Data hk aims to promote best practice in managing personal data and reducing business risk, as well as efficient compliance for data transfers between businesses. It also aims to facilitate the sharing of information and best practices on personal data management across jurisdictions. The site features resources such as data sets, a knowledge hub, blogs and a marketplace. Its publications include reports, forecasts and statistics on a wide range of topics such as economies, consumers, industries and technology.
In Hong Kong, a data user must expressly inform a person before collecting his personal data about the purposes for which the information will be used and the classes of persons to whom the personal data may be transferred (DPP1 and DPP3). This requirement is often met by the provision of a PICS in which the data user sets out this information.
The definition of personal data under the PDPO is similar to that of other legislative regimes – it refers to information relating to an identified or identifiable natural person, and includes identification numbers, location data, online identifiers and factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of a person. The fact that the PDPO does not contain a restriction on the export of personal data out of Hong Kong means that businesses need to consider carefully whether the PDPO is applicable when planning an international transfer of their data.
There are a growing number of circumstances in which a business operating in Hong Kong will need to conduct a transfer impact assessment when it receives personal data from a jurisdiction outside of Hong Kong. This will often be the case where a data importer is receiving personal data of individuals from a country in the European Economic Area (EEA). The PCPD has issued recommended model contractual clauses to address this, and it is likely that the model will become mandatory in circumstances where the PDPO applies to the transfer of data out of Hong Kong.
There is a general sense of indifference within the business community about the PDPO’s intention to bring section 33 into force, mainly because there is little evidence that it would result in problems with cross-border data transfers. Nevertheless, as the need for efficient and reliable ways to transfer data with mainland China and internationally increases, pressure on the Government will undoubtedly increase in relation to its approach to implementing section 33.