Data Handling in Hong Kong
Data hk refers to the practice of gathering and analyzing information that allows businesses to make more informed business decisions, often seen across finance, insurance and marketing sectors. Information gathered can be used to measure customer satisfaction or identify market trends, while also being useful to government agencies for policy formation and planning purposes. Data gathering includes both primary and secondary sources of data collection. Primary information can come from field observations and published reports, while secondary sources include public statistics and industry studies. With this data in hand, reports and statistical analysis can then be developed that can be used commercially – for instance to identify customer trends or assess financial performance.
Hong Kong’s Personal Data Protection Ordinance (PDPO) regulates personal data protection through six data protection principles that outline specific obligations for data controllers and regulate collection, holding, processing and use of personal information.
Section 33 of the PDPO was intended to limit transfers of personal data outside Hong Kong unless certain conditions are fulfilled; however, its implementation has been postponed due to resistance from businesses and new global regulatory frameworks emerging since.
Without legal restrictions in Hong Kong, what should data users do in regard to cross-border transfers of personal data? In this respect, a careful evaluation of obligations imposed upon data users under the Personal Data Protection Ordinance and interpretation of key privacy concepts are key steps for taking appropriate actions in regards to cross-border data transfers.
First and foremost, data users must abide by statutory obligations related to collection and use. This includes informing data subjects of their rights upon collection as well as to whom such personal data may be transferred upon or before its date of collection; PICSs should include this information which must also be updated should its original purpose change.
Considerations should also be given to how the PDPO defines personal data as information that pertains to an identifiable individual, which is consistent with other legislative regimes such as China’s Personal Information Protection Law or Europe’s General Data Protection Regulation.
Before transferring personal data overseas, data importers should always conduct a transfer impact analysis. This step should take into account both countries’ levels of data protection as well as any national security concerns that may exist. It has become more prevalent for data importers to agree to standard contractual clauses found within the PDPO’s recommended model contractual clauses; this can greatly aid compliance with this piece of legislation.