Last week, Chung issued a checklist for companies that is designed to help them develop internal policies or guidelines on the use of Gen AI by their staff.
It suggested that firms cover what areas of work AI can be used for, as well as data security, ethical considerations and the protection of personal privacy.
“Some organisations may not know that if they input clients’ personal information into AI, the AI may leak this information to another party,” Chung told Commercial Radio.
As an example, she said retail stores may use AI to analyse the preferences of their customers, but this could be problematic if they don’t strip out information such as names and telephone numbers.
Chung said companies with questions on how their use of AI can comply with the requirements of the Personal Data (Privacy) Ordinance are welcome to make use of a new hotline her office has set up, adding that more promotion and education work will be carried out.
The commissioner added that her team has the authority to investigate any incidents where people’s privacy is endangered by a company’s use of AI.
“We can investigate incidents when we receive data breach reports and after that we can issue reports, or even publicly condemn the organisations involved. We can also issue enforcement notices to them and it is a criminal offence if an organisation does not abide by a notice,” she noted.
