This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The South Korean government, through the Ministry of Justice and the Ministry of Science and ICT, initiated an AI identification and tracking system project in 2019. Without obtaining consent, the government transferred over 170 million facial images of citizens and foreign nationals to private companies to train and test biometric surveillance algorithms for airport immigration. This action sparked significant controversy, with civil rights groups labeling it a violation of the Personal Information Protection Act and a severe infringement on privacy and human rights.
Korean government's development of immigration screening system involving real-time facial recognition used airport travelers' data which was supplied by the Ministry of Justice without consent.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
State organizations tasked with regulating technology bypassed the Personal Information Protection Act to facilitate private-sector AI development.
The government compromised the privacy of 170 million individuals by transferring their highly sensitive, non-public biometric facial images to private companies without consent.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Pre-deployment
Occurring before the AI is deployed
The privacy risk and unauthorized data exposure were caused by the intentional decision of South Korean government ministries to share traveler biometric data for AI training prior to the system's full deployment.
The South Korean government unauthorizedly transferred 170 million facial images of citizens and foreign travelers to private companies to train an airport biometric tracking system. This massive compromise of biometric privacy represents a severe threat to civil liberties and human rights, raising significant counter-intelligence concerns regarding the tracking of foreign nationals.
The reports describe an AI system designed to automatically identify airport users' identities and track them in real-time using CCTV cameras, operating independently to match faces against a database.
Risk Level 2: High Risk. The system is a facial recognition and tracking system used for immigration and airport security, which falls under law enforcement and biometric identification applications.
The system's primary function is to perform one-to-many facial recognition to identify and track individuals in airport terminals.
The reports are highly detailed, consistent across multiple sources (Vice, Hankyoreh, Biometric Update), and contain official government documents and statements confirming the key facts of the data transfer.
None.
Technology
Unregulated surveillance algorithms
Private firms trained 1-to-many facial recognition tools on traveler images.
Mass biometric camera deployment
88 cameras were installed at Incheon Airport to gather real-time video.
Data Inputs
Unauthorized biometric data sharing
Over 170 million face photos were shared without obtaining user consent.
Use of sensitive traveler details
Biometric data, nationality, gender, and age were transferred for training.
Human Factors
Flawed official legal assumptions
Officials assumed internal legal reviews justified bypassing traveler consent.
Lack of traveler awareness
Travelers were completely unaware their biometric photos were being shared.
Process and Methods
Secretive project implementation
Government hid data collection scope and structure during the 2019 launch.
Inadequate data screening process
No vetting process existed to stop the transfer of sensitive traveler data.
Management
Prioritizing tech growth over safety
The government prioritized AI industry promotion over information human rights.
Accountability gaps in joint MOU
MOJ and MSIT signed a data-sharing agreement without public oversight.
Regulatory Environment
Violation of privacy protection laws
The data sharing violated South Korea's Personal Information Protection Act.
Immigration Act limitations
The act did not authorize sharing biometric data for private AI development.
Delayed regulatory intervention
The Personal Information Protection Commission failed to stop the project.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
