Data Protection Law – Implications For Businesses Transferring Data Between Jurisdictions
Hong Kong’s data protection law is often viewed as one of the most modern in the world. It has a high standard of transparency and accountability, and many of its principles are similar to those found in other legal regimes such as mainland China’s Personal Information Protection Law or the European Union’s General Data Protection Regulation. However, in some cases, the interpretation of key concepts can differ slightly. In this article, Padraig Walsh from the data privacy practice at Tanner De Witt looks at the implications of these differences for businesses that transfer personal data between jurisdictions.
In the context of data transfers, ‘personal data’ refers to any information that identifies or could identify an individual. This includes an individual’s name, identifiers (e.g. a date of birth or passport number), contact details and other information that can be used to locate an individual. This definition is broad and is broadly consistent with international norms. However, the term does not include sensitive data such as health or ethnic origin.
Whether or not data is considered “personal” is determined on the basis of the purpose for which it is collected. As a result, it is important that a business understands how its purposes are defined to determine whether or not it must prepare a PICS and comply with other data protection laws in Hong Kong.
As a leading regional internet exchange point and one of Asia’s most carrier-dense network hubs, Equinix’s Hong Kong colocation facilities offer direct connectivity to a diverse ecosystem of enterprises, networks, IT services providers and other digital supply chain partners. This helps them accelerate their business transformation and scale globally. With a wide range of connectivity options available, our customers can also benefit from a global reach across 57+ locations.
If an organisation decides to transfer personal data overseas, it must inform the individual that their personal information will be transferred abroad. It must also verify the lawful basis for the transfer (although this is less onerous than under GDPR). For example, a combination of data on a staff card, which usually exhibits a person’s full name, job title, photograph and employee number, might be classified as personal data, which would require a PICS to be prepared.
For those travelling to mainland China, SmarTone offers several packages that allow data use in both HK and China (with a 365-day Mainland China SIM at HK$ 338 for 8 GB). Its regular 4G SIM costs HK$ 80 with credit of HK$ 78 valid for 180 days. This has a FUP of 15 GB per day and is throttled to 128 kbps beyond. It can be activated by dialing *101*420#. It is not suitable for tethering or Facetime calls, but can be used for WhatsApp and VoIP. SmarTone also offers a cheaper 3G add-on for domestic helpers for HK$ 28 with a daily cap at midnight and capped at 3.8 Mbps. This SIM is only sold at 3Shops and selected Indonesian grocery stores.