This Week on Insignia AI Notes: Generative AI Regulation, the Link with Data Privacy Regulation, and Implications for AI Development in ASEAN

Check out Last Week’s AI Notes: Context is King and Other Learnings from Building an GPT-powered Website Chatbot

In an era marked by rapid technological advancements, regulatory bodies are constantly striving to keep pace with innovation. Generative AI, in particular, represents a frontier where the intersection of technology, law, and ethics is both vital and complex.

This article explores the trajectory of regulation in the context of ride-hailing, social media, and generative AI, focusing on the unique challenges and opportunities in the ASEAN region. We’ll also delve into the link between Generative AI and Data Privacy regulations, shedding light on the existing gaps and the balancing act required to foster growth and protect interests.

Part 1: Generative AI has not only sped up productivity but also regulation

To set the stage for understanding how generative AI has reshaped not just technology but regulation as well, we first need to examine how other technologies have been regulated over time. By contrasting with other significant technological advancements, we can begin to appreciate the unprecedented pace at which generative AI regulation is occurring.

Ride Hailing (~4 to 9 years)

From Uber’s launch in 2009 to regulations taking shape in various regions, the evolution of ride-hailing services has been significant. The EU, US, China, and ASEAN have implemented various legislative actions, such as the administrative ban on Uber in the UK (2017), guidelines for ride-hailing in China (2016), and new regulations in ASEAN countries like Thailand (2021) and Vietnam (2020).

Social Media (~7 to 17 years)

Social media has a rich history with Facebook launching in 2004, and TikTok in 2016. Regulations have followed suit with the EU’s GDPR affecting Facebook since 2010 and the Digital Services Act in 2022. In the US, ongoing social media restrictions were passed from 2021 to 2023. ASEAN regulations include Indonesia’s MR5 in 2020 and Vietnam’s cybersecurity law in 2018.

Generative AI (<1 year, or even before launch)

Generative AI is a new frontier, with OpenAI launching ChatGPT in November 2022. Remarkably, regulations have already been implemented or drafted in the EU (AI Act passed in June 2023), the US (Senate hearing in May 2023), China (new guidelines in July 2023), and ASEAN (guardrails for AI governance code in 2023).

This drive for regulation is happening at an unprecedented speed compared to social media. Even before generative AI becomes a massive driver in Southeast Asia, we’re seeing countries and organizations forming voluntary guidelines, a phenomenon never witnessed before.

Part 2: Gen AI and Data Privacy regulations have their momentums, but there’s a gap…

After exploring the general trends in regulation, we must now focus on the current state of Generative AI and Data Privacy regulations. This part elucidates the progress, inconsistencies, and unique challenges faced in both these domains, reflecting the complexities in aligning technological advancements with legal frameworks.

Global Generative AI regulation took its first steps this year. Examples include the EU Commission’s AI Act (passed in 2023), China’s updated guidelines for generative AI (effective August 15), and ASEAN’s guide to AI governance (expected completion by early next year). Meanwhile, Data Privacy regulation is maturing in ASEAN, and many of these developments happened throughout 2022.

Examples of developments: Personal Data Protection in Indonesia became effective on October 2022, Personal data protection decree promulgated on May 2023 in Vietnam, Data Protection Guidelines in Thailand fully effective in June 2022, Increased administrative fines for PDPA in Singapore that came into effect in 2022, Privacy law reform proposals in Malaysia (Mandatory Breach Notifications), Updates and Clarifications to Data Privacy Law in Philippines 2022-2023

The memorization property of AI models causes issues for copyright and confidentiality. The case of “Samsung Banning Staff’s AI Use After Spotting ChatGPT Data Leak” exemplifies this dilemma. There is a balancing act between enabling flexibility for developers and protecting against breaches. Regulatory tools include disclosures, guardrails, new hard regulation, and existing laws, but models will also need to evolve.

Part 3: Implications for Generative AI in Southeast Asia: Opportunities for Localization

As we move into the specific context of Southeast Asia, it becomes apparent how localization shapes the evolution of Generative AI. Here, we’ll dissect the implications and opportunities that arise from the interaction between this cutting-edge technology and the distinct legal, cultural, and linguistic characteristics of the region.

1. Evolving Models and Training Data: Regulations must emphasize transparency in training datasets and clarify requirements for data protection and copyright. Specialized models for industries like legal, healthcare, and insurance may differ across markets.

2. Local Laws and Culture: Governments need to see how existing laws can be used or revised. Regulation is likely to follow political customs and cultures, with models trained on local laws and cultural practices.

3. Local Languages and Dialects: Like culture, languages and dialects will play a key role in regulation and model training. Existing laws will again be scrutinized and adapted, with models reflecting local languages, dialects, and English derivatives.

In conclusion, the swift pace of regulation in the field of generative AI, especially compared to previous technological evolutions, signals a changing landscape. ASEAN’s unique environment, laws, and cultural attributes offer a fertile ground for the growth and governance of this exciting technological frontier. The balancing act between fostering innovation and ensuring privacy and compliance remains the central challenge and opportunity for all stakeholders.

Follow our LinkedIn page for the latest updates on our weekly AI insights and other insights in Southeast Asia’s innovation landscape.

More insights in our conversation with Reuters Asia Technology correspondent Fanny Potkin:

Other References:

1. https://www.lexology.com/library/detail.aspx?g=c6616e30-de8f-4915-9572-7f85b0dae786
2. https://www.cnbc.com/2016/09/02/uber-and-lyft-are-getting-pushback-from-municipalities-all-over-the-us.html 
3. https://lkycic.sutd.edu.sg/blog/impact-chinas-new-regulations-uber-didi/ 
4. https://theconversation.com/indonesia-sets-new-rules-for-ride-sharing-companies-57187 
5. https://vir.com.vn/vietnam-formalises-legal-framework-for-grab-and-other-ride-hailing-platforms-75312.html#:~:text=From%20April%201%2C%20Decree%20No,pilot%20e%2Dhailing%20programme%20ended. 
6. https://www.nytimes.com/2023/05/22/business/meta-facebook-eu-privacy-fine.html 
7. https://restofworld.org/2022/indonesia-social-media-regulations/ 
8. https://www.cnbc.com/2023/01/01/more-social-media-regulation-is-coming-in-2023-members-of-congress-say.html 
9. https://www.theguardian.com/technology/2023/jun/13/artificial-intelligence-us-regulation
10. https://edition.cnn.com/2023/07/14/tech/china-ai-regulation-intl-hnk/index.html
11. https://resourcehub.bakermckenzie.com/en/resources/data-privacy-security/asia-pacific/thailand/topics/key-data-privacy-and-security-laws
12. https://fpf.org/blog/vietnams-personal-data-protection-decree-overview-key-takeaways-and-context/
13. https://hsfnotes.com/data/2022/08/17/privacy-law-reform-in-malaysia-one-step-closer-to-mandatory-breach-notification/