A digital economy cannot exist without data – it is a crucial factor in producing new products, empowering businesses to create innovative services and enabling smarter infrastructure such as autonomous cars. It has become more important than ever to have robust data management and protection processes and systems. This is especially so when organisations are relocating their data to new premises, or to partners who provide additional cloud storage capacity or processing capabilities. Whether the transfer involves personal data or not, it is necessary to understand and comply with relevant data privacy regulation on transfers to minimise business risk and promote efficient compliance across organisations.
When transferring personal data in or out of Hong Kong, it is critical to consider a number of key issues. The first is to understand how the PDPO defines the term “personal data” and how this differs from other jurisdictions.
Specifically, the PDPO states that “personal data means information about an identifiable individual”. This is distinct from the concept of data that is not directly linked to an identifiable individual (such as aggregated statistics) or that is not capable of being re-associated with an identifiable individual (such as CCTV recordings, logs of persons entering car parks and records of meetings).
The PDPO also requires data users to fulfil a range of statutory obligations relating to the collection and use of personal data. One of these obligations is to provide data subjects with a PICS before collecting their personal data. The PDPO states that the PICS must include the purpose for which the data is collected, and also the classes of persons to whom it may be transferred.
It is worth noting that the PDPO does not include express provisions conferring extra-territorial application. Accordingly, the jurisdictional scope of the PDPO is limited to where the data user controls the collection, holding, processing and use of personal data in or from Hong Kong.
A potential change to the PDPO that has been mooted is an expansion of the current definition of “personal data”. This could mean that more uses of personal data would be caught by the PDPO, and would require additional compliance measures.
Data is a core economic asset for many companies, and will continue to be so in the future. Equinix’s Hong Kong data centres are situated in one of Asia’s busiest hubs for international finance and trade, making it the ideal location to host your company’s data. To learn more about how our colocation facilities can support your business, contact us today. We look forward to hearing from you.