Data hk is a web portal designed to enable Hong Kong residents to submit requests to access personal information held by eight major mobile phone and internet service providers. It is easy to use and allows users to enter a limited amount of details about their situation, in order to generate a request that can be submitted online, by email or by post. At the time of writing, it had generated 1603 requests.
A significant element of data hk is the ability to identify if a request has been received, and if so whether it has been dealt with or rejected. This is a key function and enables people to make informed decisions about their privacy, and to keep track of the status of any application of their personal data. The website is currently in beta.
As the Hong Kong government and privacy regulator, the PCPD, have recognised that this is a valuable tool for individuals, it is important to ensure that data hk works well and is accessible to as many people as possible. It is therefore a positive development that the PCPD has committed to support the website in its current form, and will review the website in future.
Generally speaking, a person’s name, ID number and address are considered personal data. Other identifiers such as the physical, physiological, genetic, mental, economic, cultural or social identity of an individual can also be deemed personal data. However, it is not always clear what constitutes ‘personal data’. This is particularly the case in respect of a photograph taken by a photographer at an event, which might be said to capture personal data if the photograph is used to identify specific individuals. It may also be the case for CCTV recordings, logs of persons entering car parks and records of meetings that could be used to identify individual speakers or participants.
The PDPO requires that personal data be collected fairly and for a specified purpose. This includes ensuring that it is not kept for longer than necessary and that it is not disclosed to any unauthorised person. It also requires that the PCPD be notified of any intention to collect or use personal data for purposes other than those specified in the PDPO. These obligations can be fulfilled in a variety of ways, and most commonly by the provision of a personal information collection statement to the data subject.
There are a number of obligations that arise under the PDPO in relation to the transfer of personal data abroad. The PCPD has published guidance on these issues, and has recommended model clauses for inclusion in contracts involving data transfers. The PCPD has also issued advice on the adequacy of a foreign jurisdiction’s laws and practices in relation to the protection of personal data.
It may seem surprising that Hong Kong does not have a statutory restriction on the transfer of personal data overseas, but this position makes sense in terms of the “one country, two systems” philosophy and the need to allow free movement of people and goods between Hong Kong and mainland China. Nonetheless, the need for efficient and reliable means of transferring personal data between Hong Kong and mainland China will drive change in this area.