PDPO Hong Kong overview and applicability

PDPO Hong Kong: Overview and Applicability

The Personal Data (Privacy) Ordinance (Cap. 486), known as the PDPO, is Hong Kong's primary data protection law. It governs the collection, handling and use of personal data, applying to any person or organisation that controls such activities in Hong Kong.

What Is the Personal Data (Privacy) Ordinance?

The Personal Data (Privacy) Ordinance (Cap. 486) protects the privacy rights of individuals over their personal data. It establishes a framework of six data protection principles that data users must follow when collecting, holding, processing, or using personal data. The Office of the Privacy Commissioner for Personal Data enforces the Ordinance, investigating complaints and issuing enforcement notices.

The six data protection principles cover:

1. Collection - Personal data must be collected lawfully and fairly, for a purpose directly related to the data user's function.
2. Accuracy and retention - Data must be accurate and kept no longer than necessary.
3. Use - Personal data may only be used for the purpose for which it was collected, or a directly related purpose, unless the data subject gives consent.
4. Security - Data users must take reasonable steps to safeguard personal data from unauthorised access or loss.
5. Openness - Data users must make their policies and practices regarding personal data available.
6. Access and correction - Data subjects have the right to request access to and correction of their personal data.

Does the PDPO Apply to My Company?

The PDPO applies to any person or organisation that controls the collection, holding, processing, or use of personal data in or from Hong Kong. This includes companies incorporated in Hong Kong that collect personal data from customers, employees, or other individuals. It also covers foreign companies that collect personal data of individuals located in Hong Kong, even if the company is established elsewhere. Any data user that operates in Hong Kong, regardless of where the data subject is located, is within its scope.

The Ordinance defines a "data user" as any person who, alone or jointly with others, controls the collection, holding, processing, or use of personal data. This includes both natural persons and corporate entities. If your company collects personal data - such as names, addresses, phone numbers, email addresses, or any information from which an individual can be identified - the PDPO applies to you.

The Ordinance does not apply to personal data held solely for personal, family, or household purposes, or to data held by certain government bodies where exemptions apply.

Hong Kong Data Protection Law: Key Obligations

Under Hong Kong data protection law, a data user must provide a Personal Information Collection Statement (PICS) at or before the time personal data is collected. This statement informs the data subject of the purpose of collection and the classes of persons to whom the data may be transferred. You must obtain the data subject's consent before using their personal data for direct marketing, and allow the data subject to opt out at any time without charge. Take reasonable steps to ensure personal data is accurate, secure, and not retained longer than necessary. Respond to data access and correction requests within the statutory timeframe.

Failure to comply with the data protection principles can result in enforcement action by the Privacy Commissioner, including the service of enforcement notices, and in serious cases, criminal liability.

Who Is a Data Subject?

A data subject is an individual who is the subject of personal data. This includes customers, employees, job applicants, contractors, and any other individual whose personal data is collected by a data user. The PDPO protects the personal data of living individuals only; it does not apply to data about deceased persons.

Practical Steps for Compliance

If the PDPO applies to your company, you should appoint a person or team responsible for data protection compliance. Review all data collection points and ensure a PICS is provided. Implement security measures appropriate to the sensitivity of the data held. Establish procedures for handling data access and correction requests. Obtain consent before using personal data for direct marketing and maintain an opt-out mechanism. Review data retention periods and securely destroy data that is no longer needed.

For further guidance, refer to the Office of the Privacy Commissioner for Personal Data's website, which publishes codes of practice and compliance resources.