You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

May 9, 2023

AI, Privacy, and Data Protection: Legal Considerations in Southeast Asia

Subscribe to Updates

The significance of artificial intelligence (AI) is rapidly increasing worldwide, and Southeast Asia is no exception, as it plays a leading role in the technological development of many industries. AI has already proven its importance for driving business growth in areas such as e-commerce, finance, and healthcare, but its remarkable potential also raises concerns around privacy. As AI systems are designed to collect and process large amounts of data to improve their operation, it is necessary to balance the development of technology with the protection of individuals’ privacy.

Current Frameworks in Southeast Asia

This concern has been on regional policymakers’ agendas for many years. The ASEAN Framework on Personal Data Protection, which was adopted in 2016, is not legally binding and has no enforcement mechanism, but it serves as a guide for ASEAN member states in developing their own data protection laws and regulations.

Domestic data privacy laws are currently in force in five ASEAN member countries—Indonesia, Malaysia, the Philippines, Thailand, and Singapore—while Vietnam’s Personal Data Protection Decree is scheduled to take effect on July 1, 2023. This presents a challenge for ASEAN members, as adopting AI-related technology can further complicate data protection efforts due to the amount of personal data AI systems collect, as well as the complexity of the data used to train the AI algorithm.

Some ASEAN members have also made progress in regulating AI. For instance, Singapore released the Model AI Governance Framework in 2019 and launched the AI Governance Testing Framework and Toolkit in 2022—the world’s first such framework. Similarly, Thailand issued the Artificial Intelligence Ethics Guideline in 2019 to help government agencies in the development, promotion, and use of AI, and in 2023 adopted the Thailand Artificial Intelligence Guidelines to help the private sector develop AI-related work. These guidelines primarily focus on principles and ethics in developing AI-related technology, but lack a step-by-step implementation process that connects with privacy laws. Despite these early steps by some countries in ASEAN, there are no regional policies or consensus frameworks on how to implement and regulate AI in accordance with privacy laws in ASEAN member countries.

Legal Risks

If AI-related technology is developed without consideration for data protection, there is a risk of breaching personal data and affecting numerous data subjects, potentially resulting in mass litigation. Moreover, the lack of robust privacy laws and frameworks in many ASEAN member countries, coupled with the growing use of AI-related technology, also increases the risk of legal liabilities for companies that make use of this increasingly common technology.

In the event of a data breach or misuse of personal data, affected individuals may seek legal recourse against the companies that collected and processed their personal information. Such legal actions can result in significant financial and reputational damages for businesses, highlighting the need for effective data protection regulations and AI-related technology frameworks in ASEAN countries.

Technology companies with connections to developing AI systems are especially vulnerable. With the vast amount of data required for developing AI systems, these companies will face the challenge of lawfully collecting and processing data from a huge range of sources and data subjects.

Outlook

As AI-related technology continues to evolve and play a crucial role in the growth of many industries in Southeast Asia, it is important to ensure that its development is balanced with the protection of individuals’ privacy. While some ASEAN members have made progress in adopting AI regulations, more needs to be done to enforce data privacy laws and develop consensus frameworks for regulating AI in accordance with privacy laws. Such efforts will not only help protect individuals’ privacy but also mitigate legal risks associated with the use of AI-related technology. ASEAN member countries must continue to work together to achieve a balance between technological development and data protection in support of sustainable and ethical innovation for our digital future.

Related Professionals

Industries

Technology

Locations

RELATED INSIGHTS​ 

January 12, 2022
Thailand’s Board of Investment (BOI) recently published BOI Notification No. Sor. 8/2564, which extends the scope of investment promotion covering electronic vehicle (EV) industry manufacturers to include the production of “automotive platforms” for electric vehicles, and creates a new category of BOI promoted activities covering the manufacture of electric bicycles (E-bikes). Automotive Platforms The following investment promotion categories have been extended: 4.24 – Manufacture of Battery Electric Vehicles 4.26 – Manufacture of Electric Battery Tricycles 4.27 – Manufacture of Electric Battery Busses and Trucks These categories now include the manufacture of “automotive platforms”—which must include an energy storage system, charging module, and front and rear axle module—benefiting from similar tax incentives and subject to additional conditions, as detailed below. New BOI Promotional Category for E-Bike Production The BOI has also introduced a new category, No. 4.28, covering the manufacture of E-bikes. Projects under this category will be eligible for a three-year CIT exemption with an additional one-year exemption if certain criteria are met. Applications for this category must cover the manufacture of E-bikes, the manufacture or sourcing of electric batteries, and a management plan for used batteries. In addition to the general conditions for EV projects (industrial standards, manufacturing timelines, etc.), the BOI has also imposed the following conditions specific to E-bike projects: E-bike frames must be produced from light-weight materials such as aluminum alloy, chromium–molybdenum alloy steel (chrome moly), titanium alloy, and carbon fiber; and E-bike batteries must adopt environmentally-friendly technology. Interestingly the BOI allows E-bike production lines to jointly use manufacturing lines for ordinary bicycles. However, the sale of ordinary bicycles is regarded as non-BOI-promoted income and will not be entitled to BOI tax incentives. These new provisions, intended to stimulate both local and foreign investments in the electric automotive industry, seem to complete the BOI promotion
Read More
December 8, 2021
On February 9, 2021, Vietnam’s Ministry of Public Security (MPS) released the full text of the Draft Decree on Personal Data Protection (“Draft PDPD”) for public consultation, after having released an outline in December 2019, with an ambitious goal for the Draft PDPD to be promulgated and take effect on December 1, 2021. This date has now passed and the Draft PDPD remains unissued, with no concrete details on when the situation will change. Many new contents have been introduced in the Draft PDPD (please see our previous articles here and here). In this article, we take a deeper look at the issues that have attracted the most attention from national and international stakeholders as they wait for the draft to be finalized and promulgated. Please click below to read the full article.  
Read More
November 29, 2021
On November 25, 2021, the Myanmar Investment Commission (MIC) issued a list of investment sectors that will receive priority attention in order to encourage national development and state building. The investment activities that MIC will prioritize are the following: Fertilizer manufacturing Cement manufacturing Iron and steel manufacturing Agriculture and livestock farming and related industries Value-added manufacturing of foodstuffs Electric vehicle manufacturing Pharmaceutical and medical device manufacturing Public transportation services Both foreign investors and local investors may invest in these sectors, and the MIC, ministries, and relevant state and regional governments will provide necessary assistance to the investors under the Myanmar Investment Law 2016. For more details on the new requirements, please contact Tilleke & Gibbins at [email protected] or +95 9 772 440 001.
Read More
November 24, 2021
Attorneys from Tilleke & Gibbins have provided the latest update to the Thailand contribution to Doing Business in…, a Q&A-style guide published by Thomson Reuters Practical Law that presents an overview of the legal framework for doing business in 63 jurisdictions worldwide. The Thailand chapter of the guide outlines Thailand’s legal system and key laws applicable to foreign companies doing business in the country. The chapter specifically covers the following main topics: Legal system: Thailand’s court system and codified legal system. Foreign investment: Lists of reserved business activities, restrictions on doing business with certain jurisdictions, exchange controls and currency regulations, and grants and incentives available to investors. Business vehicles: Ordinary partnerships, registered ordinary partnerships, limited partnerships, private limited companies, and public companies. Environment: Main laws and regulations, factory operation. Employment: Laws, employment contract requirements, work permits, and termination and redundancy. Tax: Taxes on employment, tax and nontax resident employees and businesses, corporate income tax, value added tax, special business tax, municipal tax, stamp duty, dividends, interest, intellectual property royalties. Competition: Important aspects of Thailand’s regulatory regime surrounding competition, centered around the updated Trade Competition Act. Antibribery and corruption: Laws, compliance requirements, regulatory authority. Intellectual property: Patents, trademarks, registered and unregistered designs, and copyright. Marketing agreements and advertising: Regulation of marketing agreements, Thailand’s Consumer Protection Act, direct marketing, role of the Consumer Protection Board and Food and Drug Administration. E-commerce: E-commerce laws and regulations, marketing and sales via online platforms. Data protection: An outline of Thailand’s Personal Data Protection Act. Product liability: Procedures and regulations for product liability and product safety, including the Unsafe Goods Liability Act and the Consumer Case Procedure Act. Product liability: Key regulatory authorities for trade competition, environmental issues, and financial services. To browse, download, or print the Thailand chapter, please visit the Practical Law website.
Read More