Data Hk – What Does Section 33 of the PDPO Mean for Hong Kong?
Data hk is an information resource for people working with and on personal data in Hong Kong. It covers data protection issues and offers practical guidance. It is not a substitute for legal advice.
Despite its reputation for high levels of privacy, Hong Kong isn’t as “data friendly” as other jurisdictions. Its data protection regime is relatively light, and it has no statutory restriction on the transfer of personal data overseas.
This is a curious position, especially in the light of international trends. For example, several other jurisdictions now include an extra-territorial element in their data protection laws. This makes their laws more enforceable in some situations, such as where an organization has operations in their territory. However, the PDPO does not have this feature. Its territorial scope is limited to a person who controls all or any part of the collection, holding, processing and use of personal data in, or from, Hong Kong. This is a different test to the extra-territorial element of other data protection laws, which can be more broadly applied (for example, to records of a crowd at a concert or logs of cars entering car parks).
The PDPO does, however, contain some provisions that affect cross-border data transfers. These are primarily in relation to the obligation on data users to obtain the voluntary express consent of data subjects for transferring their personal data outside Hong Kong, and to inform them about the purposes for which it will be used, and the class of persons to whom the personal data will be transferred. In addition, the PDPO requires that data users obtain a contractual clause (recommended by the PCPD) which prohibits a transfer to a country without an adequacy agreement with Hong Kong.
Moreover, a data user must make a PICS available to the data subject on request (DPP 7) and provide it free of charge (DPP 8). This is also a key component of a data transfer policy, which the PDPO describes as a core element of a data protection strategy.
It is possible that increased cross-border data flows with mainland China, as well as internationally, will eventually lead to changes in Hong Kong’s position on section 33. This could be driven by business, or it may come as a result of the rapid transformation in data protection laws taking place in mainland China.
Tech Data Distribution (Hong Kong) Limited (“Tech Data HK”), a TD SYNNEX company, is a leading global distributor and solutions aggregator for IT ecosystems. Its 23,500+ dedicated team members are focused on uniting compelling IT products, services and solutions from 1,500+ best-in-class technology vendors. It helps customers maximize the value of their IT investments, demonstrate business outcomes and unlock growth opportunities.