Data hk is an online repository of news and analysis on data privacy issues in Hong Kong. Our goal is to offer an informed overview of key issues within Hong Kong’s data policy realm as well as serve as a forum for discussion and debate. However, Data hk should not be seen as a replacement for legal advice, so all readers are advised to seek professional counsel for any specific legal matters they encounter while using our site.
At its core, businesses that transfer personal data outside Hong Kong must abide by the relevant laws of their destination jurisdictions. But this can often be a complex undertaking and there may be exceptions to these rules – for instance an overseas entity may not fall under PDPO jurisdiction if it does not control collection, holding, processing or use of personal data within or from Hong Kong; similarly if its transferred personal data doesn’t identify an identifiable natural person then there are no obligations for its transfer under PDPO.
The 2019 Hong Kong protests have brought into sharp focus the dual role of data as both weapon and object in political activism. Scholars across disciplines (Citation2019) have highlighted this dual use, particularly within social movements where data practices can alter action repertoires or generate new forms of conflict.
One of the most contentious applications of data’s dual roles was its application in doxing, or the dissemination of personal information through social media networks, during protests in Hong Kong. Both pro-establishment and anti-establishment camps used this tactic during protests for different ends, though moral justifications varied significantly; this fact underscores how data can both serve as means and object of contention, reinforcing Beraldo and Milan’s (Citation2019) observation that their relationship does not always coexist in a state of unease.
Though the PCPD may appear out of step with international trends regarding cross-border data transfers, its position does provide an opportunity to explore alternative measures, such as an adequacy regime. Achieve compliance would require PCPD taking an active role in assessing and enforcing compliance with DPPO rather than simply offering guidance regarding voluntary compliance. Padraig Walsh is Senior Associate in Tanner De Witt’s Data Privacy team. He serves on Asia Pacific Council for Data Ethics as well as contributing regularly to Tanner De Witt blog. You can connect with him via LinkedIn. This article originally appeared in Wall Street Journal 19 April 2019. Click here for full article.