Hong Kong’s definition of personal data has remained consistent since PDPO first came into force in 1996, mirroring most international privacy laws (such as GDPR in Europe) by including information pertaining to an identified or identifiable natural person – this being covered under six data protection principles (DPPs) comprising core obligations under Hong Kong privacy law.
The PDPO applies to anyone responsible for controlling the collection, holding, processing or use of personal data in Hong Kong. It has no extra-territorial application – unlike mainland China’s Personal Information Protection Law or European Economic Area’s GDPR which cover extraterritorial applications – instead only covering data users that control operations related to collecting, holding or processing personal data within Hong Kong as well as those who collect or process it with residents residing within its Special Administrative Region (SAR).
If a person collects personal data, the PDPO requires them to present an Individual Collection Statement (PICS). This must include information regarding its purpose and what classes of individuals might receive the data; in addition to providing the name or job title of someone responsible for responding to inquiries regarding its collection or uses.
Under certain conditions, it may not be necessary to provide a PICS. For instance, when collecting personal data is permitted by law. Photographers may take photographs of crowds attending musical concerts without needing to notify each person individually; provided that these photographs do not target or identify specific individuals. This principle can also apply to CCTV recordings, logs of people entering car parks and records of meetings that don’t specifically identify individual attendees. Studies have recommended that Hong Kong update its data protection law in line with modernisation efforts underway elsewhere, including Europe and Canada. However, until such changes come about, businesses must understand their responsibilities under Hong Kong’s existing data protection regime and how this affects them. They should establish whether they qualify as data users and what obligations are expected of them if transferring personal data outside of SAR boundaries or to any other jurisdictions.