AI and Developing Privacy Laws in Asia (Part 2)

Created with Microsoft Bing Image Creator powered by DALL-E

 AI and Developing Privacy Laws in Asia (Part 2)

(this is a continuation of an the earlier post, AI and Developing Privacy Laws in Asia). 

Japan: 

        Regarding AI development, Japan has developed and amended an AI strategy, with the latest updates released on April 2022. AI Strategy 2022 primarily aims to develop AI applications for large scale infrastructure protecting against imminent crises (such as pandemics) and real-world industry applications, as well as promoting research and recruitment of human resources to aid in such advancs in AI technology. Additionally, Japan published a "Governance Guidelines for the Practice of AI Principles" in Feb 1, 2022, focusing on the "social principles of human-centric AI". Some examples include analyzing positive and negative impacts of AI, as well as social acceptance of AI system development; however, these guidelines are not legally binding and serve more as general principles and goals that should be implemented by developers of AI. 

        Similar to Korea, Japan also amended their Protection of Personal Information (APPI) to include the concept of "pseudonymously processed information", which reduces privacy concerns on such data and allows AI to analyze and process it without being as restricted by privacy and security laws. There are also existing laws that can apply privacy concerns to AI, such as the need to obtain consent before using personal data (APPI), or the need to protect user data from unauthorized access (E-commerce Law). However, there are no specific legislation regarding an AI legal framework yet in Japan; it seems privacy concerns relating to AI are largely undertaken by the purpose, notice and consent, and data security requirements for processing personal data laid out in the APPI. According to some reports, there is a draft bill being worked on to create a new legal framework for Ai covering data governance and liability, but it has not been made public yet. 

Singapore:

        On May 25, 2022, Singapore released A.I. Verify, the first AI governance self-test in the world. The test allows companies to demonstrate that they are developing and using responsible AI in an objective and verifiable manner; it notably does not define ethical standards, merely validates the AI developer's claims about approach, use, and verified performance regarding their AI. Although this is as yet a "Minimum Viable Product" (MVP) which still requires further development, this early release allows for continued shaping based on feedback and developing industry needs/standards into a more viable and international self-testing framework. 

        Singapore also created the Smart Nation and Digital Government Group in 2017 to support AI research & development, as well as a $150M fund to support R&D in AI. Following this, Singapore's Personal Data Protection Commission (PDPC) released the Model AI Governance Framework, to provide easily implemented guidelines to for ethical AI usage by organizations. Updated on Jan 21, 2020, it provides guidance on issues such as explaining how AI systems work, building accountability practices, and the need for open and transparent communication.

Source: https://www.pdpc.gov.sg/Help-and-Resources/2020/01/Model-AI-Governance-Framework 

India: 

        As with most other nations, India is still at the beginning stages of legislation regarding AI and privacy; currently the government's priority is the promotion of AI and application, with no currently active legislation targeting AI and privacy. For instance, India has prepared a $1 billion fund for the research and development of AI in its "Digital India" initiative.  However, there are draft bills currently being worked on to improve the situation: this year, India revamped their Digital Personal Data Protection Bill. Instead of laying out data localization standards (as intended in India's scrapped Personal Data Protection Bill), this bill focuses on the rights and duties of the 'digital citizen' and the obligation to lawfully use collected data. It also emphasizes the principles of fairness, lawfulness, transparency, data minimization, storage limitation ,and accountability. Although its scope only covers digital personal data within India, it also establishes the Data Protection Board of India that can provide additional guidance to protect the privacy of Indians. As of now, this bill has yet to be introduced to Parliament and has only recently finished the public discussion and feedback stage, but it nonetheless indicates further attention being put by governments on personal data protection, which can influence AI (since AI depend on processing and analyzing large amounts of data that may include personal data). 

Conclusion: 

        Overall, many leading Asian countries are investing heavily into the development of AI technology, but their state of regulation on AI regarding privacy concerns varies. Some countries, such as China and Korea, have incorporated AI-related developments (such as the use of pseudonymized personal data) into existing privacy protection laws, both to clarify the standards that AI must follow while facilitating AI development in a safe manner. Others, such as Singapore, have focused more on guidelines and voluntary self-regulation or self-testing. There is still much room for development, as Ai legislation is at its embryonic stage for all countries in the world, not just Asia, due to the very recent nature of AI development and application. There is currently no overarching internationally accepted legal framework for AI either, although the EU is in the process of developing one (see here). Given the many possible abuses of AI regarding personal data - both intentional and unintentional - it is crucial for such guidelines and regulations to be developed as soon as possible, so that such concerns can be incorporated into the AI during its development process (similar to Privacy By Design) rather than waiting for problems and damages to occur before designing laws to address them as they occur.