Data in Hong Kong refers to any collection of facts or statistics collected for analysis or decision-making purposes. Data may consist of numbers, text or both and is usually compiled to support a business process such as sales reporting, electricity meter readings or customer contact records. Data can also be enhanced through adding additional sources (for instance government demographic or economic data) as well as weather or information from other organisations that enrich it further.
Data sharing among businesses is often necessary in order to increase efficiency and gain a competitive edge. This may involve anything from opening databases online, to sharing spreadsheets containing customer or employee details. A key aspect of efficiently and effectively sharing data involves understanding its impact upon PDPO requirements – particularly any individual data being transferred – this article by Padraig Walsh of Tanner De Witt’s privacy practice can provide answers to frequently asked questions on data transfers.
First and foremost, one should assess if the Personal Data Protection Ordinance (“PDPO”) applies to any potential transfer. Under its provisions, any person responsible for collecting, holding, processing or using personal data in or from Hong Kong falls under its scope; other privacy regimes have included an extra-territorial application; but this is not so with Hong Kong’s.
Consider whether the transfer involves personal data. Under the Personal Data Protection and Electronic Documents Act (“PDPO”), “personal data” refers to any information which can identify an individual living individual – in particular:
Thirdly, another factor to keep in mind when transferring personal data is whether its transfer relates to its initial purpose of collection. Under PCPD guidelines, any user of personal data must inform its subjects on or prior to collection as to how and why their information will be used and whom it may be disclosed to; they also cannot use such personal information for purposes other than those specified in PICS without first receiving voluntary and express consent from data subjects.