Text
19 January 2024
Re: REQUEST FOR COMMENTS/INSIGHTS REGARDING THE USE OF ARTIFICIAL INTELLIGENCE (AI) IN THE CIVIL SERVICE COMMISSION’S (CSC) CORRESPONDENCE
Dear [Redacted],
We provide this Advisory Opinion upon the referral of the Department of Information and Communications Technology (DICT) as regards your request for comments and insights on the data privacy implications in the use of artificial intelligence (AI) for the Civil Service Commission’s (CSC) correspondence.
Discussion
On the use of AI in the processing of personal information; general principles; data subject rights; privacy impact assessment
According to the Organization for Economic Co-operation and Development (OECD), “[a]n AI system is a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment.”1
We reiterate the discussion in our 18 August 2023 letter that, at present, we see no manifest conflict with the use of AI in relation to the provisions of the Data Privacy Act of 2012 (DPA).2 The DPA recognizes the policy of the State to ensure the free flow of information and to promote innovation and growth, alongside its duty to protect the fundamental human rights of privacy and of communication.
Section 4 of the DPA states that the law applies to the processing of all types of personal information, save for some exceptions. The DPA does not distinguish as to the type of technology used in the processing of personal information. Hence, whether the processing uses AI technology or not, the processing must abide by the provisions of the DPA as with other means and methods of processing information.
In other words, personal information controllers (PICs) who are processing personal information using AI technology must adhere to the general principles of privacy, have a lawful basis for processing, implement reasonable appropriate security measures, and uphold data subject rights, among other obligations under the DPA. Consequently, PICs are accountable for the means and methods they use in processing personal information.
Specifically for the principle of transparency in relation to the right of data subjects to be informed and right to rectify, the CSC must provide adequate information to data subjects and have mechanisms in place to enable them to exercise their rights. Please refer to NPC Advisory No. 2021-01: Data Subject Rights for further information.
In addition, the CSC should assess whether the use of any AI technology is fair and proportional to the purpose of processing, considering the risks to the rights and freedoms of data subjects. This may be done by conducting a privacy impact assessment (PIA). For further guidance on PIAs, please see NPC Advisory No. 2017-03: Guidelines on Privacy Impact Assessments.
On the use of AI to improve correspondences and communication
We acknowledge that using AI has its advantages such as improving human productivity. The OECD has also acknowledged its potential:
“Artificial Intelligence (AI) is a general-purpose technology that has the potential to: improve the welfare and well-being of people, contribute to positive sustainable global economic activity, increase innovation and productivity, and help respond to key global challenges. It is deployed in many sectors ranging from production, finance and transport to healthcare and security.”3
On this note, we do not see any apparent issues in using AI, such as Chat Generative Pre-Trained Transformer (ChatGPT), to improve CSC’s correspondence. However, we emphasize that if personal information is processed using such AI, PICs must implement proper safeguards to ensure the protection of the rights of data subjects.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
cc:
Footnotes
-
Organization for Economic Co-operation and Development (OECD), AI terms & concepts, available at: https://oecd.ai/en/ai-principles [last accessed date: 15 January 2024]. ↩
-
An Act Protecting Individual Personal Information in Information and Communication Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Organization for Economic Co-operation and Development (OECD), Recommendation of the Council on Artificial Intelligence [OECD/Legal/0449], available at: https://legalinstruments.oecd.org/en/instruments/oecd-legal-0449#:~:text=The%20OECD’s%20work%20on%20Artificial,respond%20to%20key%20global%20challenges. [last accessed date: 15 January 2024] ↩