Data Hk – What to Consider When Transferring Personal Data Outside Hong Kong
Data hk is the practice of collecting and analysing information in order to make better informed business decisions. Businesses of all sizes use data hk to measure customer satisfaction, identify market trends and optimise operations. Data hk is also used by government agencies to inform policy making and service delivery. However, the collection and analysis of personal data is subject to strict privacy regulation. Data hk is a complex area of law, and there are a number of issues that businesses need to consider when planning any data transfers. Padraig Walsh from the Data Privacy practice group at Tanner De Witt outlines some of the key points to note.
A business that wishes to transfer personal data outside Hong Kong must carry out a transfer impact assessment. This assessment is designed to help a company understand the benefits and risks of the transfer and ensure that its business and legal obligations under privacy law are met.
This obligation is triggered where a person “controls the collection, holding, processing or use of personal data”. The definition of personal data in the Hong Kong Personal Data Protection Ordinance (PDPO) remains unchanged since it was first enacted in 1996, and is consistent with international norms. It includes any information relating to an identified or identifiable individual.
As a result, there are many situations where a business may be required to conduct a transfer impact assessment. This is particularly the case when it offers goods or services to data subjects in the European Economic Area (“EEA”), monitors the behaviour of individuals in the EEA through its websites and apps, or collects personal data about those people who visit its websites or use its apps.
An adverse transfer impact assessment will require the business to suspend the transfer or implement adequate supplementary measures. The supplementary measures can include technical or contractual measures. The latter could involve techniques such as encryption, anonymisation or pseudonymisation, and split or multi-party processing. They might also include additional contractual provisions imposing obligations on audit, inspection and reporting, beach notification and compliance support and co-operation.
The PCPD has published recommended model clauses for inclusion in contracts that relate to a transfer of personal data outside Hong Kong. These set out the obligations that a data exporter must fulfil in respect of any transfer of personal data to a third party outside Hong Kong, including a requirement that the transferred data must not be kept longer than necessary for its purposes and a prohibition on allowing the transferred data to be processed in a way which would violate any of the six DPPs.
While the position taken by the PCPD on data transfers appears out of step with international trends, it is based upon the understanding that an adequacy regime would not be practicable in Hong Kong given its limited resources and the scale of its extensive cross-border business activities. This position may well be revisited in the future, as there is a growing recognition of the need for effective and efficient data transfer regulation globally.