Hong Kong is home to many of the world’s premier cloud, SaaS and IoT service providers. The city’s networked data centers form a global campus which gives enterprises direct access to major cloud providers like Amazon Web Services, Microsoft Azure, Google Cloud Platform, IBM Cloud and Alibaba Cloud via cloud on-ramps.
As a result, Singapore has developed an abundant data center market and ecosystem featuring various IT and business solutions for managing, protecting, and processing data. Furthermore, this city serves as a key link between Asia and Southeast Asia, serving as gateways for regional and global companies entering China or Southeast Asia markets.
Hong Kongers view increased cross-border data flow as essential to its economy, so many believe that its unimpeded flow should continue unhindered – meaning section 33 may never come into force here.
Keep in mind that section 33 only applies when someone in Hong Kong collects, holds, processes, or uses personal data that they intend to transfer out. Whether this test is met will depend on what constitutes “use”. Under PDPO use includes both disclosure and transfer (DPP1 and DPP3).
If a data user intends to transfer personal data outside Hong Kong, they must perform a transfer impact assessment and take necessary measures (SME) to bring the level of protection there up to that in Hong Kong. SME could include technical or contractual measures which might be included as separate agreements or schedules to an existing commercial arrangement or as contractual provisions within it.
An additional requirement similar to GDPR applies for data exporters: they must obtain voluntary and express consent of data subjects before sharing or using personal information that was not contemplated in the PICS or for another purpose than originally envisaged in its PICS-compliant PICS document.
Section 33 may seem outdated when compared with international trends, yet it still may hold value given Hong Kong’s unique economic and geographical circumstances. Indeed, its implementation could offer more effective means of guaranteeing free and equitable data flows. As we look ahead, this will be of paramount importance. The PCPD is committed to working closely with industry to ensure there are sufficient safeguards in place to protect personal data and uphold data protection standards, while still permitting individuals and businesses to make legitimate, informed choices about personal and corporate information. We plan on doing this through continued engagement with industry members as well as creating relevant guidance – we look forward to creating a strong data culture in Hong Kong together!