Hong Kong issues Artificial Intelligence – Model Personal Data Protection Framework

Deploying a risk-based approach (although not legally binding), the Framework provides recommendations on best practices for organisations (e.g. government, public bodies and private companies) procuring, implementing and using any type of AI systems (including predictive and generative AI) which involve the use of personal data.

• Establish AI Strategy and Governance

Organisations should establish an internal AI governance strategy comprising of governance considerations for procuring AI solutions, and an AI governance structure with sufficient resources, expertise and authority (e.g. an AI governance committee) to oversee the ethical procurement, implementation and use of AI systems. Relevant personnel should be provided with training on topics such as data protection, cybersecurity risks, and general AI technology.

• Conduct Risk Assessment and Human Oversight

Organisations should conduct comprehensive risk assessments and formulate a risk management system throughout the life cycle of an AI system to identify and mitigate risks, including privacy risks. Adopting a proportionate level of human oversight, organisations may also need to strike a balance when conflicting criteria emerge and make trade-offs as between the criteria when mitigating AI risks to comply with the Ethical Principles for AI (as previously issued by the PCPD in 2021).

• Execute Customisation of AI Models and Implementation and Management of AI Systems

Organisations should (i) comply with the Personal Data (Privacy) Ordinance (“PDPO”) and minimise the amount of personal data involved in customisation and/or use of AI models; (ii) test and validate AI models to ensure reliability, robustness and fairness; (iii) ensure system security and data security by appropriate measures (e.g. red teaming); and (iv) manage and continuously monitor AI systems given that risk factors may change over time. An AI Incident Response Plan is recommended to be established to monitor and address incidents. Regular internal audits should also be conducted.

• Foster Communication and Engagement with Stakeholders

Organisations should communicate, and regularly and effectively engage with stakeholders – including internal staff, AI suppliers, customers, and regulators – regarding AI systems and their impact to ensure transparency and build trust. Data requests should be handled and feedback channels should be provided. Organisations should also ensure that a high degree of explainability accompanies the decisions and output of AI, and use plain language when communicating with stakeholders, in particular consumers.

The Framework is non-exhaustive and, as mentioned, is non-binding. Given the fast-changing risks and concerns surrounding the use of AI, organisations are strongly encouraged to refer to the recommended measures under the Framework in procuring AI.

Organisations should always ensure that AI systems comply with the PDPO and the six Data Protection Principles, and adhere to internationally recognised ethical principles for AI, e.g. accountability, transparency, fairness, and beneficial AI.

Organisations developing in-house AI models are also suggested to refer to the Guidance on the Ethical Development and Use of Artificial Intelligence published by the PCPD in 2021.