A data hk is an important part of a business when it comes to protecting the privacy of personal data. This is especially true if a business is transferring personal data outside of Hong Kong, to another jurisdiction, or even within the same country. While the law doesn’t explicitly state that data transfers aren’t permitted, it does require businesses to follow certain requirements in order to protect the privacy of personal information and avoid potential penalties. In this article, Padraig Walsh from Tanner De Witt discusses the legal issues that come up when transferring data between locations, as well as some of the key factors to keep in mind for compliance with the law.
One of the key factors to keep in mind for any data transfer is the consent of the data subject. While the PDPO does not directly address this issue, it does lay out clear guidelines regarding how data users must inform a data subject of any intended use of their personal information and of the classes of persons to whom it may be transferred. This information must be provided on or before the original collection of personal information, and the transferring data user must also obtain consent from the data subject for any future change of purpose.
If a data user wants to transfer personal information from Hong Kong to another location, it is required to perform a transfer impact assessment. This is an assessment of the level of protection in the destination location compared to the Hong Kong law. The transfer impact assessment must be performed by a qualified independent person, and it must be conducted by the data importer or exporter before the actual transfer takes place. The assessment must cover the following areas:
Although a transfer impact assessment is not currently mandatory under Hong Kong law, there are a growing number of circumstances in which a Hong Kong data user will need to carry out a transfer impact assessment by virtue of the laws of other jurisdictions. For example, a European data exporter will typically be required to conduct a transfer impact assessment when sending personal data to Hong Kong.
The free flow of data across borders is a vital aspect of the global economy, and it is essential for business growth and competitiveness. While there are a few gaps in the law, it is important for businesses to be mindful of these issues in order to ensure they comply with the law and protect their employees’ personal information. With that in mind, the law provides a good framework for companies to operate with confidence and to maintain high standards of data security and governance. The law has been updated several times, including in 2018, to make it more consistent with international standards. These updates have been aimed at strengthening the data protection framework for all Hongkongers. However, more work is still needed to fully align the law with international data protection standards.