In the AI Era, Prioritizing Governance Over Technology for Personal Data Protection in Public Institutions

Recent digital transformation in the public sector has rapidly expanded the use of artificial intelligence (AI) across administrative automation, citizen services, welfare administration, public healthcare, public finance, facility management, and security monitoring. However, personal data leaks from public institutions have increased despite technological advancements, with most incidents stemming from operational errors and inadequate internal management rather than advanced hacking. Statistics show public sector data breach reports rose from 23 in 2022 to 128 in 2025, accounting for 28.6% of all breaches. Operational errors accounted for 64% of incidents, while hacking constituted 32%. Safety violations dominated (64%), with ongoing issues of collecting restricted personal identifiers. These trends highlight that many breaches originate from internal governance flaws such as procedural non-compliance, excessive access rights, inadequate third-party management, and system configuration errors. While AI can enhance data protection through real-time analysis and risk prediction, its implementation alone does not guarantee improved security.