No violations found in checks on 28 organizations develop or use AI, says privacy watchdog

Companies are urged to ensure their AI systems are in full compliance with privacy laws, after the privacy watchdog carried out checks on them to understand their practices concerning the collection, use, and processing of personal data in the development or use of AI.

Twenty-eight local organizations were examined in a recent series of compliance checks conducted by the Office of the Privacy Commissioner for Personal Data.

The checks, which took place from August of last year until the present, revealed no violations of the Personal Data (Privacy) Ordinance were found.

The primary objective of the action was to gain a comprehensive understanding of the practices employed by organizations in collecting, using, and processing personal data in relation to AI development or implementation. The checks also aimed to evaluate the AI governance structures in place within the organizations under review.

Out of the organizations examined, 21 incorporated AI into their day-to-day operations. The applications ranged from data analysis and evaluating job candidates' interview performance to utilizing chatbots for customer inquiries.

Among them, 19 had established internal AI governance frameworks. These frameworks included the establishment of AI governance committees or appointing designated officers responsible for overseeing the development or use of AI products and services.

Ten out of the 21 organizations were engaged in collecting personal data through AI products and services and demonstrated their commitment to data security by implementing appropriate security measures.

These measures included providing Personal Information Collection Statements to data subjects before collecting their data.

Among the ten organizations, eight had conducted privacy impact assessments before developing or using AI products and services. Additionally, these organizations specified the retention period for personal data, ensuring that the data remains protected throughout the development or use of AI products or services. Once the original purpose of data collection is achieved, the data is either deleted or anonymized.

Ada Chung Lai-ling, the Privacy Commissioner for Personal Data, emphasized the dual nature of AI, acknowledging its potential for driving productivity and economic growth while also highlighting the associated personal data privacy and ethical risks. 

"I am pleased to learn that among the organizations reviewed, most organizations established internal AI governance frameworks to oversee the development or use of AI products or services."