Hong Kong: Adopted PCPD Artificial Intelligence: Model Personal Data Protection Framework including measures on data protection

On 11 June 2024, the Hong Kong Office of the Privacy Commissioner for Personal Data (PCPD) adopted the Artificial Intelligence: Model Personal Data Protection Framework, including data protection regulation. The framework aims to guide organisations in the procurement, implementation, and use of AI technologies, including generative AI, in a manner compliant with the Personal Data (Privacy) Ordinance (PDPO). It provides internationally recognised recommendations and best practices to ensure the protection of personal data privacy amidst the development of AI technologies. Specifically, the framework advises on reducing the usage of personal data, upholding high standards of data quality, and documenting data handling processes. It mandates the validation of AI systems against privacy and ethical benchmarks, the performance of error testing, and the completion of user acceptance testing. Additionally, it emphasises strengthening security through approaches such as red teaming and establishing strict guidelines for data input. It also calls for the implementation of robust mechanisms to ensure the traceability and auditability of AI outputs.