Data hk is a portal aimed at fostering greater awareness of the issues and challenges surrounding cross-border data flows. It provides an overview of the laws, practices and policies that apply to data transfers between different jurisdictions. It also includes a directory of data protection authorities and other organisations that can help with compliance with applicable laws and regulations.
The website has recently been updated, and it is now more streamlined and user-friendly. Its goal is to be a one-stop-shop for information on the laws and processes that are applicable to data transfers between different jurisdictions, including those related to data protection and the rights of individuals, and the steps that businesses need to take in order to ensure that they comply with applicable law.
As part of its aim to provide comprehensive, user-friendly information on cross-border data flow issues, the site is constantly being updated. For instance, a recent blog post identifies the key points to consider when preparing and implementing a data transfer agreement with an overseas entity. It also suggests that a business should consider how a particular destination country’s laws and practices might impact the effectiveness of the agreed arrangements.
Another recent topic explored on the site is transfer impact assessments, which are becoming increasingly common in circumstances where a Hong Kong business imports personal data of EEA citizens from a data exporter located in the European Economic Area (EEA). It is important to note that a transfer impact assessment must be carried out in accordance with the requirements set out in Article 33 of the PDPO and not the GDPR.
Section 33 of the PDPO prohibits the transfer of personal data outside Hong Kong unless certain conditions are fulfilled. These include that the personal data is collected for specified purposes and that the data subject has been notified of its purpose, as well as the classes of persons to whom the data may be transferred, in writing, before collection (DPP1 and DPP3).
While this position seems to be out of step with international trends, it has its merits. For example, it allows for more flexibility when transferring personal data to mainland China under the “one country, two systems” principle, and it could be argued that the need for efficient and reliable means of transferring data with mainland China will drive change on its own in the future.
However, for the time being, there is no sign that there will be any significant movement in addressing the implementation of section 33 of the PDPO in the light of current business and societal needs. The PCPD has acknowledged this in its communications, and it will continue to review the latest global regulatory developments and communicate with the Government on the best way forward for Hong Kong’s local circumstances. The PCPD also continues to advocate for the implementation of an adequacy or equivalent regime in the long term. However, a decision to implement such a regime will have significant implications for the economy and it will need to be carefully considered.