In Hong Kong, personal data is regulated by the Personal Data Protection Ordinance (PDPO), which sets out data subject rights and specific obligations to data users through six core data protection principles. These principles cover the collection, processing, holding and use of personal data. PDPO also governs the transfer of personal data outside Hong Kong. This article considers the complexities of data transfers, and in particular whether or not the PDPO’s provisions on data user disclosure and consent for personal data transfer apply.
A key factor to consider in this respect is the intention of the person acquiring the personal data. For example, taking a photograph of a crowd at a concert does not constitute the collection of personal data as it is not intended to identify any individual person. However, taking a photograph of individuals for the purposes of marketing is not permitted and would require explicit consent. Similarly, a business’s use of CCTV footage to monitor its premises or car parks does not require explicit consent as it is not intending to identify any individuals.
However, where the purpose is to identify individuals or to use their personal data for direct marketing, then the PDPO’s requirements are much stricter. In such a case, it is important that the PICS reveals that the data will be used for direct marketing and the identity of those to whom the personal data will be transferred.
Finally, where a business wishes to transfer personal data overseas, it is important that the PICS explains what legal basis the business has for doing so, and in particular that the transfer is necessary for the performance of a contract or fulfilment of a legitimate public interest or social benefit. The PICS must clearly state these reasons and also make it clear that the transfer is in accordance with applicable laws, e.g. GDPR.
Equinix’s colocation facilities in Hong Kong provide a carrier-dense network ecosystem and offer access to a number of the world’s leading enterprises, networks, cloud service providers and other businesses. Our customers are well positioned to connect into the Asia Pacific market from our data centers in Hong Kong, as they are close to key global technology hubs and support regional interconnection needs. To find out more, visit our website. Alternatively, you can contact our sales team directly. Our dedicated teams are ready to help. We look forward to hearing from you. Thank you.
