#
AI governance is active but entirely soft-law; national-security carve-outs materially limit PCPD's supervisory reach; profiling/ADM-transparency/genetic-data sub-modules are unevidenced.
Sub-modules (6)
Profiling RestrictionsRed
No Art.22-style statutory profiling restriction was identified in the PDPO.
Absence provenance: unavailable. Searched: Hong Kong PDPO profiling restriction automated decision.
Automated Decision Making TransparencyRed
No statutory ADM-transparency or explanation right was identified beyond general AI governance guidance.
Absence provenance: unavailable. Searched: Hong Kong PDPO automated decision-making transparency right.
Ai Risk AssessmentsAmber
PCPD's AI compliance-check programme and Model Framework recommend (non-binding) risk assessments, governance structures, and audits for AI systems.
Claims (3):
- On 11 June 2024, the PCPD published the Artificial Intelligence: Model Personal Data Protection Framework, providing recommendations and best practices for AI governance covering procurement, implementation, and use of AI systems including generative AI, building on its 2021 Guidance on the Ethical Development and Use of AI.
- The PCPD's 2024-25 Annual Report describes the AI Model Framework as one of the first explicit regional frameworks for regulating AI, reflecting the Commissioner's stated aim to balance innovation and security in AI.
- PCPD compliance checks on 60 organizations found 80% used AI in daily operations (a 5% increase from 2024), with the PCPD recommending AI governance structures, comprehensive risk assessments, and regular audits as best practice.
Biometric RegimeAmber
PCPD guidance flags biometric data, alongside HKID numbers and credit data, as requiring heightened caution, without a codified statutory biometric regime.
Claims (1):
- The PCPD has published guidelines regarding the collection and use of biometric data, alongside Hong Kong identity cards and consumer credit data, highlighting the need for caution absent a codified statutory biometric regime.
Genetic DataRed
No dedicated genetic-data regime was identified in this research pass.
Absence provenance: unavailable. Searched: Hong Kong genetic data protection law PDPO.
State Surveillance CarveoutsRed
The PCPD's ability to supervise and regulate authorities' actions under the National Security Law appears fairly limited, as the NSL expressly takes precedence over inconsistent local laws.
Claims (1):
- In relation to the exercise of authorities' powers under the National Security Law, the PCPD's ability to supervise and regulate compliance with the PDPO appears fairly limited, as the NSL expressly takes precedence over inconsistent provisions of other Hong Kong laws.
Algorithmic, Biometric & Surveillance Governance
Two developments mark this module as active for Hong Kong. The Privacy Commissioner for Personal Data's investigation into the Worldcoin iris-scanning biometric project, commenced in January 2024, has concluded with a finding that the project contravened the Personal Data (Privacy) Ordinance, as recorded in a paper submitted to the Legislative Council. The specific Data Protection Principle found to have been breached, and the full detail of any enforcement outcome beyond the finding of contravention itself, were not independently confirmed from a source beyond that Legislative Council summary, so this finding is reported at the level of detail the available record supports.
Separately, the PCPD published, on 25 August 2026, a supplement to its Model Personal Data Protection Framework titled to address protection of personal data privacy in the use of agentic artificial intelligence. This supplements the Commissioner's existing 2024 Model Framework and extends non-binding guidance into a category of automated, autonomously-acting AI systems that the original framework did not specifically address. As with the original framework, this guidance carries no binding legal force and does not itself create new statutory obligations under the Personal Data (Privacy) Ordinance.
Taken together, these two developments indicate that Hong Kong's approach to biometric and algorithmic governance continues to operate primarily through the PCPD's existing enforcement powers under the Ordinance and through non-binding guidance, rather than through a dedicated biometric- or AI-specific statute. The Worldcoin finding demonstrates that biometric data processing is being actively reviewed and found wanting under the existing Data Protection Principles framework, even without AI- or biometric-specific legislation in place.
Outlook
Whether the Worldcoin investigation results in a published Enforcement Notice, and what specific remedial steps or restrictions it imposes, is the most consequential open question in this module going forward. Equally, whether the PCPD's Agentic-AI guidance supplement is followed by further sector-specific or binding rule-making, or remains non-binding guidance indefinitely, will determine whether Hong Kong's algorithmic-governance approach continues to rely solely on existing DPP-based enforcement extended by interpretation, or moves toward more specific statutory footing.
1 earlier distinct update(s)
Algorithmic, Biometric & Surveillance Governance
Two developments mark this module as active this cycle for Hong Kong. The Privacy Commissioner for Personal Data's investigation into the Worldcoin iris-scanning biometric project, commenced in January 2024, has concluded with a finding that the project contravened the Personal Data (Privacy) Ordinance, as recorded in a paper submitted to the Legislative Council. The specific Data Protection Principle found to have been breached, and the full detail of any enforcement outcome beyond the finding of contravention itself, were not independently confirmed from a source beyond that Legislative Council summary, so this finding is reported at the level of detail the available record supports.
Separately, the PCPD published, on 25 August 2026, a supplement to its Model Personal Data Protection Framework titled to address protection of personal data privacy in the use of agentic artificial intelligence. This supplements the Commissioner's existing 2024 Model Framework and extends non-binding guidance into a category of automated, autonomously-acting AI systems that the original framework did not specifically address. As with the original framework, this guidance carries no binding legal force and does not itself create new statutory obligations under the Personal Data (Privacy) Ordinance.
Taken together, these two developments indicate that Hong Kong's approach to biometric and algorithmic governance continues to operate primarily through the PCPD's existing enforcement powers under the Ordinance and through non-binding guidance, rather than through a dedicated biometric- or AI-specific statute. The Worldcoin finding demonstrates that biometric data processing is being actively reviewed and found wanting under the existing Data Protection Principles framework, even without AI- or biometric-specific legislation in place.
Outlook
Whether the Worldcoin investigation results in a published Enforcement Notice, and what specific remedial steps or restrictions it imposes, is the most consequential open question in this module going forward. Equally, whether the PCPD's Agentic-AI guidance supplement is followed by further sector-specific or binding rule-making, or remains non-binding guidance indefinitely, will determine whether Hong Kong's algorithmic-governance approach continues to rely solely on existing DPP-based enforcement extended by interpretation, or moves toward more specific statutory footing.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (5)
- ProbableDataGuidance — On 11 June 2024, the PCPD published the Artificial Intelligence: Model Personal Data Protection Framework, providing recommendations and best practices for AI governance covering procurement, implementation, and use of AI systems including generative AI, building on its 2021 Guidance on the Ethical Development and Use of AI.observed
- ProbableIAPP — The PCPD's 2024-25 Annual Report describes the AI Model Framework as one of the first explicit regional frameworks for regulating AI, reflecting the Commissioner's stated aim to balance innovation and security in AI.observed
- ProbableIAPP — PCPD compliance checks on 60 organizations found 80% used AI in daily operations (a 5% increase from 2024), with the PCPD recommending AI governance structures, comprehensive risk assessments, and regular audits as best practice.observed
- ProbableDataGuidance — The PCPD has published guidelines regarding the collection and use of biometric data, alongside Hong Kong identity cards and consumer credit data, highlighting the need for caution absent a codified statutory biometric regime.observed
- ProbableDataGuidance — In relation to the exercise of authorities' powers under the National Security Law, the PCPD's ability to supervise and regulate compliance with the PDPO appears fairly limited, as the NSL expressly takes precedence over inconsistent provisions of other Hong Kong laws.observed