Artificial Intelligence and Data Law in Hong Kong: Emerging Legal Issues for Businesses

Introduction

Artificial intelligence (AI) is rapidly transforming the way businesses operate across every sector. In Hong Kong, AI applications are being deployed in financial services, healthcare, legal tech, logistics, real estate, and professional services. As AI adoption accelerates, businesses face a growing range of legal questions: Who owns AI-generated content? What are the data privacy obligations when training AI models? Who is liable when an AI system causes harm? And what regulatory frameworks are on the horizon?

This article provides an overview of the key legal issues arising from the use of AI and data analytics by businesses in Hong Kong, drawing on existing law and the regulatory guidance that has begun to emerge.

Data Privacy and AI Training

AI systems, particularly those based on machine learning, are trained on large datasets that may include personal data. In Hong Kong, the collection, use, and processing of personal data is governed by the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO), administered by the Privacy Commissioner for Personal Data (PCPD).

Data Protection Principles Relevant to AI

The PDPO's six Data Protection Principles (DPPs) impose obligations that are directly relevant to AI use cases:

• DPP 1 (Collection): Personal data must be collected for a lawful purpose directly related to the business's activities, and data subjects should be informed of the purpose at the time of collection.
• DPP 3 (Use): Personal data must not be used for a new purpose without the consent of the data subject. Using data collected for one purpose (e.g., customer service) to train an AI model for a different purpose may require fresh consent.
• DPP 4 (Security): Appropriate security measures must protect personal data against unauthorised access, use, or disclosure—including data used in AI training datasets.
• DPP 6 (Access and Correction): Data subjects have the right to access their personal data and request corrections. This right extends to data held in AI training datasets, potentially requiring significant data governance infrastructure.

Recommended AI-Specific Practices

The PCPD has published guidance on the ethical development and use of AI, recommending that businesses implement privacy-by-design principles, conduct data protection impact assessments (DPIAs) before deploying high-risk AI systems, maintain transparency with data subjects about AI-driven decisions, and use anonymisation and pseudonymisation techniques where possible.

Intellectual Property and AI-Generated Content

Copyright Ownership

The Copyright Ordinance (Cap. 528) protects works that are the result of human creative effort. For AI-generated content (text, images, music, code), the position under Hong Kong copyright law is uncertain—there is currently no specific statutory provision addressing copyright in computer-generated works (unlike, for example, the UK Copyright, Designs and Patents Act 1988, which grants copyright to the person who makes the necessary arrangements for a computer-generated work).

Businesses that rely on AI to generate content should be aware of this uncertainty and should consider whether any human creative input is involved in the AI's output, as well as the copyright terms of the AI platform used to generate the content.

Training Data and Copyright

Training AI models on large datasets may involve copying and processing copyrighted materials. Whether this constitutes infringement under the Copyright Ordinance is an open question that the courts and legislature have not yet definitively addressed. Businesses should review their data sources carefully and consider whether appropriate licences are in place for training data.

Liability for AI-Caused Harm

AI systems can cause harm—through biased outputs in hiring decisions, erroneous medical diagnoses, accidents involving autonomous systems, or flawed financial advice. The question of who is liable when an AI system causes loss is one of the most actively debated areas of emerging AI law.

Under existing Hong Kong law, liability may arise in several ways:

• Contract: If an AI product or service is supplied under contract and the output causes loss, the supplier may be liable for breach of contract (e.g., if the output did not meet the implied standards of satisfactory quality under the Supply of Services (Implied Terms) Ordinance).
• Tort (negligence): Businesses deploying AI systems owe a duty of care to users and third parties who may foreseeably be affected by the AI's outputs. Liability may arise where the AI causes harm and the deployer failed to take reasonable precautions.
• Product liability: Under the common law and the Sale of Goods Ordinance (Cap. 26), AI software may in some circumstances be treated as a product, and the manufacturer or supplier may be liable for defects causing loss.

Automated Decision-Making

AI is increasingly used in automated decision-making—in credit scoring, insurance underwriting, employment screening, and fraud detection. Where such decisions affect individuals, questions arise about the right to an explanation, the ability to challenge the decision, and the potential for algorithmic discrimination.

The PDPO does not currently contain an explicit right to explanation or right to challenge automated decisions (unlike the EU's General Data Protection Regulation). The PCPD has, however, noted the importance of human oversight of high-stakes AI decisions and encouraged businesses to maintain human review mechanisms.

The Regulatory Outlook

Hong Kong is actively developing its AI policy framework. The Innovation, Technology and Industry Bureau has issued AI strategy and governance documents emphasising responsible AI development. The HKMA has published guidance on AI governance for banks, requiring AI systems in financial services to be explainable, fair, and auditable.

While Hong Kong has not yet enacted dedicated AI legislation, businesses should anticipate that regulatory requirements—particularly in financial services, healthcare, and public-sector contexts—will continue to evolve. Monitoring regulatory developments and building adaptable AI governance frameworks now will reduce compliance risk in the future.

Practical Steps for Businesses

• Conduct a DPIA before deploying AI systems that process personal data
• Review and update data collection notices to cover AI training and deployment purposes
• Establish human oversight mechanisms for high-stakes AI decisions
• Review the IP ownership provisions in AI platform agreements and output usage rights
• Implement AI governance policies covering explainability, bias monitoring, and incident response
• Engage legal counsel experienced in data privacy and technology law to review AI deployment arrangements

Conclusion

AI presents transformative opportunities for businesses in Hong Kong, but the legal landscape remains in flux. Data privacy obligations, IP uncertainties, liability exposure, and emerging regulatory requirements all demand thoughtful legal planning. Businesses that invest in AI governance and legal compliance now will be better positioned to deploy AI responsibly and sustainably.

Alan Wong LLP advises businesses on data privacy compliance, AI governance, intellectual property, and technology contracts in Hong Kong. Contact us to discuss the legal implications of AI for your business.