Hong Kong is an attractive market for global businesses, due to its strategic location, well-established legal and regulatory framework, free market system, free flow of capital and simplified tax regime. Due to these characteristics, many international firms with substantial regional operations and global reach call Hong Kong home. Yet with this comes unique challenges associated with operating within this region – one being complying with local data protection regulations.
Although the local Personal Data Protection Officer does not impose legal restrictions on cross-border transfers of personal data, its extensive and robust guidance offers multiple safeguards to secure such transfers. Padraig Walsh from Tanner De Witt’s Data Privacy practice group highlights some key considerations for organizations looking to make international transfers of their personal data.
An important consideration in the implementation of the PDPO is the definition of “data user.” Under its provisions, this term refers to individuals or joint controllers who manage the collection, holding, processing or use of personal information – whether alone or jointly with others – in Hong Kong or otherwise. This doesn’t have to mean physically collecting it here: photos taken of crowds attending concerts do not count as personal data as these cannot be used to identify individuals in them – similarly with CCTV recordings, logs of persons entering car parks and meeting records which do.
The PDPO contains numerous obligations on data users regarding the collection, storage and use of personal information. One such obligation is providing certain information prior to or upon collection (DPP1 and DPP3) from data subjects (DPP1 and DPP3); typically this is accomplished by providing them with a PICS when collecting their personal data – according to this obligation, PICSs must include information such as its purpose for being collected as well as what type of parties this data may be shared with.
As part of its obligations under DPP7, data exporters must determine if foreign jurisdiction’s laws and practices meet Hong Kong standards (DPP7). If not, data exporter must implement additional safeguards – whether technical, contractual or other means – in order to meet Hong Kong standards of protection for its data exported abroad.
Though understanding local data privacy laws is essential, seeking expert advice when considering any cross-border transfer is crucial to ensure compliance and avoid penalties imposed for noncompliance. An experienced data privacy lawyer can guide your company through this process to ensure full compliance.