Data centers (or data hks) are storage facilities where information can be housed for safekeeping. Data has become an indispensable asset to our economy and many businesses rely on information technology for daily operations; as a result, large volumes of information must be stored and processed by businesses to run effectively; consequently they require reliable systems and processes in place for managing this information effectively.
Storage and processing of personal data entails several risks that must be assessed and considered before moving forward with its storage or processing. One major consideration should be its potential effect on privacy – an invasion could erode customer confidence, possibly even leading to business closure. Another risk is security of data, particularly relevant when handling health records or similar sensitive records.
Thus, it is vital that businesses take steps to safeguard their data, including protecting any that is transferred externally. One effective means is implementing a data protection regime compliant with the PDPO; this should include creating a personal information collection statement (PICS), seeking consent for data use cases and notifying subjects of what classes of persons their information could be shared (remember this is considered transfer).
Whenever a business transfers personal data outside Hong Kong, they may need to comply with various statutory obligations. This is particularly the case if they fall within GDPR’s definition of data exporters – in these instances they must conduct a transfer impact assessment as part of GDPR compliance and agree on standard contractual clauses; additionally they will contribute towards another transfer impact assessment where their personal data of European Economic Area persons was received from another data exporter within EEA territory.
Hong Kong does not place any legal restrictions on the transfer of personal data outside its territory, however there are various measures available to safeguard personal data when moving it abroad. Recently, PCPD updated their guidance regarding this subject; specifically advising data users transferring their personal data abroad whether their PICS needs to be updated based on this change as well as providing an overview of legal grounds available for transfer.
Remember that personal data is defined broadly under PDPO; it includes any data which identifies or can be used to identify an individual, whether direct or indirect identification occurs. Common examples of such personal data are names, addresses, ages, dates of birth and any information linked with individual identities such as their dates of birth. As businesses will likely be transferring personal data abroad it is imperative that they review their PICS accordingly to avoid unnecessary burdens on themselves and prevent unnecessary penalties being levied against them by local laws and regulators.