You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

May 9, 2023

AI, Privacy, and Data Protection: Legal Considerations in Southeast Asia

Subscribe to Updates

The significance of artificial intelligence (AI) is rapidly increasing worldwide, and Southeast Asia is no exception, as it plays a leading role in the technological development of many industries. AI has already proven its importance for driving business growth in areas such as e-commerce, finance, and healthcare, but its remarkable potential also raises concerns around privacy. As AI systems are designed to collect and process large amounts of data to improve their operation, it is necessary to balance the development of technology with the protection of individuals’ privacy.

Current Frameworks in Southeast Asia

This concern has been on regional policymakers’ agendas for many years. The ASEAN Framework on Personal Data Protection, which was adopted in 2016, is not legally binding and has no enforcement mechanism, but it serves as a guide for ASEAN member states in developing their own data protection laws and regulations.

Domestic data privacy laws are currently in force in five ASEAN member countries—Indonesia, Malaysia, the Philippines, Thailand, and Singapore—while Vietnam’s Personal Data Protection Decree is scheduled to take effect on July 1, 2023. This presents a challenge for ASEAN members, as adopting AI-related technology can further complicate data protection efforts due to the amount of personal data AI systems collect, as well as the complexity of the data used to train the AI algorithm.

Some ASEAN members have also made progress in regulating AI. For instance, Singapore released the Model AI Governance Framework in 2019 and launched the AI Governance Testing Framework and Toolkit in 2022—the world’s first such framework. Similarly, Thailand issued the Artificial Intelligence Ethics Guideline in 2019 to help government agencies in the development, promotion, and use of AI, and in 2023 adopted the Thailand Artificial Intelligence Guidelines to help the private sector develop AI-related work. These guidelines primarily focus on principles and ethics in developing AI-related technology, but lack a step-by-step implementation process that connects with privacy laws. Despite these early steps by some countries in ASEAN, there are no regional policies or consensus frameworks on how to implement and regulate AI in accordance with privacy laws in ASEAN member countries.

Legal Risks

If AI-related technology is developed without consideration for data protection, there is a risk of breaching personal data and affecting numerous data subjects, potentially resulting in mass litigation. Moreover, the lack of robust privacy laws and frameworks in many ASEAN member countries, coupled with the growing use of AI-related technology, also increases the risk of legal liabilities for companies that make use of this increasingly common technology.

In the event of a data breach or misuse of personal data, affected individuals may seek legal recourse against the companies that collected and processed their personal information. Such legal actions can result in significant financial and reputational damages for businesses, highlighting the need for effective data protection regulations and AI-related technology frameworks in ASEAN countries.

Technology companies with connections to developing AI systems are especially vulnerable. With the vast amount of data required for developing AI systems, these companies will face the challenge of lawfully collecting and processing data from a huge range of sources and data subjects.

Outlook

As AI-related technology continues to evolve and play a crucial role in the growth of many industries in Southeast Asia, it is important to ensure that its development is balanced with the protection of individuals’ privacy. While some ASEAN members have made progress in adopting AI regulations, more needs to be done to enforce data privacy laws and develop consensus frameworks for regulating AI in accordance with privacy laws. Such efforts will not only help protect individuals’ privacy but also mitigate legal risks associated with the use of AI-related technology. ASEAN member countries must continue to work together to achieve a balance between technological development and data protection in support of sustainable and ethical innovation for our digital future.

Related Professionals

Industries

Technology

Locations

RELATED INSIGHTS​ 

July 26, 2021
Laos’ first law specifically addressing contracts for electronic transactions comes as a relief to operators who had previously been left to interpret laws on contracts generally in a context for which they were not designed.
Read More
July 23, 2021
To enforce more rigorous control of cross-border advertising activities, the Vietnamese government issued Decree No. 70/2021/ND-CP dated July 20, 2021 (Decree 70), amending and supplementing provisions of Decree No. 181/2013/ND-CP dated November 14, 2013, elaborating on some articles of the Law on Advertising. Decree 70 will take effect on September 15, 2021. According to the Deputy Director of the Authority of Broadcasting and Electronic Information, Decree 70 will allow better control over cross-border advertisement on platforms such as Facebook or YouTube. To that end, Decree 70 stipulates new obligations for these providers while also consolidating executive authority over cross-border advertising activities under the Ministry of Information and Communications (MIC). Revised Obligations for Cross-Border Advertising Services Significantly, Decree 70 overhauls Article 13, which provides the definitions and obligations for cross-border advertising service providers. Accordingly, cross-border advertising services are explained as the utilization of websites hosted outside Vietnam to provide ads targeted at Vietnamese consumers and obtain revenue in Vietnam. Notably, Article 13 defines such websites as a “single or multi-website system …  providing users with services for storage, provision, use, search, or exchange of information, sound or image sharing, forum creation, or live chat to supply advertising services.” This would effectively encompass many types of online environments, specifically social network sites, such as Facebook. In addition, more entities will be taxed on cross-border advertising revenue under Article 13, including not only service providers but also both domestic and overseas advertisers. Under Decree 70, cross-border advertising services must comply with Vietnam’s cybersecurity and intellectual property laws in addition to the Law on Advertising. Decree 70 requires foreign providers of cross-border advertising services to supply the MIC with direct contact information 15 days before commencing cross-border advertising activities in Vietnam. Domestic advertising service providers that cooperate with foreign entities to provide cross-border
Read More
July 7, 2021
According to a recent report, Vietnam ranks second in the world for cryptocurrency ownership. The considerable interest of Vietnamese users has grabbed attention from the government, specifically regarding how it can effectively regulate and potentially utilize this type of currency.
Read More