Data hk refers to any collection of information regarding an identifiable natural person. This could include anything that enables one to recognize someone as being identified with them, including but not limited to their name, date of birth, gender, nationality, address, occupation, telephone number or electronic mail address – even information which reveals personal preferences or attitudes such as political affiliations, religious beliefs, sexual orientation ethnicity social class membership hobbies interests as well as information that reveals physical, physiological or genetic health or condition; financial status criminal record medical history other sensitive details or sensitive details.
The PDPO defines the term ‘data user’ as any individual or group responsible for collecting, holding, processing and using personal data. Use includes transferring personal data between data users – thus it is crucial that any potential data users explicitly inform potential data subjects prior to collecting their personal data of its purposes of use and potential recipients (or classes thereof) who may receive it.
As a result, data users must obtain express and voluntary consent from individuals before transmitting any personal data for purposes not explicitly listed in PICS. A violation can incur fines up to HK$500,000.
Cross-border data transfers have become an increasingly common business practice, making it important that businesses have a firm grasp on the rules governing this activity, whether from Hong Kong to other locations or vice versa. Padraig Walsh from Tanner De Witt’s data privacy team highlights key points for consideration here.
First and foremost, it is necessary to ascertain whether the Personal Data Protection Ordinance applies. The definition of personal data under this legislation mirrors other legislative regimes – including mainland China’s Personal Information Protection Act and Europe’s General Data Protection Regulation – meaning it applies to anyone controlling collection, holding, processing or use of personal data within Hong Kong; unlike many other data privacy regimes which allow extraterritorial scope.