190 / 192
(a) a transfer of the business of property of, or any shares in, the data user;
(b) a change in the shareholdings of the data user; or
(c) an amalgamation of the data user with another body,
is exempt from the provisions of data protection principle 3 if each of the conditions
specified in subsection (2) is satisfied”.
12.108
The three conditions that must be satisfied in order for a data user to be able to rely on
the section 63B(1) exemption are stated in section 63B(2). They are:
(a) the personal data transferred or disclosed is not more than necessary for the purpose
of the due diligence exercise;
(b) the goods, facilities or services which are the same as or similar to those provided by
the data user to the data subject are to be provided to the data subject, on
completion of the proposed business transaction, by a party to the transaction or a
new body formed as a result of the transaction; and
(c) it is not practicable to obtain the prescribed consent of the data subject for the transfer
or disclosure.
12.109
In order to avail itself of the exemption, the data user must ensure that all of the above
conditions are satisfied. To curb against abuse, section 63B(3) provides that if the primary
purpose of the proposed business transaction is the transfer, disclosure or provision for
gain of the personal data itself, then the data user cannot rely on the exemption.
12.110
The term “provision for gain” is defined under subsection (6) which adopts essentially the
same definition under section 35A(2) of Part 6A of the Ordinance in relation to the new
direct marketing regulatory regime:
…means the provision of the data in return for money or other property, irrespective of
whether –
(a) the return is contingent on any condition; or
(b) the person who provides the data retains any control over the use of the data.
12.111
In order to safeguard the personal data used for the conduct of a due diligence
exercise, section 63B(4) imposes the following duty on the data transferee:
(a) it must only use the data for the purpose of due diligence;
(b) it must, as soon as practicable after the completion of the due diligence exercise –
(i) return the personal data to the data user; and
(ii) destroy any record of the personal data that is kept by the person.
12.112
A person who contravenes section 63B(4) commits an offence and is liable on
conviction to a fine at level five and to imprisonment for two years (section 63B(5)).
Section 63C— Emergency Situations