Artificial Intelligence: Model Personal Data Protection Framework

What it is

The Artificial Intelligence: Model Personal Data Protection Framework is guidance from the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD). It was published on 11 June 2024. It gives organisations a set of recommendations and best practices for procuring, implementing and using any type of AI system that involves personal data, including predictive and generative AI.

The framework builds on the PCPD’s 2021 Guidance on the Ethical Development and Use of Artificial Intelligence. That guidance set three Data Stewardship Values (being respectful, being beneficial and being fair) and seven Ethical Principles for AI (accountability, human oversight, transparency and interpretability, data privacy, fairness, beneficial AI, and reliability, robustness and security). The 2024 framework turns those into practices for organisations that buy AI rather than build it.

Who it applies to

The framework is aimed at organisations that procure AI solutions from third parties and handle personal data when customising an AI system for a specific use or when operating it. That covers government, public bodies and private sector companies. It refers to the developers and vendors who supply those solutions as AI suppliers. Organisations that develop AI models in-house are pointed to the 2021 guidance instead.

Its legal anchor is the Personal Data (Privacy) Ordinance (PDPO) and the six Data Protection Principles in its Schedule 1, which cover personal data from collection to destruction. The framework itself is not binding, but the PDPO is.

What it requires

The framework recommends measures in four areas, applied in proportion to the risk an AI system poses.

1. AI strategy and governance. Top management should own an AI strategy that defines what AI is for, sets ethical principles for its use, identifies unacceptable uses, establishes an AI inventory and sets internal policies with escalation criteria. Procurement should include governance considerations for choosing AI suppliers. An AI governance committee, or a similar body reporting to the board, should oversee AI across the organisation, with clear roles and staff training.

2. Risk assessment and human oversight. Organisations should assess each AI system’s risks before use and again when there are significant changes. Factors include PDPO requirements, the volume, sensitivity and quality of the data, data security, the probability and severity of privacy risks, and the wider impact on individuals, the organisation and the community. The assessment sets the level of human oversight.

• Human-in-the-loop for high-risk systems. People retain control of decisions to prevent or mitigate errors or improper output.
• Human-in-command where risks are not negligible but human-in-the-loop is not practicable or cost-effective. People use the output, oversee the system and intervene when needed.
• Human-out-of-the-loop for minimal or low-risk systems. The system decides without human intervention.

3. Customisation, implementation and management of AI systems. This covers preparing data for customisation in line with the PDPO, testing and validating AI solutions, user acceptance testing before integration, security measures for the system and its outputs, and continuous monitoring. Monitoring includes logging inputs, re-assessing risks, watching for model drift and maintaining an AI Incident Response Plan. Where an AI incident involves a data breach, the data breach response plan should run alongside it.

4. Communication and engagement with stakeholders. Organisations should tell people when AI is used, support data subject access and correction requests, provide feedback channels, explain AI decisions and output where feasible, and use plain language.

Key dates

• August 2021. The PCPD publishes its Guidance on the Ethical Development and Use of AI.
• 11 June 2024. The Model Personal Data Protection Framework is published.

The framework has no commencement or transition dates because it is guidance. The PDPO applies now.

How it relates to other frameworks

The framework’s structure will be familiar to anyone who knows Singapore’s Model AI Governance Framework. Both start with internal governance, both set human involvement by the probability and severity of harm, and both end with stakeholder communication. The PCPD’s version is narrower in that it is centred on personal data and written for buyers of AI.

For AI built and used by the Hong Kong Government, and for general reference, the Digital Policy Office’s Ethical AI Framework and its Generative AI Technical and Application Guideline sit alongside this framework. The PCPD itself names ISO/IEC 23894 as a framework an AI governance committee may consult on risk management. An organisation working to ISO/IEC 42001 or the NIST AI Risk Management Framework will already have most of the governance structure the PCPD describes. The Hong Kong-specific work is mapping each AI system’s personal data handling to the six Data Protection Principles.

A note on this page

This is Aicura’s reading of the framework, written to help you understand it. It is not legal advice and it is not the framework itself. Read the primary document from the PCPD, and take advice on how the Personal Data (Privacy) Ordinance applies to your organisation.