Padraig Walsh of Tanner De Witt’s Data Privacy practice group explains the key points to consider for data transfers, whether from Hong Kong to other locations or into Hong Kong. Data transfers are commonplace between businesses and require careful consideration of data privacy regulation – including the six core data protection principles (“DPPs”) – to ensure effective compliance with Hong Kong’s data laws.
The first issue to consider is the legal basis for the proposed personal data transfer. This will be determined primarily by the purpose for which the personal data is collected. For example, if the personal data is collected for marketing purposes, the consent of the data subject must be obtained. However, if the personal data is collected for research purposes (or other “legitimate interests”), then it may be transferred without the consent of the data subject. In addition, the DPPs provide some additional protections for sensitive personal information (such as health or financial data), which must be taken into account when determining the lawful basis for a particular processing activity.
A further consideration is the class of persons to whom personal data may be transferred. In Hong Kong, a data user must expressly inform a data subject on or before the original collection of his/her personal data of the purposes for which the data will be used and the classes of person to whom the data may be transferred. This requirement is usually fulfilled by providing the data subject with a PICS. In contrast, the EU’s GDPR requires that the data subject be informed of the intended destination of their personal data prior to any transfer.
Finally, the data exporter must also verify the lawfulness of the proposed personal data transfer. This will be achieved by reviewing the PICS to see if it specifies the purposes for which the personal data is collected and identifies the classes of persons to whom the data may be transferred. If this is not the case, a PICS must be prepared or the legal basis for the personal data transfer will be in doubt.
Tech Data Distribution (Hong Kong) liaises with the channel ecosystem to connect end-users with solutions that help them maximize business opportunities. The company has recently entered into a strategic distributorship agreement with Allied Telesis, a global vendor of IT infrastructure solutions. Allied Telesis’ software advancements, known as Network AI, solve technological problems and empower organisations to become more competitive by automating administrative tasks. This will reduce human errors and enhance security while improving network performance. The company’s products and services include cloud computing, network security, and data center efficiency.