On 29 December, 2014, Hong Kong’s Privacy Commissioner for Personal Data (the “Commissioner”) published a guidance note concerning the potential implementation of section 33 of the Personal Data (Privacy) Ordinance (the “PDPO”), which would restrict the export of personal data from Hong Kong.
The Commissioner’s view is that publication of his guidance will help businesses prepare for the eventual implementation of section 33 and that, in any event, businesses should comply with the guidance as a matter of their corporate governance responsibilities. We believe that the Commissioner’s guidance on cross-border data transfers will be highly controversial. The controversial aspects of the guidance are compounded by the fact that there is at present no proposal by the government to bring the enactment of section 33 forward, either in its present form, or at all, and therefore no pending statutory instrument to evaluate the guidance against. Furthermore, the guidance is also unclear in a number of key aspects, making its interpretation difficult. These uncertainties mean that it has a very unusual status as a guide to compliance with the PDPO.
Click here to view the full article.