In brief
On 18 July 2023, the PDPC issued two public consultation papers, seeking views on: (a) the proposed clarifications on how the PDPA applies to the collection and use of personal data to develop and deploy artificial intelligence (AI) systems that embed machine learning models used to make decisions, recommendations or predictions; and (b) the proposed Advisory Guidelines on the PDPA for children’s personal data, covering issues such as obtaining children’s consent, using children’s personal data and according higher standards of protection to children’s personal data.
Key takeaways
The issuance of the public consultation papers signals the PDPC’s continued commitment to encouraging the responsible development and adoption of AI technology, and the need to protect children especially in a digital environment.
The public consultation documents can be accessed here and here. Interested parties may submit their views to the PDPC by 31 August 2023.
In more detail
The PDPC issued two public consultation papers on 18 July 2023.
The first relates to the Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems under the PDPA (“AI Advisory Guidelines“). The AI Advisory Guidelines clarify how the PDPA applies to the collection and use of personal data by organizations to develop and deploy systems that embed machine learning models, which are used to make decisions autonomously or to assist a human decision-maker through recommendations and predictions.
The AI Advisory Guidelines rely on the present notification and accountability obligations to encourage organizations to take additional measures in relation to AI systems. Organizations adopting AI systems should consider providing additional information on the following in crafting their notifications:
- The function of their product that requires collection and processing of personal data (e.g., recommendation of movies)
- A general description of types of personal data that will be collected and processed (e.g., movie viewing history)
- Explanation of how the processing of personal data collected is relevant to the product feature (e.g., analysis of users’ viewing history to make movie recommendations)
- Identification of specific features of personal data that are more likely to influence the product feature (e.g., whether a movie was viewed completely, viewed multiple times, etc.)
As for the accountability obligation, the AI Advisory Guidelines encourage organizations to provide more information on data quality and governance measures taken during AI System development, only if such information is deemed relevant and doing so does not compromise security, safety or commercial confidentiality.
The second relates to the Advisory Guidelines on the PDPA for Children’s Personal Data, currently contained in Chapter 8 of the PDPC’s Advisory Guidelines on the PDPA for Selected Topics. The public is invited to provide feedback on, among others, the age threshold on when a child can give valid consent on their own behalf, and the adequacy of measures that an organization should take to ensure higher standards of protection of children’s personal data.
* * * * *
For further information and to discuss what this might mean for you, please get in touch with your usual Baker McKenzie contact.
* * * * *
© 2023 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
