Ethical AI and Personal Data Protection for AI-Driven Mobile Network Operators

Abstract

Artificial intelligence now influences both network engineering and subscriber-facing decisions within mobile network operators (MNOs). The data used for these tasks—call detail records, device identifiers, radio measurements, location histories, and inferred profiles—can reveal far more about a person than the original service requires. This study uses a problem-oriented integrative review to examine four interconnected questions: which personal data are required for common MNO use cases; how privacy, fairness, and opacity risks arise; which legal and governance instruments are relevant; and which controls provide auditable evidence. Thailand’s Personal Data Protection Act provides the principal jurisdictional setting, while the EU General Data Protection Regulation and Artificial Intelligence Act are used where they may apply directly or offer a mature benchmark. The review identifies three recurring weaknesses in operator practice: treating pseudonymization as anonymization, treating location as an optional data field even though radio operation makes it inferable, and adopting ethical principles without assigning measurable controls or owners. In response, the study develops an MNO-specific four-layer governance framework that joins regulatory duties, ethical principles, technical safeguards, and lifecycle assurance under the NIST Govern–Map–Measure–Manage functions. Its distinctive contribution is a traceability chain from an AI use case and its data dependencies to risk, control, retained evidence, accountable ownership, and lifecycle action. A structured mobility-demand forecasting demonstration shows how the framework can record purpose, data granularity, privacy tests, performance thresholds, human responsibility, and post-deployment monitoring. The result is a decision-oriented reference for MNOs; it is not an empirical assessment of any operator or a substitute for jurisdiction-specific legal advice.