This country-specific Q&A provides an overview of Artificial Intelligence laws and regulations applicable in Hong Kong.
What are your countries legal definitions of “artificial intelligence”?
There is no legal definition of the term “artificial intelligence” in Hong Kong, however, the Guidance on the Ethical Development and Use of Artificial Intelligence issued by the Office of the Privacy Commissioner for Personal Data refers to artificial intelligence as “a family of technologies that involve the use of computer programmes and machines to mimic the problem-solving and decision-making capabilities of human beings”.
Has your country developed a national strategy for artificial intelligence?
At present, there is no official strategy for artificial intelligence in Hong Kong. That said, different governmental bodies have developed and published various guidelines and frameworks targeting different applications of AI, which include the Guidance on Ethical Development and Use of Artificial Intelligence mentioned in paragraph 1 above.
Has your country implemented rules or guidelines (including voluntary standards and ethical principles) on artificial intelligence? If so, please provide a brief overview of said rules or guidelines. If no rules on artificial intelligence are in force in your jurisdiction, please (i) provide a short overview of the existing laws that potentially could be applied to artificial intelligence and the use of artificial intelligence, (ii) briefly outline the main difficulties in interpreting such existing laws to suit the peculiarities of artificial intelligence, and (iii) summarize any draft laws, or legislative initiatives, on artificial intelligence.
Hong Kong has implemented various guidelines and frameworks in governing the use of AI in the city.
As AI often involves the use of data sets containing the personal data of individuals during problem-solving and training, the Privacy (Data) Protection Ordinance (“PDPO”) applies to AI. The PDPO stipulates six data protection principles, which broadly govern the collection, use, protection and treatment of personal data. Anyone creating and operating AI handling personal data is obliged to always comply with these principles. The Privacy Commissioner (“PCPD”) has also issued the Guidance on the Ethical Development and Use of Artificial Intelligence (“Guidance”) which specifically applies to the use of AI when personal data is used to train, or is analysed by, AI system.
Apart from the PDPO, the existing legislation of Hong Kong and common law also apply to certain aspects of the use of AI in Hong Kong, for example, tort law and intellectual property rights.
The Office of the Government Chief Information Officer developed the Ethical Artificial Intelligence Framework to facilitate governmental bodies and departments in their planning, design and implementation of AI and big data applications using guiding principles, leading practices, and assessments in AI-powered IT projects.
The Hong Kong Monetary Authority (“HKMA”) has issued circulars to provide guidance on the use of AI in the banking and financial industries. Financial Institutions are recommended to be vigilant against over-reliance on AI and reminded of their obligation to properly assess the financial capabilities of clients and monitor the design and development of AI applications. Further, the use of AI does not mitigate the financial institutions’ liabilities from the consequences of any conduct, nor should it allow any compromise of proper validation expected from financial institutions.
Which rules apply to defective artificial intelligence systems, i.e. artificial intelligence systems that do not provide the safety that the public at large is entitled to expect?
Under the principles of the law of the tort, any user of AI is expected to exercise a duty to take reasonable care when using AI.
In terms of negligence, the Hong Kong court will find a creator of AI to be in breach of duty of care if the following elements are satisfied:
The respondent (i.e. the creator of AI) has reasonably contemplated that the actions to be taken by AI would injure the plaintiff;
Proximity exists between the respondent and the plaintiff;
The imposition of duty of care is just and reasonable; and
The imposition of duty of care is consistent with public policy considerations.
In addition, the law of nuisance and the doctrine in Ryland v Fletcher (i.e. if a person keeps something that would likely cause mischief on their property, such person will be liable for any natural consequence flowing from that object’s escape) applies in Hong Kong as well. If any nuisance is caused by AI being defective which results in intrusion and nuisance on the neighbour’s property or otherwise hampers the enjoyment of such property, as long as all of the requisite elements of nuisance are satisfied and proved, the court may hold the creator and/or controller of AI liable for nuisance.
Please describe any civil and criminal liability rules that may apply in case of damages caused by artificial intelligence systems.
Other than the civil liabilities under tort law mentioned above, any person who without lawful excuse destroys or causes any damage to property belonging to another with the intention to do so, or being reckless as to whether the property will be destroyed or damaged, may be charged with criminal damage under section 60 of the Crimes Ordinance (Cap. 200), with the offender being liable to imprisonment for up to 10 years. If it is proved that the offender has the intention of destroying or causing any damage so as to endanger the life of another or is reckless as to whether the life of another will be endangered, the offender is liable to imprisonment for life.
Damage under this offence is widely defined and covers physical harm that is both permanent and temporary, tangible and intangible, and any injury that impairs the value and usefulness of the property.
The above offences apply to users of AI; therefore, if an AI user commits the offences by using AI, they may be charged with criminal damage and be liable to the respective penalties on top of civil liabilities.
Who is responsible for any harm caused by an AI system? And how is the liability allocated between the developer, the user and the victim?
It depends on the cause of the harm. If the defect is caused by the developer, the developer may be sued and be held liable for negligence. If the harm is caused by usage by a particular user and is not attributable to the creator of the AI system, the liability will be borne by the user.
Whether the victim will also be liable depends on the circumstances of each incident. Under tort law, for example, if the harm caused is partly attributed to the victim, it is possible the respondent may not be held fully liable for the harm caused to the victim.
What burden of proof will have to be satisfied for the victim of the damage to obtain compensation?
As with all claimants in the law of tort, the victim suffering any damage due to the use of AI will need to prove, on the balance of probabilities, that the respondent has been negligent in their usage of AI applying the principles set out in paragraph 4 above. If the respondent (i.e., the user of AI) has been convicted of any offence arising out of the negligence claimed by the claimant (for example, the user has been convicted of criminal damage), the respondent is presumed to have been negligent unless they can prove otherwise on balance of probabilities.
Is the use of artificial intelligence insured and/or insurable in your jurisdiction?
The use of AI is insurable in Hong Kong. Whether a particular use of AI is insured depends on the insurance policy taken out by the relevant AI user. Given that AI is commonly used by entities in Hong Kong to perform key elements of their businesses (such as managing inventory and client accounts), it is anticipated that the existing business-related insurance policies taken out by such entities would have covered the use of AI in the course of business.
Can artificial intelligence be named an inventor in a patent application filed in your jurisdiction?
At present, the Patents Ordinance (Cap 514) does not recognise non-humans as inventors. The inventor of a patent is generally regarded as the person who arrived at the critical inventive concept leading to the invention. The inventor of the patent should be the person who creates the patent using AI, rather than AI itself.
Do images generated by and/or with artificial intelligence benefit from copyright protection in your jurisdiction? If so, who is the authorship attributed to?
Images generated by and with AI are under copyright protection in Hong Kong as it falls within the definition of graphic work and artistic work under section 5 of the Copyright Ordinance (Cap 528). Similar to the issue of inventor under paragraph 9 above, the Copyright Ordinance does not recognise non-human creators as the author of the artwork. Under the Copyright Ordinance, the authorship of the artwork is attributed to “the person by whom the arrangements necessary for the creation of the work are undertaken”. Therefore, if the image in question is generated by AI of its own volition it is likely that the programmer of AI and/or any other person whose contribution is proved to be necessary for the creation of the image will be attributed authorship of such image. If, however, the image is created by a person using AI, the human creator, the programmer of AI and/or also any other person whose contribution is proved to be necessary for the creation of the image should be entitled to claim authorship of such image.
What are the main issues to consider when using artificial intelligence systems in the workplace?
Businesses in Hong Kong are increasingly reliant on AI in daily operations and delivery of services to clients. Examples include managing personal data of staff or potential candidates for human resources purposes, maintaining client accounts, setting up manufacturing procedures, handling account matters, addressing clients’ enquiries.
Apart from the privacy issues to be discussed in paragraph 12 below, the use of AI does not exempt the company using AI in its operations from being liable for damage to property or personal injury caused by AI. As such, contractually, if a party fails to perform any contract due to mistakes and errors caused by the malfunctioning or breakdown of AI, that party is still in breach of the contract in question.
Another issue that may be caused by reliance of AI in the workplace is the potential bias and discrimination that AI may cause. For example, in the context of recruitment, candidates may be exposed to AI-induced biase and discrimination. There are reports that AI-recruitment tools have discriminated against female candidates, as the historical data learned by the system mostly came from men’s resumes.
What privacy issues arise from the use of artificial intelligence?
In light of the fact that AI’s capabilities are to a large extent driven by collection, analysis and application of data (which, more often than not, means personal data), business users of AI may tend to take a more aggressive approach when collecting personal data of customers, which increase the risks of data subjects being exposed to excessive, unjustified, and perhaps unauthorised mass data collection. For example, data pertaining to consumer activities both online and offline are tracked to help AI make predictions.
In addition, after analysing and matching the massive data collected from different datasets, AI may even be able to generate dossiers for individual data subjects which may be used for purposes other than those for which the personal data is collected in the first place.
Another common risk is the leakage of personal data. Given that the data collected needs to be stored and maintained (very likely online), the data is exposed to potential security breaches, hacking, wrongful manipulation of data and other forms of misuse of data or other cyberattack by a third party.
What are the rules applicable to the use of personal data to train artificial intelligence systems?
While not legally binding, the Guidance on the Ethical Development and Use of Artificial Intelligence issued by the Office of the Privacy Commissioner for Personal Data (PCPD) lists the values and principles that it recommends AI developers and users adhere to:
accountability: Being held responsible for decisions and actions resulting from the use of AI;
human oversight: Human oversight should be in place to ensure that AI is making appropriate decisions from the data set;
transparency and interpretability: Data users should, at the time of collecting data, disclose their data usage, protection and privacy practices;
data privacy: Data governance policy should be in place within the data user to protect the privacy and proper usage of the collected personal data;
fairness: Human should intervene whenever appropriate to ensure that the results generated by AI are fair;
beneficial AI: The use of AI should benefit both the data user and the wider community. Preventative measures should be in place to limit harm and risk that AI may bring about; and
reliability, robustness and security: Preventative measures should be established to avoid security breaches or malfunction such as malware, hacking, data poisoning.
Have the privacy authorities of your jurisdiction issued guidelines on artificial intelligence?
See paragraph 3 on the Guidance on the Ethical Development and Use of Artificial Intelligence.
Have the privacy authorities of your jurisdiction discussed cases involving artificial intelligence?
Although AI become more commonly used in Hong Kong in recent years, there has not been any reported litigation involving AI in relation to privacy matters.
However, of the complaints reported by the Office of the Privacy Commissioner for Personal Data, one concerns a complaint made by an employee dissatisfied with his employer’s installation of a security camera with facial recognition function not only for security purposes but also for recording attendance without the employee’s knowledge or consent. The PCPD took the view that the employer had other means to achieve those dual purposes, and data subjects were not given free and informed choices before their biometric data was collected. The PCPD recommended the employer to consider less privacy intrusive alternatives and formulate privacy policies in compliance with the PDPO.
Have your national courts already managed cases involving artificial intelligence?
The Hong Kong courts have briefly touched on the issue of artificial intelligence in the defamation case of Dr Yeung Sau Shing Albert v Google Inc (No 2)  1 HKLRD 26.
The claimant is a well-established businessman in Hong Kong known for his presence in the media and entertainment sector. When the claimant’s name was entered on the defendant Google’s search engine, its auto-complete function provided suggestions such as “triad” to complete the phrase. The claimant’s case was that Google published (or caused to be published) words that are defamatory in nature, while Google’s position was that the results produced by the search engine were automated and based on algorithms which collect, analyse and apply data from the Internet, and as such, Google should not be considered a publisher.
The court took the view that while AI was deployed to mine data from previous searches and existing content on the Internet, the fact that the algorithm and AI was indeed deployed by Google to generate predictive keywords meant that Google did not merely pass information from one place to another, its AI had processed the relevant content before coming up with suggestions for autocomplete, and, thus, may be considered as publisher of defamatory comments.
Does your country have a regulator or authority responsible for supervising the use and development of artificial intelligence?
Hong Kong does not currently have any regulator or authority that specifically monitors the use of AI. The use of AI is generally regulated through guidelines and principles of various bodies as set out in paragraph 3 above.
How would you define the use of artificial intelligence by businesses in your jurisdiction? Is it widespread or limited?
While AI is increasingly used by companies and organisations in Hong Kong, it is currently mainly used to power chatbots and marketing analytics to improve customer experience. It is reported that a handful of shopping malls or commercial buildings adopt AI for building management purposes, such as disinfecting and sanitising public areas. Autonomous vehicles are not yet road worthy as such, but trials have been allowed.
The potential of AI has not been fully explored in Hong Kong; but since the potential benefits brought about by using AI are apparent, more businesses are moving to integrate AI into their daily operations to save costs and increase efficiency. For example, banks are using various AI tools to assist with due diligence on accounts opening and detecting money laundering activities.
Is artificial intelligence being used in the legal sector, by lawyers and/or in-house counsels? If so, how?
The legal sector has started to embrace the use of AI to increase efficiency in their work and reduce costs. While some law firms develop in-house tailor-made AI tools, some turn to experts in this area for their services. Magic circle firms are among the forerunners of the use of AI in legal work.
International firms are reported to have started to automate drafting of documents and conducting research through Harvey, the generative AI built on Open AI’s GPT AI, specifically targeting law firms as its client base. The legal research company Casetext also launched its AI legal assistant CoCounsel using GPT-4 to expedite tasks such as research and document review.
That said, generative AI has its limits. The content generated by AI is largely based on previous advice, research and/or documents, so AI may not be suitable for high-level strategic work that requires a fair amount of critical thinking or handling complicated scenarios (e.g. those involving ethical issues). The increasing use of AI in law firms allows lawyers to focus on work that actually requires skills such as conducting negotiations; although this would not save time as a lawyer would still have to review the generated product to ensure it is proper and accurate.
What are the 5 key challenges and the 5 key opportunities raised by artificial intelligence for lawyers in your jurisdiction?
The key challenges and opportunities associated with AI for lawyers in Hong Kong are as follows: – Challenges
While AI is able to review and analyse voluminous case laws and other documents in a split second, the product generated by AI is also highly dependent on the quantity and quality of materials in its database. That means, AI built on a biased or incomplete database or inherently faulty algorithms may generate inaccurate results.
Depending on the quality of AI systems and the natue of tasks AI is assigned, the effort required of lawyers to review the products generated by AI to ensure they are proper and accurate and to communicate the products to clients effectively and empathetically may not always substantially increase efficiency of work and reduce costs.
AI operates on the prompts and instructions from human users. Lawyers and staff using AI need proper training to use the AI tools properly and effectively and to maximise the benefits brought about by the use of AI.
Security and maintenance of AI and databases is very important, even more so in the legal sector given the sheer volume of priviledged and confidential materials accessed and kept by law firms. Ensuring AI and database are safe and secure could mean additional costs and effort by law firms.
As with other industries, AI competes with human labour. Lawyers and supporting staff in certain practice areas of law (especially non-contentious ones) may be more susceptible to replacement by AI in the long run as AI becomes smarter.
More mundane tasks can now be automated through the use of AI which would allow lawyers to focus on tasks that cannot be performed by AI, including high-level strategic tasks and client management.
AI works around the clock and does not take leave. As computational capabilities advance, AI will be able to work faster. This could substantially increase the productivity of law firms using AI.
AI is driven by data and is technically not prone to human error.
Maintaining AI may be cheaper than employing human staff. Using AI may therefore reduce the costs of practising law and bring down the costs of legal services to the benefit of soceity as a whole.
AI is programmed to learn from archive and experience. The more frequently an AI model is used, the better and more reliable the products it will be able to generate.
Where do you see the most significant legal developments in artificial intelligence in your jurisdiction in the next 12 months?
Currently, the regulatory landscape in Hong Kong is rather light when it comes to AI. There is no overarching legislation regulating the use of AI, and the existing guidelines and principles mainly provide guidance on the use of personal data. In light of the Hong Kong government’s commitment to develop AI-related industries in the future, as well as the fact that other jurisdictions are gradually moving to regulate AI by policy and by law, it is anticipated that the government and legislators in Hong Kong may take a more proactive approach in updating the laws and regulations to regulate the use of AI and safeguard the interests of stakeholders and the community as a whole.
Estimated word count: 3654
Join our mailing list to receive updates on new Guides: