Data hk is an open data portal from Hong Kong, offering access to international, European Union (EU), national and regional sources as charts or maps. Users can search for specific datasets and download them in Excel or CSV formats; once in Excel or CSV files this data can then be analysed using various visualization software tools in order to make informed decisions based on its trends, patterns, correlations or corroboration.
An earlier this year discussion paper from the government examined potential changes to the Personal Data Protection Ordinance, including broadening its definition to encompass “information relating to an identifiable person”. If implemented, this change would bring Hong Kong in line with other jurisdictions where broad definitions exist such as mainland China and European Union.
If the government decides to implement this change, it will have a serious ramification on businesses that use personal data in their operations. As a result, these firms must review their processes to ensure compliance with PDPO as well as take additional measures to protect customer personal information.
Under the PDPO, any data user must notify data subjects prior to collecting their personal data of its purpose and recipient categories for transfer (transfer constitutes use in terms of this Act). Failure to do so can incur monetary penalties as per PDPO regulations.
The PDPO does not contain explicit provisions conferring extra-territorial application; however, in practice it is common practice to treat data transfers outside Hong Kong as domestic transactions due to the vague definition of data user (anyone who controls collection, holding, processing or use of personal data). Furthermore, data users often outsource collection and processing activities via contractors or agents.
Therefore, data users must understand the extraterritorial ramifications of their PDPO obligations if they wish to abide by them; otherwise they risk incurring fines and even imprisonment for failing to do so.
Another key consideration when transferring personal data is whether the transferred information constitutes “personal data.” For instance, photos taken of crowds at musical concerts do not qualify as personal data under the PDPO; however records of individuals entering and exiting car parks, or logs with identifiable meeting participants could constitute personal data under its regulations. It is therefore essential for data users to take into account extraterritorial ramifications when conducting data transfers.