Data Privacy Law in Hong Kong

While the future direction of data privacy law in Hong Kong remains uncertain, businesses should understand existing obligations with respect to personal data transfers in order to reduce compliance risks and promote efficient compliance. Padraig Walsh, Partner in the Tanner De Witt data protection team, looks at some key points to note for business dealing with data transfers, whether they are being made within Hong Kong or into the jurisdiction from elsewhere.

The first point to consider is whether a particular activity involves the processing of personal data. If it does, then it triggers an obligation to fulfil a range of data privacy laws including the six Data Protection Principles (“DPP”) under the PDPO.

This includes complying with requirements relating to disclosure, the purpose for which the personal data is collected and the right to request access or correction of the personal data. The requirement to obtain the prescribed consent of a data subject for change of use of their personal data is also one of the key elements in relation to a transfer of personal data outside Hong Kong (DPP 2(f)).

Having determined that a transfer of personal data is being made, the next step is to carry out a transfer impact assessment. While this is not mandatory under Hong Kong law, it is becoming increasingly common for a data exporter to carry out an assessment when the laws of a foreign jurisdiction do not offer a comparable level of protection to that provided by the PDPO. A transfer impact assessment is designed to identify supplementary measures that can be taken to bring the levels of protection up to that required by the PDPO. This can include technical measures such as encryption, anonymisation or pseudonymisation; and contractual provisions that impose obligations on audit, inspection and reporting, beach notification and compliance support and co-operation.

In addition to a transfer impact assessment, the data exporter should review its personal information collection statement to ensure that it has clearly informed data subjects of the classes of persons to whom their personal data will be transferred and the underlying grounds. This is a key element in ensuring that the data exporter can satisfy its obligation under section 33.

As data flows continue to grow across borders and businesses operate in an increasingly global economy, regulation imposed on data transfer is likely to remain important in both Hong Kong and other jurisdictions. This article has highlighted some of the key issues to consider and identifies areas where further work may be needed in order to improve consistency in regulatory approaches. The next issue in this series will examine the use of automated decision making and artificial intelligence in data transfers. We will explore the challenges and opportunities that this raises. Further articles will be published in due course on our blog and in the form of our Data Protection Weekly newsletter. Subscribe to the newsletter here. Tanner De Witt 2019. All rights reserved.

Singapore Prize Shortlist For 2019

If you’re a fan of sassy poetry, you might want to check out Gaze Back by Tan Wei-Ming. The award-winning author’s new book is a “clarion call for gender and linguistic reclamation, searing in its sassy confidence and universal appetite”.

You can also read the full shortlist here. This year’s list includes a non-fiction work with a personal slant, such as Leluhur: Singapore’s Kampong Gelam by Hidayah Amin, which shines light on the history of a neighbourhood that many only know as a tourist attraction. It’s also worth checking out State Of Emergency, by Jeremy Tiang, which takes us to the 1950s when Singapore’s future seemed to be up for grabs.

The prize’s organiser, the National University of Singapore Asia Research Institute, has a mission to “restore and enhance Singapore’s identity through a shared understanding of its history”. Kishore Mahbubani, who chairs this year’s jury, says that the world is now experiencing what American social scientist Benedict Anderson called the Asian century. It is a time when nations are becoming a ‘shared imagination’, with a shared sense of history being one critical glue holding societies together.

This year’s winner will receive a cash prize of S$50,000. The winner will be announced in October 2021.

The Defense Innovation Unit (DIU) has made small prize challenge awards to two companies to optimise their counter-drone and secure drone communications technologies for use by warfighters. The DIU aims to spur technological innovation and encourage breakthroughs in defence science and technology, and is a key component of the Ministry of Defence’s Innovation and Capability Office.

DIU has previously made smaller prize challenge awards to an Indian maker of solar-powered dryers and a soil carbon marketplace, among others. It has also given a grant to a Singaporean-based company to develop an AI-powered facial recognition system that will recognise and classify faces in photographs.

The prize ceremony for this year’s Singapore Prize was held on Thursday. Presenters at the event, which was broadcast live on a digital platform, included actor Sterling K. Brown and singer Bebe Rexha. In keeping with the sustainability theme, the host of the event wore a 10-year-old dark green blazer by Alexander McQueen and other presenters wore clothes from local brands that recycle their fabrics. Other highlights included performances by the bands One Republic and Bastille, as well as a special appearance by New Zealand Prime Minister Jacinda Ardern. You can watch the entire ceremony here.