Data Hong Kong
Data hk is a practice that collects and analyses information, often from primary observations (like crowd data) and secondary sources (like published reports). Data hk can help businesses to improve products or services; measure customer satisfaction; identify potential market trends; and inform policy formation by government agencies. Data hk can be collected through surveys, focus groups and other research methodologies. The results of these activities are then collated into reports and statistics for use by businesses, government agencies or the media.
When a person or business collects personal data, it must comply with the PDPO’s six DPPs that form core privacy obligations. This includes the obligation to notify data subjects of any changes to the purpose for which they are collecting and processing their personal data; the right to erasure and restriction on further processing; and the requirement to only process data in accordance with a legal basis. These obligations also extend to any cross-border transfer of personal data.
Section 33 of the PDPO prohibits the transfer of personal data outside Hong Kong unless certain conditions are met. These are designed to ensure that the level of protection given to personal data in the destination jurisdiction is comparable to the standard set out in the PDPO. This is done by requiring the data exporter to undertake a thorough impact assessment, which takes into account the laws and practices of the destination jurisdiction and the responsibilities of the data importer. The data exporter must also take supplementary measures to bring the level of protection in the foreign jurisdiction up to that required by Hong Kong, which might include technical measures such as encryption and pseudonymisation; or contractual provisions such as audit, inspection, reporting, beach notification and compliance support and co-operation.
Despite these safeguards, section 33 has not been widely implemented in the wake of the PDPO’s introduction. This may be due to the increasing volume of cross-border data flow between Hong Kong and mainland China, which is facilitated by the “one country, two systems” principle. This trend is likely to continue as the emergence of an integrated economy in the future will create greater demand for data sharing and the rapid transformation of data privacy laws in mainland China will make it more compatible with the PDPO.
A recent initiative by the PCPD, the Access My Info: Hong Kong (“AMI:HK”) project, aims to raise awareness of the requirements of section 33. It is an easy to use website that allows users to generate and submit their data access requests to telecommunications service providers in Hong Kong. AMI:HK is currently available to generate requests for eight different telecommunications service providers and is free of charge.
The website uses a simplified language and simple interface to allow people to input their request, and then automatically generates a draft access request that can be submitted via email or by post. While the PDPO requires that a standard form be used to submit requests, AMI:HK provides an alternative to this.