While the future of the current Hong Kong data protection regime is being debated, it remains important for businesses to be aware of their obligations under the law as it stands. In particular, when considering the use of personal data that originates in Hong Kong and is then transferred to other countries, businesses should remember that they must comply with DPP1 (Purpose and collection of personal data) and DPP3 (Use of personal data).
DPP1 requires a person to fulfil a range of statutory obligations, including giving certain information to a data subject on or before the collection of his personal data. This includes a statement of the purpose for which the personal data will be collected and the classes of persons to whom it may be transferred. If the information is not transferred, it may not be used for a new purpose.
Similarly, DPP3 requires the person to notify a data subject of any intended transfer to another jurisdiction and to obtain his consent. In addition, the data user must ensure that the transfer will not take place unless the purpose is compatible with the original purposes for which the personal data was collected or a new lawful purpose has been identified.
The definition of ‘personal data’ under the PDPO is similar to that in other data privacy laws – it refers to any information that can be used to identify a person. As such, it can cover a broad range of information including CCTV recordings, records of persons entering car parks and minutes of meetings that contain the names of participants.
One area that is being mooted for possible change in Hong Kong is to move towards a stricter definition of personal data, which would include any information that can be used to create an artificial profile of an individual. This could potentially catch a far wider range of data uses and lead to greater compliance measures for many companies.
Increased cross-border data flow is a key pillar of the Hong Kong economy and it is important to balance this against the need for a robust legal framework that protects individuals’ privacy. To this end, it will be interesting to see whether the government adopts a more rigorous definition of personal data and whether that is accompanied by additional measures such as the use of standard contractual clauses and contributions to transfer impact assessments in circumstances where a business exports the personal data of EEA persons to Hong Kong.
For those interested in working with data, the best source of high-resolution Hong Kong topographical and elevation data is the publicly available 50cm GDI dataset from Geodata Store. It is easy to download and is tilable in 1980 grid system coordinates. Alternatively, the 30m Copernicus data is also freely available and is very high-quality with a wide variety of tiling options. Both datasets can be downloaded from the HKGIDS website. A more detailed article on tiling options can be found here.