Data hk refers to an umbrella term covering various legal instruments and rules that regulate how personal information may be collected, stored, processed and used. Hong Kong’s data protection ordinance (PDPO) sets out rights of data subjects while imposing obligations upon users who must abide by six core data protection principles.
Contrary to many other legislative regimes, such as China’s Personal Information Protection Law and Europe’s GDPR, which govern data processing in Europe, the PDPO defines personal data more narrowly. It refers only to information pertaining to identifiable natural persons – reflecting how identity can be determined through multiple factors like name, identification number, online identifiers or location data as well as characteristics associated with their physical, physiological, genetic, mental, economic cultural or social identities.
A key distinction of the PDPO from other legislative regimes is its extraterritorial jurisdiction. Its scope depends on whether an entity controls collection, holding, processing and use of personal data within or from Hong Kong – thus data users with operations outside Hong Kong must ensure their six core obligations are fulfilled in full.
This includes notifying data subjects of any transfers of their personal information and authorising its collection for specific purposes, and using recommended model clauses to ensure onward transfers abide with PDPO requirements.
Within one week of the law’s implementation, Google had temporarily suspended requests from Hong Kong users seeking data and information, along with Twitter and Facebook. Google later explained that emergency disclosure requests concerning threats to life would still be processed according to its global policy but suggested authorities reduce such requests as much as possible.
If passed, the new law would give Hong Kong’s privacy watchdog extensive powers to investigate and take action against individuals accused of disclosing personal data without consent – commonly known as ‘doxxing’ – which could incur fines of up to HK$5 million per incident. A proposal has been placed on the government agenda for debate at a Legislative Council meeting scheduled for 27 September.