You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

May 9, 2023

AI, Privacy, and Data Protection: Legal Considerations in Southeast Asia

Subscribe to Updates

The significance of artificial intelligence (AI) is rapidly increasing worldwide, and Southeast Asia is no exception, as it plays a leading role in the technological development of many industries. AI has already proven its importance for driving business growth in areas such as e-commerce, finance, and healthcare, but its remarkable potential also raises concerns around privacy. As AI systems are designed to collect and process large amounts of data to improve their operation, it is necessary to balance the development of technology with the protection of individuals’ privacy.

Current Frameworks in Southeast Asia

This concern has been on regional policymakers’ agendas for many years. The ASEAN Framework on Personal Data Protection, which was adopted in 2016, is not legally binding and has no enforcement mechanism, but it serves as a guide for ASEAN member states in developing their own data protection laws and regulations.

Domestic data privacy laws are currently in force in five ASEAN member countries—Indonesia, Malaysia, the Philippines, Thailand, and Singapore—while Vietnam’s Personal Data Protection Decree is scheduled to take effect on July 1, 2023. This presents a challenge for ASEAN members, as adopting AI-related technology can further complicate data protection efforts due to the amount of personal data AI systems collect, as well as the complexity of the data used to train the AI algorithm.

Some ASEAN members have also made progress in regulating AI. For instance, Singapore released the Model AI Governance Framework in 2019 and launched the AI Governance Testing Framework and Toolkit in 2022—the world’s first such framework. Similarly, Thailand issued the Artificial Intelligence Ethics Guideline in 2019 to help government agencies in the development, promotion, and use of AI, and in 2023 adopted the Thailand Artificial Intelligence Guidelines to help the private sector develop AI-related work. These guidelines primarily focus on principles and ethics in developing AI-related technology, but lack a step-by-step implementation process that connects with privacy laws. Despite these early steps by some countries in ASEAN, there are no regional policies or consensus frameworks on how to implement and regulate AI in accordance with privacy laws in ASEAN member countries.

Legal Risks

If AI-related technology is developed without consideration for data protection, there is a risk of breaching personal data and affecting numerous data subjects, potentially resulting in mass litigation. Moreover, the lack of robust privacy laws and frameworks in many ASEAN member countries, coupled with the growing use of AI-related technology, also increases the risk of legal liabilities for companies that make use of this increasingly common technology.

In the event of a data breach or misuse of personal data, affected individuals may seek legal recourse against the companies that collected and processed their personal information. Such legal actions can result in significant financial and reputational damages for businesses, highlighting the need for effective data protection regulations and AI-related technology frameworks in ASEAN countries.

Technology companies with connections to developing AI systems are especially vulnerable. With the vast amount of data required for developing AI systems, these companies will face the challenge of lawfully collecting and processing data from a huge range of sources and data subjects.

Outlook

As AI-related technology continues to evolve and play a crucial role in the growth of many industries in Southeast Asia, it is important to ensure that its development is balanced with the protection of individuals’ privacy. While some ASEAN members have made progress in adopting AI regulations, more needs to be done to enforce data privacy laws and develop consensus frameworks for regulating AI in accordance with privacy laws. Such efforts will not only help protect individuals’ privacy but also mitigate legal risks associated with the use of AI-related technology. ASEAN member countries must continue to work together to achieve a balance between technological development and data protection in support of sustainable and ethical innovation for our digital future.

Related Professionals

Industries

Technology

Locations

RELATED INSIGHTS​ 

June 6, 2022
Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) entered into force in full on June 1, 2022. The PDPA, which contains similarities to the EU’s General Data Protection Regulation (GDPR) introduces obligations and restrictions relating to the collection, use, and disclosure of personal data in Thailand. While the new law applies to franchisors and franchisees in the same way that it applies to other businesses, there are a number of issues that are of specific importance in franchise businesses. As franchisors and franchisees have the power and duty to make decisions concerning the collection, use, and disclosure of customers’ and employees’ personal data in the course of their operations, they are considered “data controllers” under the PDPA. The Trade Competition Commission of Thailand, via its Notification on the Guidelines for the Consideration of Unfair Trade Practices in Franchise Businesses issued under the Trade Competition Act B.E. 2560 (2017), defines a franchise relationship as one which, among others, involves an element of control by the franchisor over the business operations of the franchisee. It follows then that in some situations, franchisees’ collection, use, and disclosure of personal data will be according to the instructions of their franchisors. In such circumstances, a franchisee will be considered a “data processor” under the PDPA. Whether acting as data controllers or data processors, franchisors and franchisees must nonetheless comply with the requirements of the PDPA in the course of their operations. To ensure their activities are in compliance with the law, franchise businesses should consider five major actions: 1. Auditing existing data collection and retention practices Whether operating online or via a brick and mortar shop, it is increasingly common for franchise businesses to store and process customers’ personal data. This may include the storage and transmission of credit card information for auto-billing
Read More
April 26, 2022
During the first quarter of 2022, Thailand’s Securities and Exchange Commission (SEC) announced a series of notifications aiming to strengthen the regulatory regime for digital assets while safeguarding investors’ interests. The updated rules and conditions apply to digital asset business operators licensed by the SEC. The key features of the new notifications, which took effect in March and April 2022, are summarized below. Custody of customers’ assets (effective March 1, 2022) As custodians of their customers’ assets, digital asset business operators must: Segregate customers’ assets in their custody so that the operators can clearly identify which assets belong to which investors. If customers’ digital assets are to be deposited with a third party, the operators must inform the customers accordingly. Refrain from seeking benefits from customers’ assets in any manner other than the purpose for which the assets are held. This includes refraining from using customers’ assets to provide benefits to others or to the customers themselves, and from depositing customers’ digital assets with a custodian that intends to lend out the digital assets (but does not include giving the customer’s assets to a licensed digital asset fund manager for investment in digital assets). Reconcile customers’ assets and keep evidentiary documentation for a period of at least five years. Privacy coin services (effective April 1, 2022) Digital asset business operators are prohibited from providing privacy coin services that can conceal (or allow the concealing of) specific transactional information, such as data about the transferor, the transferee, and the transfer amount. Digital asset business operators that provided privacy coin services to customers before the effective date of these new regulations may continue to provide such services, but they must arrange for their customers to disclose at least the required transactional information or agree not to engage in information concealment. Digital
Read More
March 10, 2022
On March 7, 2022, the government of Vietnam issued Resolution No. 27/NQ-CP (“Resolution 27”) approving the promulgation of the latest version of the Draft Decree on Personal Data Protection (“Draft PDPD”) prepared by the Ministry of Public Security (“MPS”), and further instructed the MPS to pass this draft to the National Assembly’s Standing Committee for final consideration. Although the full content of the approved Draft PDPD has not been made available to the public, Resolution 27 clearly sets out several circumstances approved by the government in which processing of personal data can be carried out without the consent of the data subjects. In comparison with the corresponding provision under the widely seen version of the Draft PDPD made available to the public in February 2021 (“February Draft”), the main differences are as follows: If the data processing is necessary in response to an emergency situation that threatens the life, health, or safety of the data subject or other individual, the data controller, data processor, data controller/processor, or a third party can process the personal data without consent of the data subject, but they are responsible for proving that the situation is an emergency. The February Draft did not mention any requirement of proof. Moreover, “safety of the data subject or other individual” is a newly added criterion for personal data processing without consent under this circumstance. If the data processing is necessary because of national defense and security requirements, the processing must be carried out by competent authorities in accordance with other laws. The requirement that the processing must be carried out “by competent authorities” in this circumstance was not provided under the February Draft. Two circumstances have been removed: the processing of personal data in compliance with specific provisions that explicitly allow the processing of personal data without
Read More
March 8, 2022
On February 15, 2022, Thailand’s cabinet approved in principle a package of incentives to promote electric vehicle (EV) adoption in Thailand, with the aim of making the country an EV manufacturing hub in Asia. A week later, the cabinet approved further draft regulations including specific information on customs duty reductions and exemptions for certain types of imported EVs. The plan includes both tax and non-tax incentives from 2022 until 2025. In the first two years (2022–2023), the package incentivizes the widespread use of EVs in Thailand by providing exemption or reduction of import duties and excise tax, as well as subsidies to increase the demand for EVs and attract investment in the EV industry. These incentives will cover the importation of completely built up (CBU) cars and motorcycles, and the local manufacturing of completely knocked down (CKD) vehicles in Thailand. For the following two years (2024–2025), the plan promotes the use of domestically produced EVs by eliminating the exemption or reduction of import duties for CBU vehicles while maintaining the other incentives (e.g., reduced excise tax rates, and subsidies). The aim of this is to make the cost of CBU vehicles higher than locally produced vehicles to encourage operators to produce EVs in the country to meet increasing demand. Additional measures encourage the manufacturing of EVs in Thailand, including exemption of import duties for parts imported between 2022 and 2025, and treatment of the value of imported battery cells as a cost of local manufacturing (up to 15% of an EV’s retail price). This is beneficial to local manufacturers of EVs, as their activities will be entitled to a more generous incentive package than importation of EVs. At their meeting on February 22, 2022, Thailand’s cabinet further approved draft subordinate regulations, including specific reductions and exemptions of customs duty
Read More