PDPO and DPPs
The PDPO is technology-neutral and principle-based. Section 2 of the PDPO defines a “data user” as a person who controls the collection, holding, processing or use of personal data.
Accordingly, any individual, entity, organisation or business that develops and/or uses AI systems involving the handling of personal data is likely to be considered a data user and must adhere to the following six data protection principles (DPPs) in schedule 1 of the PDPO, among other requirements under the PDPO:
- DPP 1 (Purpose and manner of collection): Personal data must be collected in a lawful and fair manner for a lawful purpose directly related to the data user’s function or activity. The data collected shall be necessary and adequate but not excessive for such purpose;
- DPP 2 (Accuracy and duration of retention): The data user must take all practicable steps to ensure that personal data is accurate, up to date and not kept longer than necessary;
- DPP 3 (Use): Personal data can only be used for the purposes for which it was collected, unless express and voluntary consent has been obtained from the data subjects for any other purposes;
- DPP 4 (Security): Reasonable security measures must be taken to protect personal data from unauthorised or accidental access, processing, erasure, loss or use;
- DPP 5 (Openness): The data user must be open about its policies and practices in relation to personal data, the kind of personal data it holds, how it is used and the main purposes for which personal data is held; and
- DPP 6 (Access and correction): Data subjects shall have the right to request access to and correction of their own personal data if it is inaccurate.
AI guidance
In August 2021, the PCPD published the Guidance on the Ethical Development and Use of Artificial Intelligence (AI Guidance) to provide recommendations primarily for organisations that develop and use AI systems involving the use of personal data.
The AI Guidance recommends that organisations embrace
three
core data stewardship values (Values), being:
- respectful;
- beneficial; and
- fair.
It also encourages organisations to adopt the
seven
internationally recognised ethical principles (Ethical Principles) for AI:
- accountability;
- human oversight;
- transparency and interpretability;
- data privacy;
- fairness;
- beneficial AI, and
- reliability, robustness and security.
To ensure the Values and the Ethical Principles are practicable, organisations should take into consideration the recommended practices in the following areas, as set out in the AI Guidance, when they develop and use AI and formulate appropriate policies, practices and procedures:
- establishing AI strategy and governance;
- conducting risk assessment and human oversight;
- executing development of AI models and management of AI systems; and
- fostering communication and engagement with stakeholders.
Model framework
On 11 June 2024, the PCPD published the Artificial Intelligence: Model Personal Data Protection Framework (Model Framework). The Model Framework provides recommendations on the best practices for organisations that procure, implement and use any type of AI systems or solutions involving the use of personal data, including predictive AI and generative AI.
Similar to the AI Guidance, the Model Framework outlines recommended measures to ensure the implementation of the Values and the Ethical Principles. Organisations should consider these recommended practices in the following areas when procuring, implementing and using AI solutions, as well as when formulating appropriate policies, practices and procedures:
- establishing AI strategy and governance;
- conducting risk assessment and human oversight;
- executing customisation of AI models and implementation and management of AI systems; and
- fostering communication and engagement with stakeholders.
An evolving landscape
While the AI Guidance and the Model Framework do not impose mandatory requirements and their recommendations are not exhaustive, their publication is a significant step towards supporting the responsible and ethical development of AI in Hong Kong. Given the rapid development and groundbreaking advancement of AI, it is likely that the relevant legal and regulatory landscape in Hong Kong will continue to evolve to address new issues and challenges.
For the time being, data users must ensure they comply with the PDPO and the six DPPs, and follow the best practice recommendations in the AI Guidance and the Model Framework, especially when it comes to the collection, use and retention of personal data during the development, operation and use of AI.
