Data hk is an online database of information on Hong Kong’s data privacy practices that reveals achievements and challenges in the city, and introduces international best practices. Its assessment tools and principles are designed to be applied on a voluntary basis by companies wishing to disclose their data processing practices.
Data protection in Hong Kong is based on the PDPO. The key feature of the PDPO is that it requires a data user to expressly inform a person, on or before collecting his personal data, of the purposes for which the data will be used and the classes of persons to whom the data may be transferred. Moreover, a data user must also keep a record of the purpose for which personal data has been collected.
If a data user’s assessment of the laws and practices of the destination jurisdiction reveals that the level of data protection there does not meet the standards prescribed under the PDPO, the data user must take supplementary measures to bring the level of data protection up to Hong Kong standards. These supplementary measures may be technical or contractual. Technical measures may include encryption, pseudonymisation or split and multi-party processing. Contractual measures might include additional contractual provisions on audit, inspection and reporting, beach notification and compliance support and co-operation.
The PCPD has published guidance on cross-border data transfers, including recommended model clauses for inclusion in contracts relating to data transfer, and it has advised data exporters that they should adhere to the principle of data transparency. In addition, a data exporter should consider taking legal advice to confirm whether the provisions of its contracts with data importers will be enforceable in the jurisdiction in which they will be operating.
A discussion paper published by the PCPD earlier this year explored possible changes to the PDPO, including a change in the definition of personal data, aimed at broadening its scope and making it easier to comply with the PDPO’s requirements. Such a move would add extra protections for individuals, and increase compliance measures for businesses that use data-related technologies to learn about people’s behaviours or process information that will have an impact on them.
The definition of personal data in the PDPO currently refers only to ‘identifiable’ data about an individual, whereas GDPR defines personal data as information that can be used to identify an individual, whether or not that information is already identifiable. This change, if made, will significantly widen the pool of data that is subject to the PDPO’s requirements in respect of transfer abroad and other obligations. This is an important step for enhancing the protection of the personal data of individuals in Hong Kong. It will require careful consideration of the impact on businesses and individuals alike. However, if the decision is to retain the current definition of personal data, then it is essential that there are rigorous enforcement measures in place to ensure that the PDPO’s standards are upheld. Otherwise, the benefits of this enhanced protection will be lost.