Data hk is a hub for technology and innovation. It offers high-speed connectivity and world-class facilities to global businesses, hosting data centres, colocation and cloud services. The region also offers the most competitive data centre costs in Asia. The region is home to a wide range of data centres, from large enterprise-grade deployments to smaller point of presence solutions, all offering best in class technical design and high levels of resiliency.
The Hong Kong Government is currently exploring changes to the Personal Data (Privacy) Ordinance (“PDPO”). This could include a change to the definition of “personal data”. The current definition of personal data was introduced in 1996 and is consistent with the interpretations adopted by other legislative regimes, including the PIPL that applies in mainland China and the GDPR which applies in the European Union. The change that is being considered would expand the scope of personal data to cover information that can be used to identify an individual or that can be linked to an identifiable individual.
What is the impact of this change?
The impact is significant for data users, as the PDPO requires them to fulfil certain obligations in respect of personal data before it can be collected. These include: (i) the purpose for which the personal data will be collected; and (ii) the classes of persons to whom the data may be disclosed.
As a result, the PDPO does not permit the disclosure of personal data to third parties for the purposes of direct marketing without the consent of the data subject. This is a breach of the PDPO and, where it is committed by a data user, is a criminal offence punishable with fines up to HK$500,000 and imprisonment up to three years.
Fortunately, data users are often able to fulfil their statutory obligations by providing the relevant details in writing to the data subjects concerned. This is usually achieved by providing the data subjects with a Personal Information Collection Statement (“PICS”) in advance of collecting the personal data.
It is therefore important for companies to ensure that they understand the impact of this possible change to the definition of personal data. It will mean that a greater number of data transfers will be caught by the PDPO, and this in turn could lead to increased compliance measures for businesses which process personal data. This is particularly the case for those companies that use data-related technologies that learn about an individual’s behaviour and that are likely to have a direct impact on the individuals in their respective groups. This could include data-driven advertising, predictive analytics and the utilisation of artificial intelligence. For more information on how to mitigate against this potential risk, please contact our team.
Comments are closed, but trackbacks and pingbacks are open.