Data hk is a free resource that allows people to access and download open data from various sources, such as government websites and departments, businesses, research organisations, etc. The website also allows users to search and filter by category, location or date, making it easier for them to find the right data they need.
The term ‘personal data’ has been defined by the Hong Kong Personal Data Protection Ordinance (“PDPO”) since 1996, and has remained in line with international norms on this concept of data. The term has been used consistently in other legislation, such as the Personal Information Protection Law that applies to mainland China and the General Data Protection Regulation that applies to the European Economic Area, as a means of identifying information which relates to an identified or identifiable person.
When considering whether information is personal data, it is important to consider the intention of the person acquiring it. The collection of personal data should be limited to that which is necessary for the purpose for which it is collected, and not broader than that. This will help to avoid situations where a PICS is required, and issues in respect of data transfer may not arise.
A data user is a person who, alone or jointly and in common with other persons, controls the collection, holding, processing or use of personal data. If a person does not control the collection, holding or processing of personal data, then it is not likely that obligations under the PDPO will apply to him, and it is unlikely that the PDPO’s six core privacy protection principles (“DPPs”) will be applicable.
If a data user decides to transfer personal data abroad, then it is important that he fulfils a range of statutory obligations in relation to the information being transferred, including complying with the DPPs. As a matter of good practice, it is also helpful for the data user to consider undertaking a “transfer impact assessment” before transferring any personal data overseas.
Transfer impact assessments are not a requirement under the PDPO, but there is a growing number of circumstances in which it will be necessary for a Hong Kong data user to undertake one in order to export personal data to a jurisdiction outside of the EEA and the EU (as a matter of law, such an assessment can only be undertaken where there is a legal obligation).
Despite the lack of a statutory restriction on the transfer of personal data from Hong Kong, it is important that companies who collect, hold or process personal data in Hong Kong understand the requirements of the PDPO and its DPPs, particularly when considering moving information to a destination outside of the territory. There are a growing number of instances in which a transfer impact assessment will be needed, and this is likely to increase with the continuing integration of business and social life between Hong Kong and mainland China under the “one country, two systems” principle.