You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

May 9, 2023

AI, Privacy, and Data Protection: Legal Considerations in Southeast Asia

Subscribe to Updates

The significance of artificial intelligence (AI) is rapidly increasing worldwide, and Southeast Asia is no exception, as it plays a leading role in the technological development of many industries. AI has already proven its importance for driving business growth in areas such as e-commerce, finance, and healthcare, but its remarkable potential also raises concerns around privacy. As AI systems are designed to collect and process large amounts of data to improve their operation, it is necessary to balance the development of technology with the protection of individuals’ privacy.

Current Frameworks in Southeast Asia

This concern has been on regional policymakers’ agendas for many years. The ASEAN Framework on Personal Data Protection, which was adopted in 2016, is not legally binding and has no enforcement mechanism, but it serves as a guide for ASEAN member states in developing their own data protection laws and regulations.

Domestic data privacy laws are currently in force in five ASEAN member countries—Indonesia, Malaysia, the Philippines, Thailand, and Singapore—while Vietnam’s Personal Data Protection Decree is scheduled to take effect on July 1, 2023. This presents a challenge for ASEAN members, as adopting AI-related technology can further complicate data protection efforts due to the amount of personal data AI systems collect, as well as the complexity of the data used to train the AI algorithm.

Some ASEAN members have also made progress in regulating AI. For instance, Singapore released the Model AI Governance Framework in 2019 and launched the AI Governance Testing Framework and Toolkit in 2022—the world’s first such framework. Similarly, Thailand issued the Artificial Intelligence Ethics Guideline in 2019 to help government agencies in the development, promotion, and use of AI, and in 2023 adopted the Thailand Artificial Intelligence Guidelines to help the private sector develop AI-related work. These guidelines primarily focus on principles and ethics in developing AI-related technology, but lack a step-by-step implementation process that connects with privacy laws. Despite these early steps by some countries in ASEAN, there are no regional policies or consensus frameworks on how to implement and regulate AI in accordance with privacy laws in ASEAN member countries.

Legal Risks

If AI-related technology is developed without consideration for data protection, there is a risk of breaching personal data and affecting numerous data subjects, potentially resulting in mass litigation. Moreover, the lack of robust privacy laws and frameworks in many ASEAN member countries, coupled with the growing use of AI-related technology, also increases the risk of legal liabilities for companies that make use of this increasingly common technology.

In the event of a data breach or misuse of personal data, affected individuals may seek legal recourse against the companies that collected and processed their personal information. Such legal actions can result in significant financial and reputational damages for businesses, highlighting the need for effective data protection regulations and AI-related technology frameworks in ASEAN countries.

Technology companies with connections to developing AI systems are especially vulnerable. With the vast amount of data required for developing AI systems, these companies will face the challenge of lawfully collecting and processing data from a huge range of sources and data subjects.

Outlook

As AI-related technology continues to evolve and play a crucial role in the growth of many industries in Southeast Asia, it is important to ensure that its development is balanced with the protection of individuals’ privacy. While some ASEAN members have made progress in adopting AI regulations, more needs to be done to enforce data privacy laws and develop consensus frameworks for regulating AI in accordance with privacy laws. Such efforts will not only help protect individuals’ privacy but also mitigate legal risks associated with the use of AI-related technology. ASEAN member countries must continue to work together to achieve a balance between technological development and data protection in support of sustainable and ethical innovation for our digital future.

Related Professionals

Industries

Technology

Locations

RELATED INSIGHTS​ 

February 21, 2022
On February 14, 2022, Thailand’s Securities and Exchange Commission (SEC) announced a public hearing period on proposed advertising regulations for digital asset businesses. The public hearing period is now open for general comments until March 15, 2022. In the announcement, the SEC expressed their intention to provide clear digital asset advertising principles that conform to regulations in other countries, such as Singapore, the UK, and Japan. The SEC, in a meeting on February 3, agreed that the principles to be developed should apply to all digital asset businesses operating in Thailand. During the public hearing period, any interested parties may comment on the SEC’s proposed principles, which include the following key points: Advertisements that educate, inform, or give facts about digital assets, investments or services, or that provide an overall picture of digital assets, must not exaggerate, distort, or conceal information, or otherwise mislead consumers. In addition, advertisements that refer to customer numbers must only indicate the number of customers who have received approval to open an account and who are ready to use the service. Advertisements must be clear and appropriate, provide a warning on investment risks, and include clear and noticeable SEC-mandated statements in the font size stipulated by the SEC. Advertisements that present positive information or suggest an opportunity to receive returns must provide a balanced view that also discloses negative information or states investment risks. Advertisements relating to cryptocurrencies can only be made via a business operator’s official channels (e.g., the operator’s website, app, or other official online channel), and cryptocurrency cannot be advertised in public areas (e.g., billboards, public transportation, websites, newspapers and periodicals, etc.). However, advertisements for the services of a digital assets business can still be made in public areas and other channels. For example, this can be understood as meaning that
Read More
February 15, 2022
The sale of counterfeit goods online is as damaging to government efforts and consumer safety as it is to the reputation of the e-commerce platforms and brand owners involved. In this guest piece, Andy Chua, senior vice president of the IP Rights Protection Team at e-commerce giant Lazada, joins Tilleke & Gibbins’ Suebsiri Taweepon and Ploynapa Julagasigorn to discuss how stakeholders can work together to combat the growing threat of counterfeits online – with recent efforts in Thailand a prime example of effective action. This article, which was first published in World Trademark Review, is the second in a two-part series about trademark enforcement against online counterfeits.   Technological developments, government policy and the covid-19 pandemic have brought about significant changes to the lifestyle and behaviour of ordinary consumers. Shopping increasingly takes place on e-commerce platforms as people become more familiar with online transactions, encouraging many sellers to turn their focus to online platforms. While this shift to online retail has brought benefits for many, it has also provided additional ways for sellers of counterfeit goods to peddle their wares. The sale of counterfeit goods online tarnishes the reputation of e-commerce platforms among users, compromises consumer trust in brand owners’ products and undermines public authorities’ efforts in enforcing anti-counterfeiting policies. This dynamic problem cannot be resolved by a single entity alone. Instead, all stakeholders need to work together to amplify their efforts in consumer and brand protection. Collaborating against counterfeits in Thailand We see such collaborations between stakeholders in regions such as Thailand, where the Department of Intellectual Property (DIP) has signed a memorandum of understanding (MOU) with various parties that are committed to combatting the spread of counterfeit products online. The inaugural signing ceremony for the MOU was held on 11 January 2021, with 20 initial signatories drawn
Read More
January 19, 2022
Thailand has completed the establishment of the Personal Data Protection Commission (PDPC), the regulator under the country’s Personal Data Protection Act B.E. 2562 (PDPA), strongly indicating that the planned full enforcement of the PDPA on June 1, 2022, is likely to proceed as scheduled. The establishment of the PDPC was finalized on January 18, 2022, when the Announcement of the Prime Minister’s Office on the Appointment of Chairperson and Honorary Members of the PDPC was published in the Government Gazette. As stipulated in the PDPA, the PDPC consists of: The chairperson, appointed based on knowledge, skills, and experience; The vice-chairperson, who is the permanent secretary of the Ministry of Digital Economy and Society; Five commission members, designated based on their positions in certain government agencies (as prescribed under the PDPA); and Nine honorary commission members appointed based on knowledge, skills, and experience in personal data protection, consumer protection, technology and telecommunication, social science, law, health, finance, or other relevant fields. As the vice-chairperson and the five commission members are appointed to the PDPC based on their positions, the January 18 announcement appointing the chairperson and the nine honorary commission members completes the formation of the PDPC. The full enforcement of the PDPA has been previously postponed, and many businesses had expressed concern that another extension would be forthcoming before the current enforcement date. However, the successful establishment of the PDPC is a fundamental prerequisite to enforcement and indicates that the effective date of the PDPA on June 1, 2022, is unlikely to be further postponed. In addition, the PDPA’s draft subordinate regulations that were the subject of a series of public hearings last year are likely to be issued in the near future. Companies and other organizations that are not yet compliant with the PDPA should now assess their
Read More