Data Privacy in Hong Kong is an increasingly pressing concern for businesses. Collection and usage of personal data are subject to stringent regulation here, especially regarding cross-border transfers of such information. Padraig Walsh of Tanner De Witt’s Data Privacy practice group highlights some key points regarding such transfers.
First and foremost is whether the data in question constitutes “personal” information – that is, does it relate to an identifiable natural person? This question is crucial as PDPO defines “personal data” very narrowly: It covers information that could lead to the identification of an individual (including name, ID number, address, telephone number, e-mail address and any details pertaining to physical, physiological, genetic, mental, economic or cultural identities).
Next, one must determine whether the transfer falls under the purview of the Personal Data Protection Ordinance (PDPO). The PDPO applies to anyone responsible for collecting, holding, processing or using personal data within Hong Kong and does not extend beyond this territory as is often seen with other data protection regimes.
If both questions are answered in the affirmative, then it must be remembered that any transfer of personal data outside Hong Kong will trigger various obligations under PDPO, including six core DPPs and DPP5. Of paramount importance is obtaining consent from data subjects for any non-PICS purpose as per PCPD which defines transfer as usage.
Whenever it is unclear whether personal data exported meets this standard, data exporters should take measures to identify and implement any additional protections necessary to bring its level of protection in line with what is provided for under the PDPO. These could include technical measures such as encryption or anonymisation and contractual provisions on audit and inspection, beach notification and compliance support and co-operation. In addition, data exporters must review their PICS to make sure that they have properly disclosed both their intention to transfer as well as its underlying grounds.