ST Explains: Can customers say no to the use of their personal data for AI training?

Singapore has introduced new regulations requiring companies to inform consumers when they use personal data to train artificial intelligence (AI) models. These rules apply to a range of industries, including banking, insurance, e-commerce platforms, and social media companies. The guidelines aim to ensure transparency while allowing organisations flexibility in how they implement AI technologies. The regulation applies specifically when personal data is used for AI training. Organisations must notify customers if they intend to use their data in this manner. However, there are exceptions. For example, if anonymised datasets are used instead of raw personal data, notifications are not required. Additionally, certain sectors may be exempt depending on the nature of their operations and the type of data being processed. In the banking sector, institutions may deploy AI assistants to offer financial advice, such as helping customers plan budgets or choose suitable credit cards. These systems rely on data such as age, income, spending habits, and travel frequency. Banks are required to inform customers about the use of their data for AI training, though they are not obligated to provide opt-out options. Notifications can appear on websites or through mobile app pop-ups. If the AI system uses anonymised data, however, no notice is needed. Insurance companies face similar requirements. They may utilise AI assistants to assist with medical insurance claims, reviewing diagnostic reports, prescriptions, and medical records. The AI also considers photos or videos related to claims to provide more accurate guidance. Like banks, insurers must notify customers about the use of their data for AI training, but again, they are not required to offer opt-outs. The Personal Data Protection Commission (PDPC) clarified that organisations cannot demand consent for AI training as a prerequisite for accessing services unless it is strictly necessary. E-commerce platforms, which previously used customer purchase histories and browsing behaviours to make recommendations, now face additional obligations. If they decide to use this data to train an AI model intended for sale as a commercial product, they must issue a separate notification. Even if users were already informed about data usage for recommendations, the new purpose, training an AI for external licensing, requires a distinct disclosure. Social media platforms planning to use user-generated content, such as posts, photos, and videos, to improve AI tools for content creation must also notify users. This includes features like caption suggestions, image enhancement, and video editing. Platforms may update their privacy policies to include statements explaining that user-submitted content may be used for AI training and model refinement. Such disclosures aim to clarify how AI capabilities enhance user experiences while maintaining transparency. Legal experts, such as Toh Ming Min from BR Law Corporation, have noted that the key consideration lies in determining whether the use of personal data for AI training is essential to delivering the service. In cases where declining participation would significantly reduce the service's utility, the necessity of data usage becomes clearer. Nevertheless, the requirement for clear communication remains central to ensuring consumer trust and compliance with regulatory expectations. As these rules take effect, organisations across various sectors will need to review their data practices and adjust their notification strategies accordingly. The focus remains on balancing innovation with ethical data handling, ensuring that consumers are fully aware of how their information is utilised in the evolving landscape of AI technology.