Data HK – How Personal Data is Transferred Across Borders

Data hk is a website that provides a single source for Hong Kong open data. It provides access to over one million datasets from a variety of sources, including international, EU, national, regional, and local data portals. This includes statistics, forecasts, maps and graphs which can be used for research, education or policy analysis.

There is a growing view that the way in which personal data is transferred across borders needs to be addressed. The Privacy Commissioner for Personal Data (PCPD) has called for change, and there is a sense that businesses should be prepared to fulfil their obligations in this respect.

The PCPD has issued guidance on the subject, and recommended model clauses that data users can include in contractual arrangements with data importers. These may be in separate agreements or as part of the main commercial contract. The purpose of these is to ensure that a data exporter satisfies its obligations under the PDPO in relation to any transfer of personal data abroad.

A key aspect of these provisions is that a data exporter must have the voluntary and express consent of the data subject to be able to transfer his or her personal data overseas. This must be given on or before the date of collection of the data. It is also important that the data user has made the data subject aware of the purposes for which the data will be transferred and the classes of persons to whom the data may be transferred.

In addition, there is a requirement that the data exporter must have in place arrangements to prevent the data from being kept longer than necessary and that it is protected against unauthorised access or processing, erasure or loss (DPP 2(3)). This can be achieved by placing data protection obligations on data processors.

This is a significant obligation for businesses. It could impact the way in which a business operates, and it can be difficult to manage. Nonetheless, the obligation must be met.

There is some debate about what constitutes “personal data”. It has to concern an identifiable individual, but the concept does not seem to be as broad as in other jurisdictions. For example, a company’s staff cards typically display a person’s name and HKID number together and this would clearly be personal data. Nevertheless, there is little doubt that the PCPD intends to expand the definition of personal data, and this may impact upon some of the obligations set out in the PDPO.