Date: 16 Decemeber 2019
Response to media enquiry on PCPD proposed extraterritorial powers
Thank you very much for your question. Please find below our response:
-
The Privacy Commissioner for Personal Data, Hong Kong (the Privacy Commissioner) has the statutory duty to review the Personal Data (Privacy) Ordinance (PDPO) from time to time. The Privacy Commissioner made his preliminary views on the amendments of PDPO known to the Government in June 2019. In the past few months, there have been continuous cyber-intimidation or incitement, and violations of personal data privacy in the community. The Privacy Commissioner is examining further possible amendments to the relevant sections of PDPO. I have time and again explained by way of media interviews and media statements on our views on possible legislative amendments to address those personal data privacy issues arising from recent social incidents. We will continue to communicate with the Government on this subject.
-
PDPO’s main target of regulation is the data users who “control” the collection, holding, processing or use of personal data. As long as the personal data is controlled from or within Hong Kong, the related “data users” are regulated under the PDPO, regardless of whether or not the websites or instant messaging platforms are registered in Hong Kong and whether or not their registrants are located outside Hong Kong. For cases that involve online platforms registered outside Hong Kong, it naturally would be more complicated in collecting evidence and enforcing the law, e.g. it may take a longer time to investigate.
-
In June 2019 when we let our proposals known to the Government, the proposals already contained some elements on extra-territoriality, for instance, expanding the regulatory framework of the PDPO to directly cover data processors and that data users and data processors with a “Hong Kong” link and/or having a presence in Hong Kong should be covered.
-
We always keep our proposals under review. On this basis, we further consider that the “Hong Kong” link should also cover the scenario where individuals in Hong Kong are affected and foreign entities which provide services to individuals in Hong Kong. The proposed regulatory reform also included enhancing the powers of the Privacy Commissioner, such as imposing administrative fines and enabling the Privacy Commissioner to apply to court for injunction restraining doxxing and to conduct criminal investigation and prosecution.