Data hk is an internet portal that provides information about Hong Kong’s personal data protection regime. Its aim is to promote efficient compliance with personal data transfer regulation, by providing an overview of the rules and practices. Its authors are Padraig Walsh and Jonathan Mok from Tanner De Witt.
The Personal Data (Privacy) Ordinance (“PDPO”), which applies to all personal data collected in Hong Kong, has six data protection principles and establishes rights for data subjects as well as specific obligations to data controllers. It is a modern and comprehensive law that has been significantly amended in 2012 and 2021.
One of the key elements in PDPO is that personal data may not be transferred outside Hong Kong without the prescribed consent of the data subject. However, the DPPO also permits the transfer of personal data for new purposes, provided that the new purpose is lawful and not contrary to the original purpose for which the data was collected.
This is a flexible and balanced provision, which strikes an important balance between the freedom of businesses to conduct business operations and the protection of individuals’ personal data. Its interpretation has evolved over time to reflect the evolving business landscape and technological changes. The emergence of the cloud has also raised the importance of this provision, as more organisations choose to store and process data in jurisdictions other than their own.
A key part of the interpretation of this provision is the definition of “data user”. A data user is defined as a person who, alone or jointly or in common with other persons, controls the collection, holding, processing or use of personal data. This is similar to the definition used in other legislation, including the Data Protection Law that applies in mainland China and the General Data Protection Regulation that applies in the European Economic Area.
It is also worth noting that the word “control” is very broadly interpreted. This means that even if an individual cannot be identified by the data in question, he or she might still be a data user. For example, a photograph of a crowd at a concert might be considered to be the collection of personal data, although it does not identify any particular people in it.
SmarTone, which operates the largest mobile network in Hong Kong, offers roaming packages that include both data and voice, with the latter limited to a fixed number of minutes. The cheapest package costs HK$ 98 for a day, which is automatically debited until midnight local time. After that, the data allowance continues but is throttled to 384kbps. Tethering is allowed, but Facetime, VoIP and WhatsApp calls are not permitted. SmarTone also has a cheaper prepaid SIM for Hong Kong and Macau, which is available at its shops and 7-Eleven, csl, 1O1O, Van Go and Circle K kiosks. This SIM is also aimed at Indonesian domestic helpers and costs HK$ 38 with a credit of HK$ 80 valid for 180 days.