examine other legal bases for processing concurrently. However, the stage of applying that model to actual employees to select candidates for interviews constitutes processing to identify individuals; therefore, general legal bases and purpose boundaries, such as employment contract performance or separate consent, must be separately established, and discrimination and fairness reviews from Chapters 1 and 5 must also be conducted.

Entrustment of Processing and Provision to Third Parties

When transferring HR data to an AI vendor, the first thing to determine is whether the relationship constitutes entrustment or provision to a third party. The criterion is for whose purpose the data is processed.

Article 26 requires the following for entrustment: a document stipulating the prohibition of processing beyond the purpose of the entrusted work, technical and managerial protection measures, etc. (Paragraph 1); disclosure so that data subjects can easily check the content of the entrusted work and the trustee (Paragraph 2; here, the trustee includes any sub-entrusted third party); supervision, including education and inspection of processing status of the trustee (Paragraph 4); and consent of the entrustor if the trustee intends to sub-entrust (Paragraph 6). Furthermore, Paragraph 8 applies several provisions mutatis mutandis to trustees, including destruction (Article 21), sensitive information (Article 23), and Automated Decision (Article 37-2).

If a draft contract contains a broad clause such as "the vendor may utilize data to improve service quality," one must re-examine whether that utilization falls within the scope of the entrusted work. If it serves the vendor's own purposes, such as training the vendor's general-purpose model, it exceeds the scope of entrustment.

Overseas Transfer

AI services often run in overseas clouds. Article 28-8, Paragraph 1 prohibits in principle the overseas provision (including where personal information is accessed/viewed), entrustment of processing, or storage of personal information, and permits it only in the following cases:

1. Where separate consent regarding overseas transfer has been obtained from the data subject
2. Where special provisions exist in an Act, treaty, etc.
3. Where entrustment of processing or storage is necessary for concluding or executing a contract with the data subject, and the matters related to the transfer have been disclosed in the privacy policy or notified via email, etc.
4. Where the recipient has obtained certification publicly notified by the Personal Information Protection Commission (PIPC) and taken necessary measures
5. Where the Personal Information Protection Commission (PIPC) recognizes that the level of protection in the destination country, etc. is substantially equivalent

Matters to be notified or disclosed include the items transferred, the destination country, timing, and method of transfer, the name and contact information of the recipient, the recipient's purpose of use and period of retention and use, and the method and procedure for refusing transfer along with the effects of such refusal (Paragraph 2). Even if the processing is for company purposes and thus constitutes entrustment, if the location of processing is overseas, the overseas transfer requirements are added to the entrustment requirements. If it is unclear whether processing at the applicant stage—where an employment contract has not yet been concluded—constitutes entrustment of processing or storage that is "necessary for concluding a contract" under Subparagraph 3, obtaining separate consent under Subparagraph 1 is better for reducing disputes.

Retention Periods and Destruction

Article 21 mandates that personal information be destroyed without delay when it becomes unnecessary, such as upon expiration of the retention period or attainment of the processing purpose (Paragraph 1), that measures be taken to prevent recovery or reproduction (Paragraph 2), and that if it must be preserved pursuant to other statutes, it must be stored and managed separately (Paragraph 3). As this obligation applies mutatis mutandis to trustees, copies remaining in the vendor's systems must also be destroyed together.

Using AI expands the targets of destruction. Not only original applications, but also scores, summaries, embeddings (values converting text into numeric vectors that may allow the original text to be inferred), and analysis logs generated by AI constitute personal information if they can identify an individual or be combined with other information to identify an individual. Materials that must be preserved pursuant to other statutes are stored separately instead of being destroyed (Article 21, Paragraph 3). If these derived outputs are not included in the destruction list, a situation arises where "the originals were deleted, but the summaries remain."

The return provisions of the Fair Hiring Procedure Act also overlap regarding hiring documents. Article 11, Paragraph 1 provides that if a job seeker (excluding a finalized hire) requests the return of hiring documents after the hiring decision is finalized, the employer must return them after verifying identity; however, an exception is made where documents were submitted via website or email, or where the job seeker submitted them voluntarily without being requested to do so. The return request period is determined by the employer within a range of 14 to 180 days from the date the hiring decision is finalized, and must be notified to job seekers before the hiring decision is finalized (Article 4 of the Enforcement Decree, Article 11, Paragraph 6 of the Act). Hiring documents that are not returned or for which the request period has expired are destroyed in accordance with the Personal Information Protection Act (Article 11, Paragraph 4). Since the Fair Hiring Procedure Act applies to workplaces with 30 or more regular employees (Article 3), in workplaces smaller than that, the retention and destruction principles of the Personal Information Protection Act serve as the standard.

Safety Measures and Access Logs

Article 29 mandates technical, managerial, and physical measures necessary to ensure safety, such as establishing internal management plans and preserving access logs. In HR AI, this materializes in two concrete ways. One is processing exclusively in tools managed by the company. The moment an interviewer pastes a transcript into a free chatbot on a personal account, it escapes the company's scope of security management. The other is retaining records of who accessed what. This connects to the audit trails in Chapter 4.

Decision-Making Procedure: May This Data Be Entered into This AI?

The decision-making sequence that HR managers can use every time is summarized as follows:

1. Verify the purpose. What is this analysis intended to decide? Is it to take action regarding an individual, or to understand a group?
2. Verify the legal basis. Does that purpose fall within the legal basis and notified purpose from the time of initial collection? If not, is there a new legal basis, such as separate consent?
3. Verify the information type. Does it contain sensitive information, uniquely identifiable information, or resident registration numbers? If so, is there a legal basis appropriate for that information? Can it be excluded from analyses used for personnel actions? If it is the recruitment stage, are prohibited items under Article 4-3 of the Fair Hiring Procedure Act and variables revealing protected attributes by proxy (Chapter 1) mixed in?
4. Minimization. Have only the items necessary for the purpose been retained? Can the purpose be achieved through anonymization?
5. Verify the tool. Is it a tool contracted and approved by the company? Are entrustment documentation, disclosure, and overseas transfer requirements fulfilled? If it is a tool that collects employee behavior afresh, have consultation with the labor-management council (Article 20, Paragraph 1, Subparagraph 14 of the Act on the Promotion of Employee Participation and Cooperation) and notification requirements (Chapter 4) also been verified?
6. Verify the retention period. When will the inputs and outputs be destroyed? How long is the retention period on the vendor side?

Checking Data Use Terms in Vendor Contracts

An AI vendor's data terms are found in contract documents, not on screen interfaces. Fill in the fields in the table below along with supporting documentation before signing a contract.

Statements such as "the vendor assured encryption" or "we executed a non-disclosure agreement (NDA)" do not fill the fields in this table. Encryption is merely one of the protective measures, and an NDA does not substitute for the statutory content of entrustment documents, disclosure, or the entrustor's supervisory obligations.

Going deeper

Between "Deleting the Name" and "Being Anonymous"

Article 58-2 provides that this Act shall not apply to information that can no longer identify an individual even if other information is used, reasonably taking into account time, cost, technology, and other factors. Anonymization is the process of creating this state. Human resources (HR) data struggles to meet this criterion. This is because organizations are small, members know one another, and career histories and job duties are unique. In practice, three methods are used together. Enlarging the unit of aggregation (combining departments with fewer than five people into higher-level organizations, using the k-anonymity method so that there are at least k individuals with the same value). Deleting unique specific details (project names, client company names, specific incidents). Omitting verbatim quotes from deliverables. Even so, free-form text still carries residual risk, so analyses are conducted only within tools managed by the company, and results are shared only at the aggregate level.

How Free Is Employee Consent?

In recruitment and employment relationships, power is not equal between the company and applicants or employees. When a consent form is presented, most people sign it. The law seeks to reduce this imbalance by specifying methods for obtaining consent (Article 22), requiring notice that consent may be withheld for information beyond the minimum required, and prohibiting adverse treatment on such grounds (Article 16 and Article 22, Paragraph 5). The practical principles are as follows. Processing that can be justified by contract performance or statutory obligations is carried out on those legal bases; processing requiring consent is designed so that refusal incurs no disadvantages; and alternative paths for those who refuse are prepared from the outset. Processing that is difficult to justify even with a consent form, such as trade union membership, is not conducted in the first place.

The Lifespan of Derived Data

Outputs generated by AI tend to outlive the original source data. Summaries are scattered across shared folders, scores across spreadsheets, and embeddings across search indexes. Furthermore, if remaining summaries are reused as "reference material" for subsequent hiring cycles even after the original source data has been destroyed, such processing falls outside both the notified retention period and the stated purpose. When drawing data flow diagrams, record not only the original data, but also the storage locations and destruction schedules for all deliverables generated by AI.

At work

Fields Produce's Analysis of Reasons for Resignation

The HR team at the agricultural produce distributor 'Fields Produce' (1,300 employees) wanted to analyze 480 exit interview records from the past two years using AI to identify causes of turnover. The initial plan was to feed the raw text of the interview records directly into a company-approved AI tool and ask it to "estimate the real reason for resignation for each departed employee."

When the assessment procedure was applied, problems emerged. Because the purpose was to identify company-wide improvement initiatives, there was no need to identify individuals. The interview records contained a mix of health reasons, family circumstances, and colleagues' names. Estimating the "real reason" for each departed employee could exceed the notified purposes (processing resignation procedures and organizational improvement). In addition, the retention periods for some of the records had already expired.

The HR team changed the plan. Records whose retention periods had expired were destroyed before analysis. From the remaining records, names, employee numbers, colleagues' names, and details related to health and family were deleted, and departments with fewer than five people were merged at the division level. The prompt was also changed from "estimates for each departed employee" to "types and frequencies of recurring resignation reasons by division." Verbatim quotations were omitted from the final report. The discarded options were "use the records as they are since they exist in the company system" and "obtain retroactive consent from departed employees." The former lacked a legal basis, while the latter was unrealistic because many individuals could not be reached, and individual-level analysis was unnecessary in the first place.

Reward Energy's Overseas AI Summarization Service Contract

The energy company 'Reward Energy' reviewed an overseas AI service for summarizing job applications for experienced hires. The sales representative said, "There is no need to worry because we have industry-standard security certifications and encrypt data." The HR team completed a vendor contract checklist.

The processing status was an entrustment because it served solely the company's document screening purposes. However, the terms of service contained a clause stating that "customer data may be utilized to improve the service," and the default setting for training use was enabled. The processing location was an overseas region, and there was a separate list of sub-processors.

The HR team established three contract conditions: disable training use and narrow the service improvement clause to the scope of entrusted work; obtain company consent when changing sub-processors; and receive processing status reports along with confirmation certificates of deletion. Regarding cross-border transfer, because it was uncertain whether processing at the applicant stage—prior to executing a contract—qualified as an entrustment necessary for concluding a contract, they decided to obtain separate consent for cross-border transfer upon receiving applications. On the consent screen, they specified the items being transferred, the destination country, timing, and method, the recipient's name and contact information, the purpose of use and retention period, and the method and consequences of refusal, while establishing a path where applications of candidates who did not consent were reviewed domestically by human reviewers. Although security certifications were verified, they noted in an internal report that certifications alone could not substitute for these required items.

Common mistakes

• "Deleting the name means it is no longer personal information." It is personal information if an individual can still be identified by easily combining it with other information.
• "Information can be used simply because it is in the company system." The purpose and legal basis must be verified each time it is used. Possession itself is not a legal basis.
• "Obtaining a consent form allows the collection of Resident Registration Numbers." Resident Registration Numbers cannot be processed even with consent unless there is a statutory basis, among other exceptions.
• "Anything can be done without consent once data is pseudonymized." The special provisions for pseudonymous information apply only to statistical purposes, scientific research, public interest archiving, and similar purposes; pseudonymous information remains personal information.
• "The vendor can use data freely because an entrustment contract exists." The trustee cannot use data beyond the scope of entrusted work. If used for the vendor's own purposes, it constitutes provision to a third party.
• "Overseas servers are acceptable as long as domestic entrustment requirements are met." If the processing location is overseas, cross-border transfer requirements are additionally applied.
• "Destruction is complete once the original data is deleted." AI scores, summaries, embeddings, and copies held by trustees must also be destroyed.
• "Applications received via the website should be retained for a long period in preparation for return requests." Submissions via websites or email are exempt from return obligations. When data becomes unnecessary, such as when hiring purposes are fulfilled, it must be destroyed without delay even if the notified retention period remains, and it cannot be retained beyond the notified retention period.

Summary at a glance

Check the official docs

• Article 15 of the Personal Information Protection Act — Read the seven legal bases for collection and use and the mandatory disclosure items when obtaining consent.
• Article 18 of the Personal Information Protection Act — Check the prohibition of out-of-purpose use and provision, along with the exceptions.
• Article 23 of the Personal Information Protection Act and Article 18 of its Enforcement Decree — Read the scope of sensitive information and its processing requirements.
• Article 24-2 of the Personal Information Protection Act — Check the limitations on processing Resident Registration Numbers and encryption obligations.
• Article 26 of the Personal Information Protection Act — Read the provisions on entrustment documentation, public disclosure, supervision, re-entrustment, and mutatis mutandis application.
• Article 28-8 of the Personal Information Protection Act — Check the five pathways for cross-border transfer and the mandatory disclosure items.
• Article 11 of the Fair Hiring Procedure Act and Article 4 of its Enforcement Decree — Check the exceptions to the return of hiring documents and the claim periods.

Self-check

3-1. State the principle of anonymization and pseudonymization in Article 3, Paragraph 7 of the Personal Information Protection Act (PIPA), and explain with one example each how this principle applies differently to tasks that strictly require individual-level processing versus tasks that do not.

3-2. Summarize the differences in processing requirements among sensitive information, unique identification information, and Resident Registration Numbers in a table. In particular, pay attention to whether the consent of the data subject serves as a legal basis.

3-3. Write the criterion that distinguishes entrustment of processing from provision to a third party in one sentence, and state four obligations that the entrusting party must fulfill.

3-4. Among the five pathways permitted for cross-border transfer, choose one pathway that can be used without separate consent and explain its requirements.

3-5. In recruitment using AI, state three items that must be included on the destruction list in addition to the original applications, and write the reasons why.

3-6. State the purposes to which the special provisions for pseudonymous information processing apply, and explain why these special provisions cannot serve as the legal basis for analysis intended to take personnel actions regarding an individual.

3-7. (Design) Create a plan to complete the eight rows of the vendor contract checklist in this chapter for one AI tool used by the company. For each row, state which document to find supporting evidence in and how to handle the situation if it cannot be confirmed.

Hands-on tasks