The Personal Data Protection Ordinance (PDPO) in Hong Kong protects the privacy of individuals and imposes certain obligations on businesses that handle data. These include the obligation to notify data subjects of any transfer of their information. The PDPO also requires that any data users who have collected personal information disclose to the data subjects the purposes for which the personal data is collected and, where applicable, the categories of persons to whom it may be transferred. This article by Tanner De Witt’s Data Privacy practice group takes a look at the PDPO’s approach to data transfers and what that means for companies that move data between locations, either within or outside of Hong Kong.
First, it’s important to understand how PDPO defines “personal data.” The PDPO defines personal data as any information that can be used to identify an individual, such as their name, email address or phone number. However, it also includes other identifiers that can be linked to an individual, such as location data or online identifiers. In this regard, the PDPO’s definition of personal data is much broader than that of the GDPR.
Despite this broader definition, the PDPO requires that any collection of personal data must be for a lawful purpose. Further, any use of the data must be directly related to that collection, and it should not exceed what is necessary for the purpose in question. As a result, it is possible for a company to collect personal data without violating the PDPO, so long as that data is used solely for its original purpose.
In addition to requiring that the PDPO’s six Data Protection Principles be followed, the PDPO makes it a requirement for data users to obtain the consent of data subjects before transferring their personal information for any purpose other than the one specified in the PICS. This is a far more stringent requirement than that of the GDPR, which only requires that the data user inform the data subject of the new purpose before seeking their consent.
The PCPD has issued two sets of model contractual clauses designed to aid the transfer of personal data between data users who are located in different jurisdictions, and these model clauses should be considered before a company exports any data from Hong Kong to a destination elsewhere. Generally, these clauses should be reviewed by the firm’s lawyers before a contract is signed.
The MVNO Multibyte Info Group offers several SIM cards with a roaming data allowance for both HK and China on their UMTS/LTE networks. Their cheapest option is their HK$ 80 card with 4 GB for 180 days, activated by dialing *101*420#. The card supports roaming data only and tethering is not allowed. Their other options include a HK$ 88 card for 6 GB for 30 days and a 365-day Mainland China SIM for HK$ 338 with 8 GB. All of their plans are available for both iOS and Android phones.