Data hk is the website of Hong Kong’s privacy watchdog, the Personal Data Protection Commission (“PCPD”). This is where you can find information about the PCPD and its functions, including how to file complaints. It also contains useful guides on the six core data protection principles (“DPPs”) that form the basis of data privacy law in Hong Kong.
It is also where you can find a useful summary of the law on international transfers of personal data. There is a growing number of circumstances in which a Hong Kong business will be involved in the preparation and conduct of a transfer impact assessment, most commonly in relation to the export of data to jurisdictions that do not have laws comparable to those of Hong Kong.
The purpose of a transfer impact assessment is to determine whether or not a particular arrangement would lead to an undesirable outcome in respect of the processing of personal data transferred to a third country, including consideration of any available alternatives. It is not a requirement of Hong Kong law, but it can be a very helpful tool in helping data users to consider the legal issues involved before a transfer occurs.
In most cases, a data user will be required to prepare and publish a PICS before collecting personal data, as well as to inform the data subject of the purposes and intended use of that data. In addition, a data user may not collect personal data that is intended for transfer abroad without the express consent of the data subject (DPPs 1 and 3). These obligations are usually fulfilled by including recommended model clauses in contracts dealing with data transfers.
There are a number of exemptions from the DPPs, including the requirement to limit data processing to that which is necessary and proportionate in a given situation. For example, the collection of a photograph of a crowd at an event can be lawful provided that it does not identify individuals and is not used to contact them directly for marketing purposes. Other examples include CCTV recordings, logs of persons entering car parks and records of meetings that do not identify individual speakers or participants.
A number of jurisdictions now have law that requires or encourages a review of data flows by the local supervisory authority before a transfer takes place. Unlike many of these other jurisdictions, however, section 33 of the PDPO does not have extra-territorial application in Hong Kong. This is the result of a 2020 decision of the AAB, which held that the scope/territorial jurisdiction of the PDPO is limited to “persons being data users who have operations controlled in, or from, Hong Kong”.
As such, it will be unusual for a data user in Hong Kong to be asked to prepare and contribute to a transfer impact assessment by virtue of its agreement to standard contractual clauses proposed by EEA data exporters, or its contribution to an adequacy determination process undertaken by the EU.