Facts
The Ministry of Justice, with the Ministry of Science and ICT, ran an “AI identification and tracking system” project to develop a face-recognition model suited to immigration checks. On 23 July 2020 a testing lab opened inside a secured area of Incheon Airport, where companies could work in an environment cut off from outside networks. The Ministry de-identified about 170 million face photos collected at immigration, keeping only nationality, sex and year of birth, sent them to the lab's training server and let participating companies use them. After the matter became public around 20 October 2021, the project was put on hold on 25 November 2021 and ended on 31 December 2021. The data were destroyed on 2 March 2022.
Question
The complainants, Korean nationals and foreigners who had crossed the border between 2005 and 2021, claimed that their fundamental rights, notably the right to informational self-determination, had been violated. The review covered three targets: the transfer of their face data to third parties as AI training data; Articles 3(5), 6(6), 12-2(5) and 28(6) of the Immigration Act, which allow immigration officers to use biometric information in entry and exit checks; and the legislature's failure to enact a ban on processing biometric data to train AI algorithms.
Decision
On 26 February 2026 the Court unanimously dismissed all the claims. The project had ended and the data had been destroyed, so the interest in challenging the transfer had lapsed, and the Ministry's statement that no similar project was planned meant repetition could not be assumed. The transfer's lawfulness was primarily a matter for the Immigration Act and the Personal Information Protection Act, turning on concrete factors such as the scope of the data, the degree of de-identification, the selection of companies and security measures, so there was no exceptional interest in review. The statutory provisions lacked directness because they require an implementing act, and no constitutional duty to enact a specific ban on AI training use could be derived.
Why it matters
Because the Court did not reach the merits, whether public bodies may reuse biometric data they hold to train AI remains unanswered at constitutional level. The decision expressly leaves that assessment to the application of the Immigration Act and the Personal Information Protection Act to specific facts, and so to the regulator and the courts. It also shows the limits of a constitutional complaint against a data-processing operation that has already ended.
Related stages
On 27 April 2022 the PIPC had found the transfer lawful under the Immigration Act but fined the Ministry KRW 1 million for failing to disclose the outsourcing and the contractors.