Data Hk – Current Issues in Data Privacy in Hong Kong
Data hk is a platform for discussion about current issues in data privacy in Hong Kong. It is hosted by the Personal Information Protection Commission (PIPC) and provides a venue for discussing and developing solutions to privacy issues in the business community.
Data privacy in Hong Kong is governed by the Personal Data (Privacy) Ordinance (“PDPO”), which contains six DPPs that form core data obligations for data users. One of these obligations is to fulfil DPP1 (Purpose and collection of personal data) and DPP3 (Use of personal data). This includes notifying the data subject of the purposes for which the personal data will be used including any intention to transfer the data to a third party, and obtaining the data subject’s voluntary express consent to the transfer.
The concept of data user is broadly defined in the PDPO to include any person who controls the collection, holding, processing or use of personal data. This would include a sole proprietorship, partnership, or corporate entity. However, an individual may also be considered to be a data user if he or she controls the data processing activities of another person.
This definition of data user is significant as it means that individuals will be able to raise concerns about the handling of their personal data by any person who is considered to be a data user. This could impact the reputation of businesses who have been perceived to be irresponsible in their dealings with personal data.
In addition to these statutory obligations in respect of collecting and using personal data, there are additional considerations in relation to the transfer of personal data outside of Hong Kong. As the volume of data transfer grows, there is a need to have efficient and reliable legal provisions for this purpose.
A key issue in relation to this is section 33 of the PDPO. This is a statutory provision that requires the data exporter to identify and adopt any supplementary measures required to bring the level of protection of personal data transferred to a foreign jurisdiction up to that required in Hong Kong. This can be done by a combination of technical and contractual measures.
This may be particularly important in the context of the growth of cross-border data transfer between Hong Kong and mainland China. It is expected that more businesses will seek to transfer data between Hong Kong and mainland China, given the increasing interconnectedness of business and social life in both territories.
A common scenario is the sharing of staff information on a company’s intranet. This data is likely to exhibit the name and HKID number of an employee. Generally, this combination of data should not be displayed together and should only be made available to those who need it in order to carry out activities related to the purpose in which the information was collected. It is therefore important to consider whether or not this type of data is really personal data and should be protected under the PDPO.