Just six of 112 Hong Kong online stores surveyed declare to customers that data collected was used for artificial intelligence (AI) purposes, as the city’s Consumer Council called for more comprehensive privacy legislation on the usage of the technology.

Such intentions include AI models training, which uses consumer information to improve business performance.

The news came on Thursday as the council announced its latest survey results on consumers’ perception, usage habits of AI in e-commerce and data privacy.

“AI models training should be an independent purpose listed for data collection,” council chairman Clement Chan Kam-wing said.

He added that there was too much information on consumers collected by traders, including data on “employment status”, “marital status” and “education level” which were not directly related to transactions. Six to 10 per cent of some 109 traders in the survey said they collected those items on their platforms.

“AI is a double-edged sword as it fosters economic growth and provides more personalised shopping experiences to consumers,” Chan said. “But it also poses risks to consumers if traders do not fully disclose the details of data collection.”

Clement Chan Kam-wing of the Consumer Council.

AI can help online retailers cater to customer experience on and off their websites by using collected consumers’ data. The information can help businesses accurately predict consumers’ behaviour and in turn improve their business.

In Hong Kong, AI is commonly employed in the form of chatbots, software that simulates human-like conversations with users using text messages. It can also be used to recommend products to customers, or through advanced biometrics and augmented reality, which lays a computer-generated image or animation over a user’s view of the real world.

With the increasing adoption of AI in e-commerce, the council is hoping to enable the “healthy development” of the technology.

Among the 112 Hong Kong and overseas online stores reviewed in the survey, 85 per cent mentioned “survey, market research and data analysis” as their purpose of data collection but using the information for training AI models was rarely mentioned, Chan said.

Only six of the stores indicated that they collected data for AI purposes. It is unclear if the others surveyed also do so.

While many countries are revising their laws for AI applications, there is no specific legislation on the technology in Hong Kong, only guidelines issued by three government bodies: the Office of the Privacy Commissioner for Personal Data, the Monetary Authority and Securities and Futures Commission.

Industries like insurance and tourism, which gather relatively large amounts of personal data, need to have more specific sectoral regulations, said Gilly Wong Fung-han, chief executive of the Consumer Council.

“When you book flight tickets and hotel accommodation, a lot of personal data has been collected online,” she said.

The council urged the government to conduct a comprehensive strategic study in preparation for legislation.

More than 1,219 Hongkongers aged 15 or above who had visited online stores between October and November 2 in 2021 were also surveyed. Among them, 74 per cent said they were worried about the excessive data collection of traders, but 60 per cent had never read privacy policies on the websites.

Wong said the average time needed to read an entire privacy policy takes 20 minutes, and as some terminologies could be hard to understand, “some consumers will directly click agree without even reading it, which is not ideal”.

She suggested traders could publish a more “concise” version of the privacy policy for easier understanding.

Stuart Hargreaves, an associate professor at Chinese University of Hong Kong’s law faculty, highlighted that the Personal Data (Privacy) Ordinance has not had a major update since it was introduced in 1995.

“Hong Kong’s current data protection law does not specifically address AI-related topics, as it is designed to be technologically neutral,” he said.

“Hong Kong should comprehensively overhaul the ordinance rather than on a piecemeal basis as new scandals arise, in order to protect residents from a wide range of modern privacy harms that they suffer online.”