Data hk is an online resource for Hong Kong businesses on personal data protection issues, managed by the Privacy Commissioner for Personal Data (“PCPD”). It covers topics including international transfers of personal data outside Hong Kong.
No legal restrictions restrict the international transfer of personal data in Hong Kong; however, any person seeking to transfer personal data must conduct a Privacy Impact and Compliance System Assessment and in most cases agree to additional contractual provisions that impose obligations such as beach notification, audit support and compliance co-operation obligations on them. The PCPD has published two sets of recommended model clauses which cater for different scenarios: (i) when data users transfer their own data directly to another data user and (ii) processors transfer personal data directly into user’s hands.
As part of a PICS assessment, an assessor will look at whether foreign jurisdiction’s laws or practices raise any concerns over the level of data protection during transfer. If such concerns do exist, data exporter must identify and take measures to meet Hong Kong standards of data protection in transfer. These may include technical measures like encryption or pseudonymisation; contractual ones like audit/inspection reporting obligations as well as beach notification obligations along with compliance support/co-operation arrangements.
Finally, it should be noted that the PDPO defines personal data as any information which identifies an individual in an identifiable way and which can be easily processed into meaningful form for identification. This definition mirrors similar ones found in other privacy regimes such as mainland China’s Personal Information Protection Law or Europe’s General Data Protection Regulation (GDPR).
The PDPO requires anyone who intends to transfer personal data must first notify the PCPD. Furthermore, only users who submit written applications and receive consent from transferees will be granted licences by the PCPD in order to ensure compliance with its provisions.
The PCPD is currently considering whether to implement new measures that would strengthen protections in regard to transfers of personal data from China and EEA, which would be welcomed and welcomed with open arms by businesses alike. Such measures would make data transfers to and from Hong Kong simpler while increasing compliance measures related to such transfers; ultimately boosting Hong Kong as an attractive location for storage and processing personal data while making Hong Kong more competitive as an asset class for global business operations – this would be a win-win scenario! The PCPD’s full report regarding such proposals will be published late 2022.