Singapore – New AI guide on synthetic data generation proposed

The Guide sets out guidance for organisations in respect of the various techniques and potential use cases of synthetic data generation. Although the Guide is non-binding, organisations and their CIOs, CTOs, CDOs, as well as data scientists, data protection practitioners, and technical decision-makers involved in generating or using synthetic data are encouraged to refer to the Guide and the guidance and best practices it prescribes.

We have summarised the key guidance of the Guide below.

What is synthetic data and what are the risks associated with the use of this data?

To foster innovation and comply with data regulations, synthetic data generation has emerged as a widely utilised form of Privacy Enhancing Technology (“PET”).

Synthetic data is fictitious data which is created using purpose-built mathematical models or algorithms. These models and algorithms may be trained on datasets which mimic the characteristics and structure of source data.

This means there is a risk that personal data or confidential information can still be leaked due to the resemblance of the synthetic data to the primary source data.

Overview of recommendations in the Guide

The Guide divides the generation process of fully synthetic data into five steps with recommendations and checklists for organisations to adopt:

Step 1: Know Your Data

• Organisations should understand the purpose, use cases, and source data before generating synthetic data. Additional considerations should be given if (1) the trends/insights of source data are sensitive; or (2) the synthetic data will be released publicly.
• Contractual obligations may be imposed on the synthetic data recipient to prevent re-identification attacks. By determining an acceptable re-identification risk level and the expected data utility, organisations will be in a better position to assess trade-offs between data protection risk and data utility.

Step 2: Prepare Your Data

• Organisations should identify key insights necessary to be preserved for meeting business objectives. Based on the identified insights, they should apply data minimisation techniques to extract relevant data attributes. For granular information which is not necessary, organisations should consider generalising or adding noise to the data to reduce re-identification risks.

Step 3: Generate Synthetic Data

• Organisations are advised to choose the most appropriate data generation method based on their use cases, data objectives, and data types. The Guide highlights six generation methods and their respective suitability and limitations. The Guide also provides comprehensive performance metrics for organisations to perform quality checks to ensure the integrity, fidelity, and utility of the generated data.

Step 4: Assess Re-Identification Risks

• Re-identification risks should be assessed through an attack-based evaluation. The Guide discusses how re-identification risks could arise through three types of re-identification attacks (namely Singling Out attacks, Linkability attacks and Inference attacks) (see Annex D of the Guide for more information). It also highlights that organisations might align their acceptable re-identification risk level with existing industry guidelines for de-identified/anonymised data. If the risk levels evaluated are unacceptable, organisations should repeat Step 3 to re-generate synthetic data with more data protection controls.

Step 5: Manage Residual Risks

• Organisations are advised to identify and mitigate potential residual risks associated with synthetic data generation. They may consider implementing appropriate technical, governance, and contractual mitigation controls. The Guide offers examples of best practices covering access controls, asset management, risk management, legal controls, and database security. Organisations should also ensure their incident management plans address the risk of data breaches involving synthetic data, synthetic data generator models, and model parameters. In the event of such data breaches, organisations should investigate the incident, understand the root cause and improve its internal safeguards. They are also advised to monitor evidence of actual re-identification or of a possible successful model inversion attack which may result in the reconstruction and disclosure of source data, and assess if it would be a notifiable data breach to PDPC.

Conclusion

The Guide provides valuable insights into harnessing the potential of synthetic data while seeking to strike a balance between data utility and data protection risks in synthetic data generation.

Organisations intending to generate or use synthetic data should take the Guide into consideration.

The Guide will be offered as a resource in the Privacy Enhancing Technology Sandbox. This Sandbox was launched in 2022 by PDPC and Singapore’s Infocomm Media Development Authority as a testing ground for businesses to pilot their PET use cases.