[Expert Column] De-identifying HR Data: The Prerequisite for AI-Based HR Management

Amid the wave of digital transformation, the field of HR management is rapidly evolving. Beyond simple administrative tasks, HR data is now being directly used in strategic corporate decisions—including hiring, turnover prediction, performance analysis, and organizational diagnosis. As AI-based analytics tools proliferate, many companies are considering adopting HR solutions. However, there is a critical precondition that must be addressed first: the sensitivity of HR data and the issue of de-identification.

 

When we think of "personal information," we tend to picture identifiers like names, resident registration numbers, and contact details. But HR data encompasses a far broader and more complex range of information. Job history, performance evaluations, counseling records, sick-leave reasons, and health checkup results reveal sensitive insights into an employee's disposition and condition. Recently, the collection of unstructured data—such as employee opinion surveys and qualitative comments for organizational-culture analysis—has also been on the rise. This is often the first obstacle companies face when attempting to adopt AI-driven HR management: HR professionals frequently find themselves uncertain about how far to cleanse and anonymize internal data.

 

HR data cannot be protected simply by masking names and ID numbers. For example, an attribute combination such as "Planning Team, Manager, born 1990, female" can be enough to infer a specific individual. Information that appears anonymous in isolation can become highly identifiable when combined. This is why sophisticated, statistically grounded de-identification—beyond mere anonymization—is essential. Overseas, mathematical models such as k-anonymity, ℓ-diversity, and t-closeness are used to pre-assess and control identification risks. Free-form unstructured text such as counseling notes and qualitative comments also requires a separate de-identification process using natural language processing (NLP). Only through such a rigorous process can AI safely learn from data and use it for prediction and analysis.

 

Fortunately, the institutional foundation for safely leveraging HR data has been gradually taking shape in Korea in recent years. Following the 2020 amendment to the Personal Information Protection Act introducing the concept of pseudonymized information, the Personal Information Protection Commission issued guidelines for processing sensitive information in 2023, setting out basic principles for HR-data handling. In 2024, the certified pseudonymized-data combination institution system was expanded, providing companies with practical means to process, combine, and analyze data safely.

 

Still, many organizations understand the intent of these regulations but find real-world application difficult. HR data is scattered across multiple platforms—payroll, evaluation, attendance—and the growing use of cloud-based solutions and outsourced operations blurs the lines of data-processing responsibility.

 

To use HR data safely, practitioners should verify the following: ▲data classification, ▲identifiability assessment of attribute combinations, ▲presence of unstructured data, ▲review of liability clauses in outsourcing contracts, ▲re-identification verification and log retention, and ▲minimum-information collection when used for AI analysis. This is not merely a compliance checklist for personal-data protection—it is the foundational infrastructure for building employee trust and strategically leveraging talent data. Human Consulting Group systematically embeds these requirements into its proprietary HR solutions—hunel, JaDE, and talenx—realizing the balance between HR data protection and utilization......(hereafter omitted.)