ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
News5 min read·2026-10-20DisconfirmAI Editorial

Korean Certified Information Manager Yang Hee-eun: AI Projects Fail More from Unusable Data than Dirty Data

Based on her hands-on experience performing pseudonymization for public institutions and companies in South Korea, Certified Information Manager Yang Hee-eun argues that AI projects stall not because data is dirty but because it is unusable — legally restricted, unable to leave the institution, or invisible in unstructured formats. She advocates treating privacy governance as a traffic light rather than a brake, selecting pseudonymization, anonymization, or synthetic data pathways according to the intended use.

ImportanceMaterialEvidenceE3 inspectableWrite-upStandard

Original publication time 2026-10-20 08:47 GMT+8

"The data is a mess." When an AI project falls short of expectations, this is the most common explanation. Yang Hee-eun, a Korean Certified Information Manager, acknowledges in her ZDNet Korea column that this diagnosis is not wrong: Gartner predicts that 60% of AI projects lacking "AI-ready" data will be abandoned by 2026, and 63% of organizations either have not established a data management system suited to AI or are not even sure whether they have one. Many companies accordingly pour budgets into cleansing, standardization, and quality control.

But Yang Hee-eun points out that the failures she encountered while personally performing data pseudonymization for public institutions and companies looked entirely different. "Projects stopped not because the data was dirty, but because it could not be used." Cleaned data sat right there, yet could not enter training because it contained personal information; or problems only surfaced after deployment, forcing services to be taken offline.

She distinguishes two commonly conflated standards: data quality (accuracy, completeness, consistency) and data usability (whether this particular use is permitted). Consider anomaly-detection modeling: if you erase "outliers" as noise, quality metrics improve but the model loses the very signal it was supposed to capture. Quality is not an intrinsic property of data but is relative to purpose. Going further, even if every quality metric passes, if the law does not permit that use, the data might as well not exist for AI.

Sign in / Sign up
ReadingResearchRadarInvestment framework

Yang Hee-eun categorizes "unusable data" into three types. The first is data that cannot legally be used: customer data collected for service delivery, if fed directly into AI training, may trigger controversy over out-of-purpose use; projects that begin without first confirming consent scope, legal basis, and pseudonymization requirements are halted by legal review at the late development stage. The second is data that cannot leave the institution: the moment data is sent to an external partner, cloud platform, or overseas LLM API, processing-delegation and cross-border-transfer issues follow; network isolation and inter-subsidiary data-combination procedures are equally barriers. She participated in a project at a South Korean transportation-sector public institution where data could not leave the premises, so isolated processing equipment was brought inside, work was done on-site, and only results were carried out. The third is the most dangerous — invisible data: consultation recordings, contracts, emails, and scanned documents contain names, contact details, identifier numbers, and health information scattered throughout, yet protection systems centered on structured databases simply cannot detect them. While pseudonymizing consultation audio for a South Korean information-security institution, she found personal information dispersed across conversations rather than confined to designated fields. If such content is fed directly into RAG or training data, a single query can leak private information.

The common thread across all three types is that cleansing tools cannot solve them; what is needed is a system that makes data "usable." Yang Hee-eun describes privacy technologies as a spectrum rather than a binary choice: raw data has the highest utility but can only be used within scopes where consent or legal basis is clear; pseudonymized data, which cannot identify an individual without additional information, can be used without separate consent for statistics and scientific research, making it the practical choice for internal analysis and model training; anonymized data is freely usable but entails significant information loss; synthetic data, generated by learning the statistical structure of the original, excels at development testing, external collaboration, and augmenting rare cases, but if it resembles the original too closely, re-identification risk remains and verification is essential. The core principle is not choosing the "safest method" but the method that matches the use.

She cites a concrete experiment: a South Korean local government's CCTV footage needed pseudonymization. Testing on a public pedestrian dataset, blurring faces dropped person-detection mAP from 0.595 to 0.579; replacing faces with generative-AI-generated virtual faces held mAP at 0.594, nearly lossless. The same pseudonymization goal yields vastly different data utility depending on the technical path chosen. A South Korean financial-sector institution's erroneous-transfer data, after verification, was published as synthetic data on the national public data portal.

On the governance level, Yang Hee-eun uses a metaphor: privacy governance is not a brake but a traffic light. Many organizations treat personal-information protection as the final gate of an AI project — legal and security review comes only after everything is built, so rework and delays repeat endlessly. She references the "Guide for Personal Information Processing in Generative AI Development and Use" published by South Korea's Personal Information Protection Commission in August 2025, which recommends defining processing scope from the purpose-setting stage and requires the Data Protection Officer to participate from the earliest planning phase. If the rule "this use corresponds to this processing path" is pre-established, operational teams need not seek approval from scratch each time. Her judgment: the more refined an organization's governance, the faster and broader its AI adoption.

She concludes with five execution conditions: write a data-use specification before selecting a model; map all data including unstructured sources and classify sensitivity; standardize processing pathways by use and risk level with pre-approved routes; evaluate task utility and re-identification risk simultaneously after processing; and maintain a complete processing trail from raw data to deployed model. Her final point: attributing AI project failure solely to data quality keeps the solution at cleansing; the real bottleneck in the field is whether data matches the purpose and whether that purpose is permitted. The first condition for successful AI transformation is not more or cleaner data, but governance designed to make data usable for its intended purpose.

Sources

  • 原始出处zdnet.co.kr↗
Continue researching →