Data Hk – A Guide to Personal Data Protection in Hong Kong
Data hk is Hong Kong’s data privacy regulator website and serves to educate the public on personal data issues while conducting investigations and enforcement actions relating to said issues. Furthermore, Data hk’s pages are regularly updated to reflect any developments in Hong Kong regarding data protection law or regulations such as Personal Data (Protection) Ordinance (“PDPO”).
Since it was first implemented in 1996, the definition of personal data in the PDPO has remained consistent with international norms and remains in compliance. “Personal Data” means any information pertaining to an identifiable or identifiable individual. Furthermore, six data protection principles comprise core obligations for all users who collect, hold, process or utilize personal data – these cover collection, storage processing use.
First and foremost, data users must uphold their obligation to explicitly notify data subjects on or prior to collecting their personal data of its purposes and possible recipients before it is collected or transferred – this requirement mirrors GDPR; however, in Hong Kong it applies only if transferring personal data for specific reasons that were disclosed prior to collection of said personal data.
Data users must also comply with a legal requirement that requires them to ensure any personal data they transfer to data importers does not contain sensitive information (for instance, information that could identify someone). They should take steps to assess whether the laws and practices in foreign jurisdictions provide adequate protection for such personal data.
If the assessment shows that foreign laws and practices fail to adequately safeguard personal data, data exporters may take additional measures such as technical or contractual agreements in order to meet Hong Kong standards of protection for personal data.
Understanding the requirements of data transfers under PDPO is vitally important for businesses, helping to minimize compliance risk and enable efficient cross-border personal data transfers. Padraig Walsh from Tanner De Witt’s Data Privacy practice group discusses some key points when moving personal information outside Hong Kong.