On 18 July 2023, the Personal Data Protection Commission (PDPC) published the Proposed Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (Proposed Guidelines). The Proposed Guidelines clarify how the Personal Data Protection Act 2012 (PDPA) applies to the collection and processing of personal data to develop and train systems that embed machine learning models to make autonomous decisions or to generate recommendations and predictions (AI Systems).
Comments on the Proposed Guidelines are accepted until 31 August 2023.
Consent Exceptions
When using personal data to develop an AI System, organisations may rely on the Business Improvement Exception or Research Exception in lieu of obtaining individuals’ consent. However, organisations are urged to conduct a data protection impact assessment to identify and mitigate potential risks.
Good Data Protection Practices
In any event, when designing, training, testing or monitoring AI Systems using personal data, organisations should:
Consent must be obtained to collect and use personal data for processing by an AI System, unless an exception applies.
Before obtaining such consent, individuals must be sufficiently informed about the types of personal data that will be collected and processed and the purpose for their processing, including the function of the product that uses an AI System (e.g., to suggest a shop), why processing personal data is relevant to the product feature (e.g., suggestions rely on an analysis of previous shopping habits) and what specific personal data will influence the product feature (e.g., amount spent or items purchased).
To be fair and reasonable, organisations should be transparent in their data protection policies about their practices and safeguards when using personal data in AI Systems.
A service provider that develops and deploys bespoke AI Systems for an organisation is a data intermediary under the PDPA. As a data intermediary, a service provider should keep track of data that were used to form training datasets and log the transformation of those data and support the organisation in complying with its PDPA obligations (e.g., by explaining how the AI System operates in simple language, so that the organisation can provide the necessary notices to individuals concerned).
While service providers should provide support as data intermediaries, organisations still bear primary responsibility for ensuring that the AI System they use enables their compliance with the PDPA.
As organisations eagerly incorporate AI Systems in their operations to improve efficiency, they should also be mindful of their regulatory obligations when using personal data to develop or deploy AI Systems. The Proposed Guidelines are helpful in guiding organisations on using AI Systems in a manner that complies with the PDPA.
OrionW regularly advises clients on data protection matters. For more information about how to comply with the Personal Data Protection Act 2012, or if you have questions about this article, please contact us at info@orionw.com.
Disclaimer: This article is for general information only and does not constitute legal advice.
