You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

May 9, 2023

AI, Privacy, and Data Protection: Legal Considerations in Southeast Asia

Subscribe to Updates

The significance of artificial intelligence (AI) is rapidly increasing worldwide, and Southeast Asia is no exception, as it plays a leading role in the technological development of many industries. AI has already proven its importance for driving business growth in areas such as e-commerce, finance, and healthcare, but its remarkable potential also raises concerns around privacy. As AI systems are designed to collect and process large amounts of data to improve their operation, it is necessary to balance the development of technology with the protection of individuals’ privacy.

Current Frameworks in Southeast Asia

This concern has been on regional policymakers’ agendas for many years. The ASEAN Framework on Personal Data Protection, which was adopted in 2016, is not legally binding and has no enforcement mechanism, but it serves as a guide for ASEAN member states in developing their own data protection laws and regulations.

Domestic data privacy laws are currently in force in five ASEAN member countries—Indonesia, Malaysia, the Philippines, Thailand, and Singapore—while Vietnam’s Personal Data Protection Decree is scheduled to take effect on July 1, 2023. This presents a challenge for ASEAN members, as adopting AI-related technology can further complicate data protection efforts due to the amount of personal data AI systems collect, as well as the complexity of the data used to train the AI algorithm.

Some ASEAN members have also made progress in regulating AI. For instance, Singapore released the Model AI Governance Framework in 2019 and launched the AI Governance Testing Framework and Toolkit in 2022—the world’s first such framework. Similarly, Thailand issued the Artificial Intelligence Ethics Guideline in 2019 to help government agencies in the development, promotion, and use of AI, and in 2023 adopted the Thailand Artificial Intelligence Guidelines to help the private sector develop AI-related work. These guidelines primarily focus on principles and ethics in developing AI-related technology, but lack a step-by-step implementation process that connects with privacy laws. Despite these early steps by some countries in ASEAN, there are no regional policies or consensus frameworks on how to implement and regulate AI in accordance with privacy laws in ASEAN member countries.

Legal Risks

If AI-related technology is developed without consideration for data protection, there is a risk of breaching personal data and affecting numerous data subjects, potentially resulting in mass litigation. Moreover, the lack of robust privacy laws and frameworks in many ASEAN member countries, coupled with the growing use of AI-related technology, also increases the risk of legal liabilities for companies that make use of this increasingly common technology.

In the event of a data breach or misuse of personal data, affected individuals may seek legal recourse against the companies that collected and processed their personal information. Such legal actions can result in significant financial and reputational damages for businesses, highlighting the need for effective data protection regulations and AI-related technology frameworks in ASEAN countries.

Technology companies with connections to developing AI systems are especially vulnerable. With the vast amount of data required for developing AI systems, these companies will face the challenge of lawfully collecting and processing data from a huge range of sources and data subjects.

Outlook

As AI-related technology continues to evolve and play a crucial role in the growth of many industries in Southeast Asia, it is important to ensure that its development is balanced with the protection of individuals’ privacy. While some ASEAN members have made progress in adopting AI regulations, more needs to be done to enforce data privacy laws and develop consensus frameworks for regulating AI in accordance with privacy laws. Such efforts will not only help protect individuals’ privacy but also mitigate legal risks associated with the use of AI-related technology. ASEAN member countries must continue to work together to achieve a balance between technological development and data protection in support of sustainable and ethical innovation for our digital future.

Related Professionals

Industries

Technology

Locations

RELATED INSIGHTS​ 

May 15, 2023
Southeast Asia’s remarkable growth as a destination for foreign investment—including a 42 percent increase in 2021, according to a joint ASEAN-UNCTAD report—has brought with it innovation as well as the desire to protect that innovation. Investors are increasingly seeking to patent the proprietary technology that is a crucial component of so many businesses today, and a burning question for patent applicants is whether artificial intelligence (AI) technology and software are patentable in Southeast Asia. The short answer is that it depends, as the patent laws in Southeast Asia are not uniform. Is it Patentable? While AI tools tend to be newer, the older and more familiar question is whether computer software is patentable, and many jurisdictions do have specific rules on this issue. Pure software, or software characterized only by source code, may not be patentable, but it can be protected under copyright laws. AI-related software may involve complex algorithms, datasets, and training methodologies that can be challenging to disclose in a manner that satisfies the enablement requirement in practice. Algorithms, mathematical methods, and abstract ideas are often considered non-patentable subject matter in many jurisdictions. While software implementing AI may involve innovative algorithms, securing patents for algorithms alone can be challenging in some jurisdictions. Also, the patent laws of Indonesia, Myanmar, Thailand, and Vietnam specifically list computer programs as unpatentable subject matter. However, a possible workaround would be to describe the software as connected to a tangible medium. This method could overcome an unpatentable subject matter rejection during substantive examination. Furthermore, in Indonesia, a computer program can be patentable if its characteristics (i.e., instructions) have a technical effect and function to solve a tangible or intangible problem. The most liberal of Southeast Asia’s patent regimes—Singapore’s—even addresses AI innovations. The country has a special fast-track scheme for examining AI patent
Read More
April 25, 2023
As in many countries around the world, IP laws in Southeast Asia do not currently specify whether works generated by artificial intelligence (AI) are protected by copyright, and there is also uncertainty surrounding the issue of ownership with respect to works created by AI. While changes to the IP legal framework are expected to respond to the rapid development of AI technologies, existing copyright laws of most countries in Southeast Asia explicitly impose the requirement of a human author for copyright protection to arise. AI-Generated Works and the Law This is similar to the position in the United States, where the US Copyright Office issued a policy statement in March 2023 reiterating the US Copyright Act’s requirement of human authorship to register copyright works. The policy document states that when an AI technology determines the expressive elements of the output, the generated materials do not fulfil the human authorship requirement. However, the US Copyright Office also clarified that certain works containing AI-generated materials may nonetheless contain sufficient human authorship for a copyright claim, such as when a human selects or arranges the AI-generated materials in a sufficiently creative way for the resulting work as a whole to constitute an original work of authorship, or when an artist modifies material originally generated by AI technology to a degree that meets the standard for copyright protection. This is distinguishable from the position in countries such as the UK and Hong Kong, where absent specific provisions addressing AI-generated works, such works may arguably be considered by some as computer-generated works, with authorship assigned to the person who arranges for creation of the work. New Challenges from Generative AI The ongoing legal uncertainties surrounding the ownership and protection of AI-generated works create practical challenges for businesses that use or develop generative AI tools.
Read More
April 21, 2023
After a protracted period of deliberation, the Vietnamese government ultimately passed the country’s “historic,” first-ever Personal Data Protection Decree (“PDPD”) on April 17, 2023, as Decree No. 13/2023/ND-CP. The PDPD is a landmark legal instrument that integrates all of Vietnam’s disparate data protection legislation, with the potential to bring them closer to the EU’s General Data Protection Regulation (“GDPR”) requirements. (The PDPD, however, will not replace these existing regulations but will concurrently exist with them.) Scheduled to take effect on July 1, 2023, with basically no grace period (save in limited cases), the PDPD will apply to both domestic and foreign individuals/entities that directly engage in or relate to personal data processing activities in Vietnam. As the PDPD continues to be a magnet for public attention, we take a closer look at its key provisions and some initial implications for businesses below. 1. Definition and Classification of Personal Data The PDPD defines personal data as information on an electronic medium in the form of symbols, letters, numbers, photos, sounds, or the like that is associated with or helps to identify a specific individual. Information that helps to identify a specific individual is further clarified as information generated from an individual’s activities that, when combined with other data and stored information, can identify a particular person. Personal data is split into two different categories—basic personal data and sensitive personal data. Basic personal data includes name, date of birth, gender, nationality, personal photos, phone number, identification number, marriage status, history of one’s cyberspace activities, and so on. Sensitive personal data, on the other hand, is more private and, if violated, will jeopardize a person’s legitimate rights and interests. Accordingly, sensitive personal data comprises, among other things, political and religious views, health status and private life information as recorded in medical records,
Read More
April 18, 2023
On April 17, 2023, the Vietnamese government issued Decree No. 13/2023/ND on the Protection of Personal Data (“PDPD”), following extensive public consultations and multiple rounds of review since the first release of its draft version in February 2021. This is a long-awaited legal instrument which is designed to be the very first comprehensive regulation on the protection of personal data in Vietnam. The PDPD is set to take effect on July 1, 2023, without any transitional period. All Vietnamese and foreign organizations and individuals located in Vietnam and/or directly participating in or related to personal data processing activities in Vietnam must comply with the PDPD. As expected, the PDPD sets out significantly new requirements on the processing of personal data. The most critical provisions include: Eight principles for the processing of personal data: (i) lawfulness, (ii) transparency, (iii) purpose limitation, (iv) data minimization, (v) accuracy, (vi) integrity, confidentiality, and security, (iv) storage limitation, and (viii) accountability (Article 3). Critical new definitions and concepts, notably including personal data (Article 2.1); basic personal data (Article 2.3); sensitive data (Article 2.4); data subject (Article 2.6); data controller (Article 2.9); data processor (Article 2.10); parties controlling and processing personal data (Article 2.11); third parties (Article 2.12); and cross-border transfer of personal data (Article 2.14). Eleven data subject rights, including the right to know; right to consent; right to access; right to withdraw consent; right to delete data; right to restrict data processing; right to request the provision of data; right to object to data processing; right to complain, denounce and initiate lawsuits; right to claim compensation for damage; and right to self-defense (Article 9). Specific responsibilities of data controllers (Article 38), data processors (Article 39) and third parties (Article 41). Specific requirements in the exercise of data subject rights (Articles 14-16). Rules on
Read More