On August 7, 2024, the Office of the Privacy Commissioner for Personal Data (PCPD) published an article that introduced the Artificial Intelligence Model Personal Data Protection Framework for directors. The PCPD noted that the Model Framework aims to assist companies in procuring, implementing, and using artificial intelligence (AI), including generative AI, in compliance with the relevant requirements of the Personal Data (Privacy) Protection Ordinance (PDPO), and to encourage the active participation of top management, including the board directors, in establishing a company's AI strategy and governance.

What are the proposed recommendations of the Model Framework?

• AI strategy and governance – active participation of top management (such as C-level executives or board directors) in formulating an internal AI governance strategy and considering governance issues in their supplier management processes, such as the key privacy and security obligations or ethical requirements to be conveyed to potential AI suppliers;
• risk assessment and human oversight - companies should conduct comprehensive risk assessments to systematically identify, analyze, and evaluate the risks, including privacy risks, involved in the AI lifecycle and ensure human actors retain control in the decision-making process;
• customization of AI models and implementation and management of AI systems – companies should take measures to ensure compliance with the PDPO and minimize the amount of personal data involved in customizing and implementing AI solutions; and
• communication and engagement with stakeholders - companies should encourage feedback from all parties and conduct ongoing communications with stakeholders to instill trust.

You can read the press release here and the Model Framework here.