Skip to content

Response to Media Enquiry or Report

Response to Media Enquiry or Report

Date: 10 November 2017

Responses to Media Enquiry on Cross-border Data Transfer


Thank you very much for your enquiry and our office’s responses are as follows:
 
  • The Chief Executive’s 2017 Policy Address states that “Capitalising on our advantages of “One Country, Two Systems”, our geographical location, business environment, legal system, intellectual property, research and development capability, financial services, etc., and given the opportunities brought by the National 13th Five‑Year Plan and the Guangdong‑Hong Kong‑Macao Bay Area development, Hong Kong has huge potential to become an international innovation and technology hub”.
 
  • The Chief Executive also announced that the Smart City Blueprint for Hong Kong will be available within this year.
 
  • A research report entitled “Building Hong Kong as
    an international data hub” conducted by Hong Kong Smart City Consortium, an advocacy group which shares expertise, advice and views in collaboration with other professional bodies to assist the Government in building a Smart City, advocated that Hong Kong's pro-business environment, sound legal system and free flow of talent and information technology give the city the competitive edge to become the region's premier data hub. With its added advantages under "One Country, Two Systems" and opportunities arising from the Belt and Road initiative, Hong Kong is well positioned to develop into an international data hub for hosting, storage and processing services.
 
  • During a representation by the Chairman of Data Hub Committee of the Hong Kong Smart City Consortium at the 39th International Conference of Data Protection and Privacy Commissioners held on 29 September 2017, it is proposed that a simplified approval process would be established with overseas and mainland jurisdictions on data transfer to Hong Kong.
 
  • As the regulator on protection of personal data privacy, the Privacy Commissioner for Personal Data, Hong Kong (PCPD) fully cooperates with the relevant authorities for the said initiatives, and meanwhile monitors the privacy concerns that may arise. 
 
  • Article 37 of the Cybersecurity Law of the mainland of China stipulates that personal data and important information collected and generated by operators of critical information infrastructure during their operation in mainland China shall be stored locally.  Security assessment has to be conducted if the personal data or important information needs to be transferred to a place outside mainland China. The relevant authorities of mainland China have been drafting the measures and guidelines for transfer of personal data and important information outside the mainland.
 
  • With regard to cross-border data transfer provisions in Hong Kong:
 
  • Section 33(2) of the Personal Data (Privacy) Ordinance (PDPO) provides a stringent regulatory framework for the transfer of personal data to places outside Hong Kong.  This section has yet to be brought into force since its enactment in 1995.
  • To prepare for the commencement of operation of section 33, PCPD commissioned a consultancy study on drawing up a “white list” of jurisdictions with privacy protection standards comparable to that of Hong Kong, delivered the consultancy report to the Government and issued a Guidance Note on Personal Data Protection in Cross-border Data Transfer[1] (Guidance) in 2014.  The Guidance seeks to assist data users in understanding the requirements on cross-border data transfers which section 33 would impose when brought into force, and to provide practical guidance.
  • Given the implementation of section 33 could bring about impact on business, the Government has engaged a consultant to conduct a Business Impact Assessment for the implementation of section 33, and the stakeholders’ views are consulted on their compliance measures. 
  • In its recent paper submitted to the Legislative Council Panel on Constitutional Affairs (LC Paper No. CB(2)1368/16-17(03)) (May 2017)[2], the Government has revealed that the trade sectors have expressed concerns regarding the implementation of section 33, and the small and medium-sized enterprises may face difficulties in complying with section 33.  The Government consultant has not yet released its report.  
  • As pointed out in the above Legislative Council Paper, the PCPD will further study the issues raised by the trades with regard to section 33 and the compliance issues as well.  The Government will formulate the steps forward in the light of the PCPD’s study.
 
  • The PCPD will keep abreast of the global personal data privacy development, and take proactive steps to strike the proper balance between data privacy protection and free flow of information, and respond promptly to meet the challenges ahead.