Anyone in Hong Kong responsible for collecting, holding, processing and using personal data must abide by the six data protection principles (DPPs) laid out in the Personal Data Protection Ordinance (PDPO). Furthermore, that person must ensure any agent or contractor they share data with also comply with said DPPs; this requirement extends even when personal data leaves Hong Kong.
However, it should be noted that Hong Kong law does not include express provisions conferring extraterritorial application of DPPs; however this does not indicate a lack of restrictions on personal data transfers from Hong Kong. The PCPD has published guidance regarding this matter including recommended model clauses to include into data processing agreements with third parties – these could either be separate contractual arrangements, schedules to main commercial agreement or contractual provisions within main commercial arrangement.
First step to compliance with PDPO: determine whether a transfer of personal data falls within its ambit. This decision depends upon several factors including who acquired and collected it as well as who it will be transferred to and its purpose of use. Under PDPO’s definition of personal data – including non-identifiable items like photos and CCTV recordings -, its coverage cannot be easily determined.
As part of any personal data collection exercise, it is also vital that DPP1 and DPP2 obligations have been fulfilled. DPP1 requires data users to inform data subjects expressly before collecting their personal data about its purpose, purposes for collection and classes of persons to whom it will be transferred; while DPP2 stipulates that personal data may only be used for new purposes if voluntary consent from data subjects has been secured before doing so.
When it comes to data transfers, DPP3 and PICS requirements relating to the “lawful basis” for processing the data are key considerations. As was noted above, Hong Kong makes this step significantly less burdensome than GDPR does.
As best practices dictate, many businesses have taken the step of obtaining explicit written consent from data subjects prior to transmitting any personal data pertaining to them. Failing to do this may result in enforcement action by the PCPD.
Businesses transferring personal data of European Economic Area residents (EEA residents) to Hong Kong have increasingly adopted a practice known as transfer impact assessments as an early step in this process. These analyses aim to ascertain any concerns over Hong Kong’s level of protection, which serves as a precondition for agreeing on standard contractual clauses. A transfer impact analysis might lead the data exporter or importer to take additional measures upon receiving personal data in Hong Kong, in case this analysis identifies any discrepancies regarding its processing once arrived at its final destination – either way it’s an integral step that needs not to be taken for each transaction!