Data hk is a comprehensive resource for the latest information on business trends, market analysis and forecasts. Browse by industries or regions to get the information you need for informed decision-making. Data hk is free to use, but charges apply for access to detailed reports and statistics.
Data Protection in Hong Kong
There is currently no statutory restriction on the transfer of personal data from Hong Kong to other locations, although this situation may change. It is important that businesses understand how the PDPO, and the application of its principles in practice, applies to such transfers in order to avoid compliance problems. Padraig Walsh, a partner in the Data Privacy team at Tanner De Witt, will outline the key issues that need to be considered, and provides practical examples of how they can be addressed.
The first issue is the scope of the PDPO. The territorial scope of the PDPO is very narrow: it only applies where a person has operations controlling the collection, holding, processing or use of personal data in, or from, Hong Kong. This is very different to the approach taken by many other jurisdictions, where the scope of their regimes is wider.
In addition, the PDPO does not impose a duty on a data user to notify a data subject of their PICS (as required by DPP3) in cases where the purpose of the collection is not apparent from the description provided in the PICS. However, it is good practice to provide the PICS in such circumstances.
One other issue to consider is whether the data in question is “personal data” within the meaning of the PDPO. This is a definition which has not been updated since the PDPO was first introduced, and which is very different to the definition of personal data used in other legislative regimes, such as that found in the European Union’s General Data Protection Regulation (“GDPR”).
As more and more businesses make significant business decisions based on the availability and quality of data, it is important for them to have a clear understanding of how the PDPO applies to those decisions. While it is possible that the PDPO will be amended to bring it more in line with international norms, until such time as this happens, businesses should take care to ensure they fully understand their obligations under the existing regime. This will help them to minimise compliance risks and ensure that they are able to maximise the benefits of data transfers.
