Whether you are transferring data from one jurisdiction to another or from within Hong Kong to a company in Mainland China, there are many regulatory issues that need to be considered. The PCPD is introducing new rules on cross-border data transfers, including standard contractual clauses and a requirement for an impact assessment when you transfer personal data of EEA residents to a third party in the Mainland (Section 33 of the PDPO).
In addition, the PCPD will require the data user to expressly inform a data subject on or before collection of their personal data of the purposes for which the data will be used and the classes of persons to whom the personal data may be transferred. This will make it much easier for data subjects to object to data transfer and will put greater pressure on data users to ensure that their data is not transferred to unauthorized third parties.
The law also imposes additional requirements on data importers in circumstances where they transfer personal data of EEA residents to companies in the Mainland under the one country, two systems principle. These include the requirement for a data importer to agree to the new standard contractual clauses and to contribute to an impact assessment in cases where the data is being transferred from an EEA data exporter. These requirements are likely to increase the amount of time and effort that will be needed to comply with the PDPO and the data protection regulations.
As a result, the PDPO has a number of provisions that are intended to help businesses comply with these new rules and reduce their exposure to risk. In this article, Padraig Walsh from Tanner De Witt’s Data Privacy practice group explains the key points to consider for these new data transfer regulations.
While the PCPD’s approach to these new rules appears to be a departure from international best practice, it is likely that in the long term this position will become increasingly untenable as business and social life continues to integrate with Mainland China. The volume of data transferred between Hong Kong and the Mainland will increase, and this will place significant pressure on the need for an efficient and reliable legal basis for transfer.
In the meantime, if you are unsure of the exact rules that apply to your specific circumstances, it is worth discussing the matter with a specialist. This will ensure that you are fully aware of your obligations and are prepared to take steps to mitigate any risks that may arise from these new data transfer regulations. If you would like to discuss this with a member of our team, please do not hesitate to contact us. You can reach us via email or phone. We will be happy to help you. We look forward to hearing from you soon. Good luck and have fun! Thanks for your support. You can also follow us on Facebook, Twitter and Instagram. By doing so, you will be able to keep up to date with our latest news and offers.