Data hk is a platform providing reports, statistics and forecasts on industries, economies and consumers. It aggregates data from market research organizations, businesses and governments. Users can browse by industry or country or search the site for specific data. Free publications are available, with paid subscriptions for more detailed data.
Hong Kong’s privacy regulation imposes onerous obligations upon data users, and those obligations extend to cross-border transfers of personal data. In this article, Padraig Walsh from Tanner De Witt explains the issues around these transfers.
The PDPO defines ‘personal data’ as information that relates to an identifiable natural person, such as name, identification number, location data or factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual. This is a relatively broad definition, and one that could cause substantial additional compliance obligations for companies using data.
In contrast, most European laws define “personal data” much more narrowly, and exclude information such as business contact details and credit card details. It is not clear whether the Hong Kong PDPO would move towards such a more restrictive definition, but it is worth bearing in mind that changes to the definition of “personal data” could mean substantial new compliance obligations for companies that use data.
If a person controls the collection, holding, processing or use of personal data in, from or within Hong Kong, then he is a “data user”. The PDPO then imposes on the data user a wide range of obligations. These include the obligation to notify a data subject on or before collecting their personal data of the purposes for which it will be used and the classes of persons to whom the data may be transferred. Transfer is a form of use, and transferring data is a requirement for complying with six core data protection principles.
The PDPO has extensive guidance on the requirements that data users must meet in respect of cross-border transfers, and it includes recommended model clauses for inclusion in contracts involving such transfers. These models can be incorporated into contracts either as separate agreements or as schedules to the main commercial agreement. The form ultimately does not matter; what matters is the substance and content of those clauses. This provides further scope for efficient compliance with the PDPO in respect of such transfers.