Data hk is Hong Kong government’s new portal designed to make public data easier to find and comprehend. It features a searchable catalogue of datasets with information available via metadata (data about data). Furthermore, there are links to open data sites and other sources.
Padraig Walsh, Partner in Tanner De Witt’s Data Privacy practice, presents an overview of data hk and its importance in business.
One of Hong Kong’s key distinguishing factors from many other jurisdictions is that it does not contain a statutory restriction on the transfer of personal data outside its territory. While this may seem odd, this reflects its approach to data protection laws and specifically its view that adequacy/equivalency regimes aren’t the right way forward in its region – an opinion shared by some other data privacy regulators as well and unlikely to change quickly.
At any rate, there is recognition of the various statutory obligations owed by persons that control data in Hong Kong and of their responsibility to comply with such obligations when moving their data overseas. This requirement can be found within the recommendations from Hong Kong Privacy Commissioner for Personal Data (PCPD) regarding cross-border data transfers – this includes meeting six core data protection principles (“DPPs”) when dealing with transfers as well as making sure any contracts entered into take into account these DPPs.
The PCPD’s recommendations also recognize that any data transfer must only occur where lawful and appropriate. This generally means where DPPs permit such transfers with prior consent from data subjects; or where an entity has disclosed its intention to transfer personal data in their PICS and such transfer is essential to fulfilling its intended purpose.
Final recommendations of the PCPD mandate that a data exporter identify and take any supplementary measures necessary to bring the level of protection in its destination country to meet those imposed under DPPs or PDPO. This could involve technical solutions like encryption or anonymisation or contractual arrangements with local entities.
These recommendations represent an exciting advancement and are likely to become part of future legislation in mainland China, as well as other parts of the world. They serve as a useful reference point for businesses that must manage transfer risks, while providing guidance on how to comply with DPPs when transferring personal data across borders. As personal data flows between Hong Kong and mainland China increase under “one country, two systems”, compliance needs for data transfers will only become increasingly urgent – thus driving further changes to this area.