Hong Kong data transfer overseas rules
Transferring personal data from Hong Kong to another jurisdiction is regulated by Data Protection Principle 3 under the PDPO.
Hong Kong Data Transfer Overseas Rules
The hong kong data transfer overseas rules are set out in the Personal Data (Privacy) Ordinance (Cap. 486). Data Protection Principle 3 (DPP 3) governs the use of personal data, including its transfer outside Hong Kong. A data user intending to export personal data must ensure the transfer complies with the Ordinance's requirements.
Hong Kong Cross-Border Data Transfer
A hong kong cross-border data transfer occurs when a data user in Hong Kong discloses, shares or transmits personal data to a recipient in another jurisdiction. DPP 3 does not prohibit such transfers outright. It imposes conditions to protect the data subject's privacy.
PDPO Cross-Border Transfer
The pdpo cross-border transfer requirements are in section 33 of the Ordinance. This section has been enacted but is not yet in force. In practice, the Office of the Privacy Commissioner for Personal Data (PCPD) advises compliance with DPP 3. DPP 3 requires personal data be used only for the purpose for which it was collected or a directly related purpose. A transfer overseas is a form of use.
Personal Data Export Hong Kong
For a personal data export hong kong to be lawful, the data user must obtain the data subject's consent, unless an exception applies. Consent must be freely given and specific to the transfer. Alternatively, the data user may rely on a contractual arrangement with the recipient that ensures comparable protection to that provided under the Ordinance. The PCPD has published model clauses for this purpose.
Data Protection Transfer Rules
The data protection transfer rules require the data user to take all reasonably practicable steps to prevent the transferred data from being used, held or processed in a way that contravenes the Ordinance. This includes ensuring the recipient has adequate security measures. A Personal Information Collection Statement given at the time of collection should inform the data subject of the intended transfer and the classes of transferees.
Sources
More on glossary.