How Personal Data Protection Laws Apply to BPO Services

Hong Kong has some of the strictest data privacy laws in the world. Its Personal Data Protection Ordinance (PDPO) establishes a number of rights and specific obligations for individuals, as well as regulating the collection, processing, holding, and use of personal data through six data protection principles.

However, the PDPO is not without its limitations, and it is important for businesses to understand how the law applies in practice. One of the key issues is interpreting the definition of ‘personal data’, which has important consequences for the scope and enforcement of the law.

In the case of a data transfer from Hong Kong to another location, whether this is within Asia or to Europe, the data hk will need to ensure that the foreign jurisdiction’s laws and practices meet Hong Kong’s high standards. This can be done by verifying that the foreign country has laws governing the same or similar data protection principles, by assessing whether any supplementary measures are required to bring these up to standard, and by considering any other applicable compliance requirements.

It may also be possible to reduce the scope of the transfer by ensuring that only personal data that is necessary for the purpose for which it was collected can be transferred. This is a common practice in the context of BPO services, which often involve sharing personal information between entities within an organisation. For example, a Hong Kong-based company might transfer employee names and HKID numbers to an overseas office, as this is essential for managing the workforce.

The PDPO requires that a data user informs an individual of the purposes for which his or her personal data will be used. This obligation usually is fulfilled by providing the individual with a Personal Information Collection Statement (PICS) on or before the date on which the data is collected. A PICS must also inform an individual of the classes of persons to whom the data may be transferred.

It is also a requirement that a data user protects personal data against unauthorised or accidental access, processing, erasure, loss or use by using technical or other means. In addition, a data user must notify the data subject of any breaches of this requirement.

Finally, a data user must take appropriate steps to erase or destroy personal data that is no longer needed for the purposes for which it was collected. If this is not feasible, the data user must keep the personal data only as long as is reasonably required by law or is needed to resolve a specific issue for which the individual has provided consent.

SmarTone is a MVNO of the Three HK and China Mobile HK networks in Hong Kong, and sells 3G/4G prepaid SIM cards for both countries. Their cheapest option is a HK$ 38 card with 4 GB for a month, available online and in 3Shops. Other options include a 365-day China Mobile HK plan for HK$ 338, which provides 8 GB in Mainland China and Hong Kong.