How Personal Data is Protected When Transferred Overseas
Data hk is an online data collection platform which provides access to a wide range of open government and business datasets. It is designed to be used by students, researchers and businesses. The website allows users to download and filter data from over a million sources across the globe. It also displays the results in easy to read charts and tables. The website is free to use, although a subscription is required for some features.
When a Hong Kong company wishes to transfer personal data overseas, it must first consider whether it has a lawful basis to do so. The first step in this process is to review the company’s Personal Information Collection Statement (PICS). The PICS must expressly state that personal data may be transferred, and that the transfer is for the purpose contemplated by the original collection. If a new purpose is contemplated, the written consent of the data subject must be obtained.
The next step is to conduct a transfer impact assessment. If the assessment reveals that the foreign jurisdiction’s laws or practices do not meet Hong Kong standards, then the data exporter must suspend the transfer or take supplementary measures to bring the level of protection up to those standards. Supplementary measures can include technical measures such as encryption or pseudonymisation, and contractual provisions governing audit, inspection and reporting, beach notification, compliance support and co-operation.
Finally, the data exporter must notify the Office of the Privacy Commissioner for Personal Data (“PCPD”) of its intention to transfer personal data. The PCPD will then approve or disapprove of the transfer. It must also publish a notice in the Hong Kong Gazette, and notify the data exporter of the decision.
The PCPD’s approval of a transfer will be dependent upon a number of factors, including the extent to which a foreign jurisdiction meets or exceeds the six core data protection principles (“DPPs”) set out in the PDPO. In addition, the PCPD will consider the level of protection provided by laws in the territory to which the personal data is being transferred. Ultimately, the need to efficiently and reliably transfer personal data with mainland China, as well as internationally, will likely drive changes in Hong Kong’s approach to cross-border data transfers.