Data hk is an online portal providing access to open data sets from Hong Kong government, offering over one million data sets on various subjects. Furthermore, this resource also offers advice and tips for visualizing data sets; making it a useful resource both for researchers and citizens.
Cross-border data flows are increasingly vital to global economies. Data Hong Kong plays an integral role in these flows and must abide by principles of data transparency to facilitate them. Companies must fully comprehend how data transfers affect them – in this article by Tanner De Witt’s Padraig Walsh explores key points regarding Hong Kong law that apply when transferring data across borders.
As part of its scope analysis, it is critical to assess the Personal Data (Privacy) Ordinance. As opposed to other data privacy regimes which cover extraterritorial application, the PDPO applies only to persons controlling all or any part of operations controlling collection, holding, processing and use of personal data in or from Hong Kong – this definition may appear restrictive yet is nonetheless clear and in line with international trends.
The PDPO requires data users to inform data subjects explicitly on or prior to collecting their personal data of its intended use and classes of people it will be disclosed or transferred to. These requirements essentially serve as consent, although the PDPO distinguishes between “use” and “disclosure or transfer”. Nevertheless, data users should ensure they fulfill these obligations prior to sending personal information abroad.
Data exporters must also demonstrate that their proposed transfer of personal data has legal grounds that are sufficiently compelling. To this end, it is crucial that they carefully consider their Personal Information Collection Statements to ascertain if this transfer constitutes a change of purpose that requires consent from data subjects before proceeding with their plan.
If a data exporter cannot establish that their proposed personal data transfer meets legal or compelling grounds, or both, then either suspending the transfer or taking appropriate supplementary steps are required to comply with PDPO transfer requirements. Although this can be an extensive undertaking for many businesses, compliance is key if businesses wish to continue doing business successfully.
If a data transfer is suspended or subject to additional measures, data exporters should keep records detailing what steps were taken in this regard in order to comply with PDPO and facilitate examination by Hong Kong Data Protection Authority. Depending on circumstances, in some instances DPA will request written reports detailing efforts being made towards fulfilling data transfer requirements from data exporter; these must be maintained for five years.