News and developments
Key points of AI data protection and privacy regulations in Hong Kong
As AI technology becomes more advanced and integrated into businesses and everyday life, it is crucial for Hong Kong’s data protection laws and regulations to keep pace. This article provides an overview of the current legal and regulatory framework of data protection and privacy in Hong Kong in the context of AI.
In Hong Kong, the primary law governing data protection is the Personal Data (Privacy) Ordinance (PDPO). Additionally, the Office of the Privacy Commissioner for Personal Data (PCPD) has provided guidance on the ethical development and use of AI and the model framework for organisations that procure, implement and use AI systems.
PDPO and DPPs
The PDPO is technology-neutral and principle-based. Section 2 of the PDPO defines a “data user” as a person who controls the collection, holding, processing or use of personal data.
Accordingly, any individual, entity, organisation or business that develops and/or uses AI systems involving the handling of personal data is likely to be considered a data user and must adhere to the following six data protection principles (DPPs) in schedule 1 of the PDPO, among other requirements under the PDPO:
Author: Sam Wu, Partner at YYC Legal
-
- DPP 1 (Purpose and manner of collection): Personal data must be collected in a lawful and fair manner for a lawful purpose directly related to the data user��s function or activity. The data collected shall be necessary and adequate but not excessive for such purpose;
- DPP 2 (Accuracy and duration of retention): The data user must take all practicable steps to ensure that personal data is accurate, up to date and not kept longer than necessary;
- DPP 3 (Use): Personal data can only be used for the purposes for which it was collected, unless express and voluntary consent has been obtained from the data subjects for any other purposes;
- DPP 4 (Security): Reasonable security measures must be taken to protect personal data from unauthorised or accidental access, processing, erasure, loss or use;
- DPP 5 (Openness): The data user must be open about its policies and practices in relation to personal data, the kind of personal data it holds, how it is used and the main purposes for which personal data is held; and
- DPP 6 (Access and correction): Data subjects shall have the right to request access to and correction of their own personal data if it is inaccurate.
-
- respectful;
- beneficial; and
- fair
-
- accountability;
- human oversight;
- transparency and interpretability;
- data privacy;
- fairness;
- beneficial AI, and
- reliability, robustness and security.
-
- establishing AI strategy and governance;
- conducting risk assessment and human oversight;
- executing development of AI models and management of AI systems; and
- fostering communication and engagement with stakeholders.
-
- establishing AI strategy and governance;
- conducting risk assessment and human oversight;
- executing customisation of AI models and implementation and management of AI systems; and
- fostering communication and engagement with stakeholders.
Author: Sam Wu, Partner at YYC Legal