Whether you are in a business that does or does not collect personal data, or you work with a client that does, chances are you will need to transfer some of that information across borders. The question is how to do this in compliance with privacy laws. Padraig Walsh of Tanner De Witt’s Hong Kong office, an international law firm, gives some insights.
A key factor is the definition of “data user” under HK’s PDPO. It includes a person who alone or jointly or in common with others controls the collection, holding, processing or use of personal data. This is a wider definition than in many other jurisdictions. In addition, a data user must fulfil certain obligations when collecting and using personal data. This includes a requirement to tell data subjects the purpose and collection of the data (DPP 1), and to explicitly inform data subjects of the classes of persons to whom the personal data may be transferred (DPP 3).
In addition, if a data user agrees to standard contractual clauses proposed by an EEA data exporter, or participates in any procedures aimed at ensuring compliance with those clauses, he must submit himself to the jurisdiction of, and co-operate with, that data exporter’s supervisory authority in respect of the enforcement of the contractual terms. This is a significant restriction on extra-territorial application that has not been included in the other jurisdictions where extra-territorial provisions exist.
It is also important to consider the intention of the person acquiring the data. This will be relevant for determining whether a PICS is required and for assessing the impact of transferring that data. For example, if personal data is collected with the sole intention of sending it to a particular country or region, then that purpose is likely to be captured by the PICS and any issues around transferring that data should be addressed.
If you would like more information about this topic, please contact us. Our data protection specialists are ready to help you navigate your compliance requirements. They can be reached via our website or by calling us on +852 2828 8688. We look forward to hearing from you! Tanner De Witt is a leading global law firm with offices in Asia, Europe and the United States. Its Hong Kong team consists of more than 80 lawyers and professionals, with expertise in a wide range of cross-border and domestic matters including corporate transactions, antitrust, intellectual property, insurance and private equity. Its global presence enables the firm to provide clients with the best possible legal advice and service in any location where they do business. Its clients include multinational corporations, major financial institutions, energy and utility companies and technology leaders. The firm’s global reputation is based on its commitment to excellence and its focus on the highest quality work. Its lawyers are recognised by their peers and clients for their technical and commercial skills, their depth of knowledge and the practical advice they give.