Hong Kong may seem like it stands apart from global trends when it comes to data transfers, but there are good reasons for its position. The government commissioned a consultant to draft an action plan making it easier and safer for companies in Hong Kong to transfer personal information securely across borders to mainland China. All stakeholders should welcome this initiative which reduces compliance costs while strengthening Hong Kong’s position internationally.
The PCPD has published two sets of recommended model clauses to be included in contracts involving data transfers. One applies to transfers between entities controlled by Hong Kong data users, and another between Hong Kong data users and their data processors; these model clauses aim to ensure that personal data that leaves Hong Kong is not used or held anywhere without express agreement from both data users involved, or subprocessors;
Concerns have also been expressed over the recent legal recognition that data users who control operations in Hong Kong are legally accountable and liable for the acts of agents such as data processors based overseas (section 65 of PDPO). This provides additional motivation to businesses when outsourcing operations overseas that they comply with their obligations under PDPO.
As part of their practices, data exporters should also conduct a transfer impact assessment prior to sending personal data abroad in order to ascertain whether local laws and practices offer adequate protection of this personal data, and identify any additional steps needed in order to meet Hong Kong standards of protection for it. Such steps might include technical measures like encryption, anonymisation or pseudonymisation as well as contractual provisions mandating audit, inspection reporting obligations as well as beach notification obligations with compliance support support co-operation agreements in place.
Data exporters typically take steps to notify and give individuals an opportunity to object before sending any personal data overseas, creating more transparency and giving individuals control over their data. This gives individuals more power in terms of shaping it themselves.
Access My Info: Hong Kong (‘AMI:HK’), an easy-to-use website developed by a consortium comprising Chinese University School of Journalism and Communication, InMediaHK, Keyboard Frontline, Open Effect and Citizen Lab to increase transparency around data handling practices is one example of such public service that seeks to increase transparency around personal data use. Since launching in August 2013, 1603 requests have already been generated using AMI:HK!