Singapore: Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems

1. 2 Application of the PDPA to collection and use of data to design
2. PART III: USING PERSONAL DATA IN AI SYSTEM DEVELOPMENT, TESTING AND
3. PART IV: DEPLOYMENT – COLLECTION AND USE OF PERSONAL DATA IN AI
4. 8 PDPA Applies to Collection and Use of Personal Data in AI Systems
5. PART V: PROCUREMENT OF AI SYSTEMS – BEST PRACTICES FOR HOW SERVICE
6. PART I: EXECUTIVE SUMMARY
7. 1.1 The Personal Data Protection Act 2012 (the “PDPA”) establishes a general data
8. 1.2 The purpose of the Advisory Guidelines on the Use of Personal Data in AI
9. 1.4 Third-party developers of bespoke AI Systems (“Service Providers”) are data
10. 1.5 To assure consumers that their personal data is being used appropriately, the
11. 1.6 The Guidelines also recommend additional resources from the Personal Data Protection
12. PART II: LEGAL EFFECT AND SCOPE
13. 2 Application of the PDPA to collection and use of data to design and/or
14. 2.1 The PDPA is broad-based legislation that applies to all collection and use of personal
15. 2.2 These Guidelines should be read in conjunction with the Commission’s Advisory
16. 3 Scope of the Advisory Guidelines
17. 3.1 These Guidelines are provided for situations where the design and/or deployment of
18. 3.2 These Guidelines are organised according to the typical stages of AI System
19. Part III Development, testing and monitoring: • Consent
20. Part IV Deployment: Collecting and using • Notification and Consent
21. Part V Procurement: Service Providers for • Notification and Consent
22. 4 Business Improvement Exception and Research Exception
23. 4.1 Organisations may occupy the role of an AI developer by developing AI models in-
24. 4.2 Besides seeking consent to use personal data to train an AI System, organisations
25. 5 Application of the Business Improvement Exception
26. 5.3 Relevant considerations for organisations on whether to rely on the Business
27. 5.4 The following are examples of purposes where the Business Improvement Exception
28. 5.5 In addition, organisations may wish to consider relying on the Business Improvement
29. 5.6 Organisations could rely on the Business Improvement Exception to use personal
30. 5.7 Organisations are to take note that different standards for securing and protecting
31. 5.8 The Business Improvement Exception could apply to the use of personal data for bias
32. 5.9 In considering whether the Business Improvement Exception applies, organisations
33. 5.10 The Commission understands that generally, industry best practice is to use personal
34. 6 Application of the Research Exception
35. 6.1 The Research Exception is intended to allow organisations to conduct broader
36. 6.2 Organisations may use personal data for a research purpose7, subject to the
37. 6.3 Organisations may rely on the Research Exception to disclose personal data for a
38. 6.4 Relevant considerations for organisations on whether to rely on the Research
39. 7 Data Protection Considerations when using Personal Data
40. 7.1 When developing AI Systems, organisations should practise data minimisation as
41. 7.2 Organisations are reminded that when designing, training, testing, or monitoring AI
42. 7.3 If pseudonymisation is not possible and raw personal data has to be used e.g., facial
43. 7.5 Generally, privacy controls for internal use need not be as extensive as intra-group
44. 7.6 Separately, whether AI Systems are built in-house, externally, or using a combination
45. 7.7 In addition, as per their Accountability Obligation under the PDPA12, organisations
46. 7.8 Organisations are encouraged to anonymise their datasets as far as possible instead
47. 7.9 The Commission recognises that there are trade-offs with using anonymised data
48. 7.10 In terms of what would be considered effectively anonymised data for developing or
49. 7.11 As to whether anonymisation is sufficiently robust to reduce the risk of
50. 7.12 The Commission is aware that identifiability and anonymisation exists on a spectrum
51. 8.1 This section deals with how the PDPA applies when organisations deploy AI Systems
52. 9 Consent and Notification Obligations
53. 9.2 The Consent Obligation is complemented by the Notification Obligation, which
54. 9.3 As set out in the Advisory Guidelines on Key Concepts in the PDPA, consent should
55. 9.4 The raison d’etre for the Consent and Notification Obligations is to enable
56. 9.5 Organisations are encouraged to provide information on the following, to the extent
57. 9.6 The provision of such information could be through notification pop-ups or included
58. 9.7 It may also be useful to consider “layering” information. This means displaying the
59. 15 For model cards, see “The value of a shared understanding of AI models”
60. 9.8 Notwithstanding the above, the Commission recognises that organisations may need
61. 9.10 An example of a Legitimate Interest for processing personal data without consent
62. 9.11 Organisations may wish to refer to the Commission’s Advisory Guideline on Key
63. 10 The Accountability Obligation
64. 10.1 The Accountability Obligation refers to how an organisation discharges its
65. 10.2 Among other things, Section 12 of the PDPA requires organisations to develop
66. 10.3 Organisations that make use of AI Systems should be transparent and include in their
67. 10.4 Section 12(d) requires organisations to make information about such policies and
68. 10.5 Written policies can house more detailed information that organisations ought to
69. 10.6 Written policies also play an important function in education and confidence-
70. 10.8 Organisations are generally encouraged to provide more information on data quality
71. 10.9 Organisations may wish to refer to the Model AI Governance Framework for further
72. 10.10 Organisations can consider using technical tools such as AI Verify to validate the
73. 10.11 It is good practice for organisations to develop processes to regularly review the
74. 10.12 Organisations are also encouraged to perform impact assessments, particularly data
75. 11 Business to Business Provision of AI solutions
76. 11.1 This section is relevant for Service Providers (e.g., systems integrators) who are
77. 11.2 Where Service Providers, as part of developing bespoke or fully customisable AI
78. 11.3 The above measures will support data intermediaries in assessing whether there has
79. 11.4 In addition, Service Providers developing such bespoke or fully customisable AI
80. 11.5 The subsequent paragraphs contain best practices on how such Service Providers
81. 11.6 Service Providers are encouraged to be familiar with the types of information
82. 11.7 As part of implementing privacy-by-design, Service Providers are encouraged to build
83. 11.8 While Service Providers can support organisations in achieving their Consent and

The outline comes from headings detected in the text, so it might miss some or include extras.