Key Points to Note on Data Transfers
In an increasingly globalised world, it is essential that businesses have clear and efficient compliance with data transfer regulation. Padraig Walsh from Tanner De Witt guides us through key points to note on data transfers, both between Hong Kong and elsewhere and from overseas into Hong Kong.
Data users have significant and onerous obligations when it comes to transferring personal data overseas. They must adopt contractual or other means to ensure that any personal data they transfer outside of Hong Kong will be protected. This can be achieved through separate agreements, schedules to a main commercial agreement or as contractual provisions within the main commercial agreement. The form of the arrangements ultimately does not matter; it is what they protect that matters.
When personal data is transferred between Hong Kong and overseas, it must be protected from unauthorised access, processing, erasure or loss when in transit. This is important because a failure to protect the personal data in this way can lead to substantial penalties under the PDPO and other regulatory regimes. This can be the case even if the personal data is being transferred under an approved arrangement, such as a PICS.
The definition of personal data in the PDPO was first established when it was enacted in 1996 and is consistent with international norms at that time. However, the wording of the definition has been updated in other legislative regimes such as in mainland China and the European Union (EU). The GDPR includes a more specific and broader definition of personal data.
Hong Kong’s unique position as an international economic powerhouse and information hub, combined with the close integration of cities in the Greater Bay Area, makes it an ideal location to facilitate cross-border data flows. To this end, the GBA SC has taken a number of measures to foster such flows, including the introduction of a pilot scheme to allow academics in Hong Kong and Macau to bypass the Great Firewall of China for scientific research purposes.
As a result of these initiatives, the Greater Bay Area is expected to become a leading global centre for high-value data centres and related services. This in turn will contribute to the sustainable development of Hong Kong as a premier global technology hub and attract more companies to set up data centres in the region. It will also provide a platform for Hong Kong to build stronger and more diverse technology industries, which in turn will create more employment opportunities in the sector. This will benefit all sectors of our economy. It will also help to foster a vibrant and innovative culture in the GBA region.