Data hk is an open government platform which provides easy, secure and convenient access to Hong Kong public data. In addition to a comprehensive database of more than one million government datasets, the site also includes various search functions and other useful features. In order to enhance the user experience, the website has been redesigned with new functionality and a fresh look.
In Hong Kong, the Personal Data (Privacy) Ordinance (“PDPO”) sets high standards for data privacy and regulates collection, processing, handling, holding and use through six data protection principles. While the law may appear complex, it can be easily understood and applied if business practices are based on its principles.
For example, PDPO section 33 requires that a data user expressly inform a data subject on or before the original collection of his personal data of the purposes for which the data will be used and the classes of persons to whom the personal data may be transferred. This includes any intended transfers to countries where the PDPO does not have an “adequacy” status.
Moreover, the PCPD has clarified that a transfer to such a country would only be permitted where there was an existing law or practice in place reflecting each of the essential guarantees of the PDPO. This requirement is an important safeguard to protect the interests of data subjects.
It is worth noting that despite the fact that the PDPO does not include an adequacy regime, it is increasingly common for businesses to conduct a transfer impact assessment as part of their compliance processes when exporting personal data out of Hong Kong. This is generally due to the application of laws of other jurisdictions that require a transfer impact assessment before the transfer is permitted.
A transfer impact assessment is an evaluation of the level of protection offered in another jurisdiction as against the requirements under a particular law (such as GDPR). A transfer impact assessment may result in a data exporter having to carry out supplementary measures before transferring the personal data or having to terminate the proposed transfer. This may, in turn, affect the ability of businesses to carry out international business transactions.