As AI Begins Handling Reservations and Payments, Government to Establish 'Agent Data Rules'

[Financial News] As the era of AI agents that purchase products and make hospital reservations on behalf of users approaches, the government is moving to establish rules governing personal information. The key issue is to define how much personal information—including names, addresses and contact details—may be shared with online retailers, hospitals and payment providers when users assign tasks to AI. The government plans to assess actual demand for data integration through the closed beta of the 'Moduui AI' service, scheduled to begin in October, while conducting legal reviews with relevant ministries.
According to government and industry sources on the 30th, the Ministry of Science and ICT plans to identify cases in which companies participating in Moduui AI require clear legal standards. It will then consult with relevant ministries, including the Personal Information Protection Commission (PIPC).
'Moduui AI' is a project to develop Korean AI-powered everyday-life chatbots and AI agents. Three consortiums involving Kakao, SK Telecom and KT will begin rolling out closed beta services in October, with an official launch targeted for December.
Data transfers between companies are important because AI is moving beyond providing information to handling actual tasks. Product recommendations may require only pricing and performance data, but placing an order requires the buyer's name and delivery address. A hospital reservation likewise requires the user's name, contact details and preferred time.
Users currently enter their information directly into apps, but AI agents may take over that role in the future. Even when a request is made through a single chat window, the actual task is processed through AI companies, online retailers, and reservation and payment providers, meaning the necessary information must move between them as well.
The question is whether assigning a reservation or purchase to an AI agent can be considered consent to transfer personal information to other companies. Even for a request such as "Buy this product for me," the recipient, categories of information to be provided, retention period and purpose of use must be determined.
The current Personal Information Protection Act also requires such matters to be disclosed when information is provided to a third party with consent. The government must determine how these requirements will apply to AI services.
"We need to consult with the PIPC or relevant ministries on matters that we cannot determine ourselves," a Ministry of Science and ICT official said. "At this point, we are listening to companies' views on what they would like clarified."
Overseas AI companies have also introduced separate safeguards to prevent agents from sharing excessive personal information while acting on users' behalf. OpenAI designed its Agentic Commerce Protocol (ACP) to send only the information necessary for a purchase to a merchant with the user's permission. Meta's 'Muse' also allows users to set access limits for each app and requires their approval before carrying out sensitive actions such as purchases.
However, the scope of the authority granted to an AI agent remains a point of contention. One recent example involved the home address of a user who had asked Muse to handle a secondhand transaction being shared with the buyer. The user had selected "Always allow," but said they had expected to approve each transaction separately when personal information was actually shared externally.
The Ministry of Science and ICT plans to assess demand for data integration between companies through the closed beta service and review, with relevant ministries, the scope permitted under current law. 
[email protected] Yoon Hong-jip Reporter