Hong Kong is one of Asia’s densest network hubs, boasting an ecosystem of companies and data center service providers as well as serving as an international gateway to mainland China and beyond.

As is often the case in this field, details matter greatly and when dealing with cross-border transfers of personal data there are several key points that must be kept in mind when dealing with personal data transfer issues. Padraig Walsh from Tanner De Witt’s Data Privacy team details these considerations.

As part of any data transfer agreement, it is crucial to first determine whether or not the PDPO applies. The PDPO only covers data that relates to identifiable people – meaning its obligations apply if such information exists. Consequently, its provisions only apply if:

Second, it is crucial that the collection, storage, processing or use of personal data be lawful. There are various means by which this can be evaluated, including:

Thirdly, it is imperative to ensure that the personal data being transferred does not violate any of Hong Kong’s six Data Protection Principles (DPPs), known as Core Data Protection Principles. If this occurs, a PICS should be issued and compliance must be achieved before any transfer can take place.

Finaly, it should be mentioned that the PDPO includes an obligation for data controllers to consult with PCPD if they believe a particular transfer of personal data might conflict with its objectives or requirements. This provision facilitates discussions between both parties that may help reconcile any potential discrepancies as to what requirements or permissions exist under PDPO in relation to proposed transfers.

Hong Kong may eventually move towards adopting an expansive definition of personal data and stricter compliance measures for those using it, in line with international norms and approaches taken by other legislative regimes like GDPR in Europe.

Businesses must remain mindful of the complexities surrounding data transfer and seek professional advice when necessary. A complete understanding of PDPO provisions and processes is integral for effective data management in Hong Kong.