Report 5189

Half of 48 organisations checked by Hong Kong's privacy watchdog collect or use personal information through artificial intelligence (AI) systems, with most having contingency plans for data breaches.

The Office of the Privacy Commissioner for Personal Data said on Monday no contravention of privacy laws was found during the compliance checks conducted from February to May this year.

The checks covered 60 local organisations across sectors such as telecommunications, banking, retail, education, public utilities and government departments.

Among them, 48 used AI in their daily operations, with most having done so for more than a year.

The watchdog also found that 24 organisations collected or used personal data through AI systems. Nineteen retained the data, although the retention periods were specified.

All 24 organisations had alerted users and also specified the purposes for which their data was to be used, it added.

Among the 24 organisations, 22 had formulated data breach response plans to address contingencies.

Privacy Commissioner Ada Chung Lai-ling, who presented the findings at a Legislative Council panel meeting on Monday, said she was satisfied the businesses' awareness of privacy risks of using AI had increased.

She cited a separate survey last year showing that of 442 local enterprises polled, 69 per cent were aware the use of AI in their operations posed privacy risks. But only 28 per cent had developed policies on AI security risks.

Legislator Tik Chi-yuen called for tighter privacy laws to tackle AI-related risks.

But Chung argued: "The current privacy law is a piece of legislation that is technology-neutral and principle-based. The law applies equitably to any technical means of collecting, using, storing, retaining and transferring personal data.

"No matter what form of technology you use, if you breach the provisions, you commit an offence."

Legislator Tang Fei also expressed concerns that many of the AI systems were developed by Western companies.

"There should be more public education to warn residents against the risk of having their digital footprints and personal data being collected by those firms, especially amid the tense geopolitical environment," Tang said.

Chung urged the public not to provide too much personal and sensitive information when using AI programmes or chatbots.

"The AI system may obtain the information, which could then be used to train AI algorithms," she said. "We will strengthen relevant public education."

Chung added the watchdog had issued various guidelines on the use of AI in recent years. It also launched an AI security hotline in March.

Her office will publish a storybook for primary school pupils to publicise the importance of respecting and protecting privacy.

At Monday's panel meeting, legislators were also briefed on the results of a recent visit by a Hong Kong government delegation led by Chief Executive John Lee Ka-chiu to Zhejiang province in mainland China.

Officials said the four-day visit in April brought about "fruitful achievements, including the establishment of the Hong Kong-Zhejiang Cooperation Conference mechanism to deepen cooperation.

"Both sides reached consensus on 51 items under 13 cooperation areas, with a view to better serving national development and promoting mutually beneficial cooperation of the two places in all respects," said Clement Woo Kin-man, undersecretary for constitutional and mainland affairs.

Four cooperation agreements were also signed, covering areas of innovation and technology, housing, economic and trade cooperation, and youth development, Woo told the panel.

Hong Kong has established regional cooperation mechanisms with Beijing, Shanghai, Guangdong, Shenzhen, Fujian, Sichuan, Hubei, Chongqing, Zhejiang and the Pan-Pearl River Delta region.