Artificial Intelligence, Profiling and Automated Decision Making | Hong Kong | Global Data and Cyber Handbook | Baker McKenzie Resource Hub

Start Comparison

Artificial Intelligence, Profiling and Automated Decision Making

Jump to

Artificial Intelligence, Profiling and Automated Decision Making Start Comparison

Are there any restrictions or requirements related to creating profiles of data subjects or utilizing automated decision-making for decisions related to data subjects, including with respect to artificial intelligence?

Last review date: 31 December 2024

No (provided that the provisions of the PDPO are complied with). Please note, however, the PCPD issued non-binding Guidance on the Ethical Development and Use of Artificial Intelligence in August 2021 and the Artificial Intelligence: Model Personal Data Protection Framework in June 2024.

If such restrictions or requirements exist, are they subject to any exceptions?

Last review date: 31 December 2024

N/A

Has the data privacy regulator issued guidance on data privacy and artificial intelligence, automated decision-making or profiling?

Last review date: 31 December 2024

Yes

If yes, please provide brief details and a link.

The PCPD issued the Guidance on the Ethical Development and Use of Artificial Intelligence in August 2021 and the Artificial Intelligence: Model Personal Data Protection Framework in June 2024, both being non-binding guidelines.

Has the data privacy regulator taken enforcement action in relation to artificial intelligence, including automated decision-making or profiling?

Last review date: 31 December 2024

No enforcement activity to date

While there has been no formal enforcement activity to date, the PCPD carried out a compliance check on 28 local organizations from August 2023 to February 2024 to understand their practices in relation to the collection, use and processing of personal data in the development or use of AI, as well as the AI governance structure of the relevant organizations. No contravention of the PDPO was identified.

Do other (non-personal data or cybersecurity) laws or regulations impose restrictions on use of artificial intelligence, automated decision-making or profiling?

Last review date: 31 December 2024

Non-binding guidance or principles issued or in progress

If yes, please provide brief details and a link.

The Office of the Government Chief Information Officer (OGCIO) released an Ethical Artificial Intelligence Framework (August 2023) that complements the PCPD's Guidance on the Ethical Development and Use of Artificial Intelligence. Specifically, it sets out 12 ethical AI principles to be followed when designing and developing AI applications, consisting of 10 general principles and two performance principles, namely transparency and interpretability on the one hand, and reliability, robustness and security on the other. The framework provides use cases and an assessment template to guide organizations implementing AI. The framework also introduces concepts such as the AI lifecycle and provides details on how to conduct AI impact assessments.

The Financial Services and the Treasury Bureau released its Policy Statement on Responsible Application of Artificial Intelligence in the Financial Market in October 2024, which emphasizes the Government’s approach to AI in the financial market and the importance of formulating a risk-based AI governance strategy.

There are also sector-specific non-binding guidance.

The HKMA published High-level Principles on Artificial Intelligence, which include governance, application design and development, and ongoing monitoring and maintenance obligations. The HKMA has also released Artificial Intelligence in Banking: The Changing Landscape in Compliance and Supervision and Artificial Intelligence and Big Data in the Financial Services Industry: A Regional Perspective and Strategies for Talent Development to inform business strategy and assist in compliance. In addition, the HKMA has also issued a set of Guiding Principles on Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence by Authorised Institutions relating to the use of AI for reference by banks. These principles concern four key areas, namely governance and accountability, fairness, transparency and disclosure, and data privacy and protection. In response to the prevalence of generative AI, the HKMA has issued a set of guidelines on Consumer Protection in respect of Use of Generative Artificial Intelligence.

The Hong Kong Securities and Futures Commission (SFC) issued a Circular to licensed corporations - Use of generative AI language models in November 2024. In the circular, the SFC reminds licensed corporations of the risks in relation to AI language models and the notification requirements if a licensed corporation intends to adopt AI language models in high-risk use cases. It also lays down core principles in relation to AI language models, including (i) senior management responsibilities, (ii) AI model risk management, (iii) cybersecurity and data risk management, and (iv) third party provider risk management.

The Mandatory Provident Fund Schemes Authority has also issued Guidance on Offering Robo-Advisor Service, and the Insurance Authority has published an article titled “Chatting about Chatbots and AI”.