Data has become an indispensable asset to modern economies, not only as an information resource but also as an economic factor of production, with the power to fuel growth and create jobs. Data is increasingly used for manufacturing digital goods and services – including autonomous vehicles and artificial intelligence – thus necessitating effective data management practices in any organization.

Hong Kong government recently unveiled the principles for a Data Management Framework, a set of rules to guide how organisations store and process personal data. The new framework seeks to ensure compliance with Personal Data (Privacy) Ordinance as well as implement safeguards to protect security and privacy of personal data, outlining powers and duties for users and processors of said data. The framework will take effect starting January 2020 and all sectors should review existing policies before making necessary adjustments accordingly.

Personal data can be difficult to access. To address this, Access My Info: Hong Kong (‘AMI:HK’) was launched. This initiative enables individuals to easily make data access requests to their telecommunications service providers; its goal is to see whether there is consistency among how these providers treat IP addresses as personal data.

Data users must fulfill their PDPO obligations by informing data subjects of their purpose for gathering personal data as well as its intended uses prior to or upon collecting such information. They must also inform data subjects of which categories of people the data may be transferred; if not possible to give this information at once, it must be made available upon request; typically this obligation can be fulfilled through written PICSs.

Law is unclear as to whether this requirement applies to entities outside Hong Kong. The Personal Data Protection Ordinance defines “data user” as any person responsible for collecting, holding, processing and using personal data – yet the Board held that this was insufficient grounds for extraterritorial jurisdiction, given that Google LLC lacked operations controlling these aspects in Hong Kong.

As part of their plan to introduce a new data management framework, the Hong Kong government also unveiled plans for an advanced financial data infrastructure known as Common Data Interface (CDI). CDI will replace multiple one-to-one connections between banks and sources of commercial data with just one connection through CDI – making data exchange much simpler while increasing security – further strengthening Hong Kong as a regional data hub and driving demand for city-based data centres.