Data hk is an online news publication focused on data, technology and privacy. It provides updates, analysis and insight into the Hong Kong tech scene from the perspective of its contributors – all data engineers with real experience in the field. The news and views are based on unbiased reporting without any commercial or political biases. The website has been established to promote data journalism and the sharing of knowledge in this area.
The government’s close ties with the Mainland result in high demand for cross-boundary services and data flow between Hong Kong and the Greater Bay Area (GBA). The Innovation, Technology and Industry Bureau (“ITIB”) of the Hong Kong SAR government has recently signed a Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the GBA with the Cyberspace Administration of China (“CAC”). This is a policy breakthrough to leverage data flow to promote innovation and research development in the GBA, while ensuring personal data privacy protection.
The MoU will also strengthen bilateral cooperation in areas such as cybersecurity, data management, legal issues and information exchange. Moreover, it will encourage joint initiatives to promote innovative uses of Big Data in the Greater Bay Area. It will boost Hong Kong’s status as an international innovation hub, complement national development and enhance the city’s role in the global economy.
Despite the close links between Hong Kong and the Mainland, data flows remain limited because of varying privacy regulations in the two jurisdictions. Currently, the Hong Kong Personal Data Protection Ordinance (“PDPO”) only applies to personal data processed in Hong Kong. The PDPO defines “personal data” to mean any information that can identify a living individual, including but not limited to his name; his identification number or other record that identifies him; his location data or other recorded data that reveals the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
This definition of personal data has led to some confusion. For example, some businesses have incorrectly assumed that if their processing of personal data does not involve the collection of any PICS then it does not fall within the scope of the PDPO. In reality, it is important to consider whether the collected personal data concerns a living individual and what the intention of the person collecting that information was.
A further point to consider is that a data user must, on or before the collection of personal data, clearly inform the data subject of the purposes for which the personal data will be used. This is an important distinction because a data user cannot transfer the personal data of a data subject to a class of persons not notified to the data subject on or before the original collection of that personal data. This is because a data transfer is a form of data use.
Data users who wish to transfer their personal data overseas should consider contacting the PCPD for advice before doing so. The PCPD has published recommended model contractual clauses which set out the obligations of a data exporter with respect to data transfers outside Hong Kong. These include the requirement to take supplementary measures to bring the level of protection in the data importer’s jurisdiction up to that of Hong Kong, and to comply with all six DPPs.