New guidelines also offer practical tips to support Gen AI use among staff
A new set of guidelines has been published in Hong Kong with the aim of helping organisations develop policies to ensure the safe use of Gen AI by employees.
The Office of the Privacy Commissioner for Personal Data (PCPD) issued the guidelines in late March amid the widespread use of employees of generative AI.
"The Guidelines aim to assist organisations in developing internal policies or guidelines on the use of Gen AI by employees at work while complying with the requirements of the Personal Data (Privacy) Ordinance (PDPO)," said Privacy Commissioner Ada Chung Lai-ling in a statement.
The guidelines outline the following key factors that employers need to remember in coming up with their internal AI policies:
Scope of permissible use of Gen AI. Specify the permitted Gen AI tools, the permissible purposes of use, and the applicability of the policies or guidelines.
Protection of personal data privacy. Provide clear instructions on the types and amounts of information that can be inputted into the Gen AI tools, the permissible purposes for using the output information, the permissible storage of the output information, the applicable data retention policy, and other relevant internal policies to comply with.
Lawful and ethical use and prevention of bias. Specify that employees shall not use Gen AI tools for unlawful or harmful activities, emphasise that employees are responsible for verifying the accuracy of AI-generated outputs and for correcting and reporting biased or discriminatory AI-generated outputs, as well as providing instructions on when and how to watermark or label AI-generated outputs.
Data security. Specify the types of devices on which employees are permitted to access Gen AI tools and the categories of employees who are permitted to use Gen AI tools, require employees to use robust user credentials, maintain stringent security settings in Gen AI tools, and report AI incidents according to the organisation's AI Incident Response Plan.
Violations of policies or guidelines. Specify the possible consequences of employees' violations of the policies or guidelines, and refer to the PCPD's "Artificial Intelligence: Model Personal Data Protection Framework" for recommendations on establishing Gen AI governance structure and measures.
"The issuance of the Guidelines by the PCPD can help organisations and their employees use generative AI safely and protect personal data privacy, thereby fostering the safe application of AI across different sectors and accelerating the development of new quality productive forces," said Prof Hon William Wong Kam-fai, MH, member of the PCPD's Standing Committee on Technological Developments and the Legislative Council, in a statement.
Meanwhile, the guidelines also offered practical tips that employers can do to support staff in using generative AI tools. They are:
Enhancing transparency of the policies or guidelines by regularly communicating them to employees
Providing training and resources for employees' use of Gen AI by explaining the capabilities and limitations of the tools, providing practical tips and examples, as well as encouraging staff to read the privacy policies
Providing a support team to assist employees in using Gen AI tools in their work
Establishing a feedback mechanism where employees can provide feedback to help the organisation identify areas for improvement
The guidelines come amid the widespread use of AI among Hong Kong employees.
Findings from UiPath last year revealed that 60% of employees in the financial hub are using generative AI tools at work, higher than the global average of 39%. In recruitment, however, Hays revealed that 46.6% of employers in Hong Kong have no immediate plans to integrate AI into their hiring process.
