On Monday 20 January, the Constitutional and Mainland Affairs Bureau, jointly with the Privacy Commissioner for Personal Data, presented a paper outlining topics for review of the PDPO to the members of the Legislative Council Panel on Constitutional Affairs. The CMAB and the PCPD are expected to take panel members’ feedback on the PDPO Review Paper and undertake further in-depth study of the issues with a view to making specific proposals for legislative reform in due course.
The Hong Kong Securities and Futures Commission has issued a paper containing proposals to introduce cyber security guidelines under the Securities and Futures Ordinance applicable to internet brokers. Comments are open through 7 July 2017.
On 26 January, Hong Kong’s Privacy Commissioner for Personal Data published his annual report on 2015 complaints and enforcement activity under the Personal Data Privacy Ordinance. The report reveals that 871,000 Hong Kong individuals were affected by data breaches in 2015, compared with 47,000 in 2014. The report is noteworthy that the number of reported breaches continues to increase at a rapid pace notwithstanding the fact that Hong Kong’s data breach notification regime is at the moment a voluntary one. The report is also notable for setting out the Commissioner’s statement of priorities for 2016.
On 9 October 2015, the Privacy Commissioner for Personal Data published a Guidance Note on “Data Breach Handling and the Giving of Breach Notifications”, a revised version of its June 2010 edition. The Guidance Note gives guidance to data users on how to deal with data breaches. In particular, the Guidance Note provides more of a focus on the relationship between data users and data processors. A data user engaging a data processor must adopt contractual or other means to ensure personal data security.
Few areas of regulation are advancing as quickly in Asia as data privacy regulation. This year marks the tenth anniversary of the APEC Privacy Framework and we now see “European style” comprehensive data privacy regimes in a dozen jurisdictions across the Asia-Pacific region. Hogan Lovells data protection lawyers Mark Parsons and Eugene Low recently hosted in-person seminars at Hogan Lovells’ offices in Hong Kong to take stock of where Asia is in terms of data privacy regulation, and to help chart a roadmap to compliance. The focus of these discussions was on identifying “hot spots” for businesses operating across the region and pointing to practical measures and points of prioritisation. The discussions also considered steps to be taken to prepare for and react to data breach events, with a seasoned view of regulatory attitudes and approaches to enforcement and remediation.
On Thursday, 14 May, Hogan Lovells data protection lawyers Mark Parsons and Eugene Low will host an in-person discussion at Hogan Lovells’ offices in Hong Kong to take stock of where Asia is in terms of data privacy regulation, and to help chart a roadmap to compliance. The focus will be on identifying “hot spots” for businesses operating across the region and pointing to practical measures and points of prioritisation. The discussion will also consider steps to be taken to prepare for and react to breach events, with a seasoned view of regulatory attitudes and approaches to enforcement and remediation.
On 29 March, the Hong Kong Privacy Commissioner for Personal Data published a guidance note that supplements previous guidance on the use of closed circuit television systems and for the first time addresses the increasing use of unmanned aircraft systems. The Commissioner’s guidance is the first significant regulatory engagement on the use of UAS by a Hong Kong regulator.
2014 was a very eventful year for data privacy regulation in Asia and there are reasons to believe that 2015 will represent a turning point for the region as established privacy regimes are toughened and new regimes enacted in recent years begin to mature. The past year saw a number of significant regulatory developments, in particular the implementation of new, comprehensive “European-style” privacy laws in Singapore and Malaysia, the amendment of China’s consumer protection law to include data privacy principles and increased financial penalties in South Korea.
Although Asia’s data privacy laws draw from a common set of guiding principles, each law is unique. Moreover, as freshly minted regulators come to grips with these new laws, differences in interpretation and underlying policy are becoming apparent. As a consequence, there is now a ‘patchwork’ of compliance requirements across the region. Depending on the country, sector specific laws, consumer protection laws, employment laws and laws in emerging areas such as cybersecurity, also complicate the compliance picture for Asia, and there is no common framework for any of these laws.
On 29 December, 2014, Hong Kong’s Privacy Commissioner for Personal Data published a guidance note concerning the potential implementation of section 33 of the Personal Data (Privacy) Ordinance, which would restrict the export of personal data from Hong Kong. In a recent client alert, partner Mark Parsons and associate Peter Colegate from the Hogan Lovells Hong Kong office explore the Commissioner’s understanding of how section 33 would be implemented, including some important nuances that are particularly relevant to multi-national businesses operating in Hong Kong and the wider region.
In a recent client alert, partner Mark Parsons and associate Peter Colegate from the Hogan Lovells Hong Kong office highlighted the attention increasingly paid by privacy regulators around the world to the manner in which mobile apps collect, process, and transmit personal data.
The privacy enforcement in Hong Kong under its data protection law, the Personal Data (Privacy) Ordinance, ramped up significantly last year. Hong Kong’s Privacy Commissioner for Personal Data received 1,792 complaints in 2013, a record high. The figures show a 48% increase in complaints filed and more than a doubling of the number of enforcement notices issued by the Commissioner, with 25 enforcement notices issued in 2013 against 11 in 2012. 78% of all complaints were made against the private sector and in particular the financial, telecommunications and property sectors. The Commissioner has confirmed that a key focus for 2014 will be to increase its enforcement efforts.
Somewhat of a furor has been caused in Hong Kong by the decision of the Office of the Privacy Commissioner for Personal Data to issue an enforcement notice to stop a company from supplying data on individuals obtained from publicly available litigation and bankruptcy records via a smartphone application, claiming that the company “seriously invaded” the privacy of those individuals.
On January 25, 2013 the Hong Kong Privacy Commissioner for Personal Data published its “New Guidance on Direct Marketing” to help organizations comply with the direct marketing provisions of the Personal Data Amendment Ordinance. The “Amendment Ordinance” was passed on June 27, 2012; while most of its provisions have already been implemented, the provisions relating […]
In Hong Kong, an individual’s right to make an Access Request is expressly conferred by section 18of the Personal Data (Privacy) Ordinance which enables individuals to ascertain whether data users hold any personal data relating to them, and if so, to obtain a copy of such data. Individuals also have the right to request the correction of any inaccuracies contained in such data. Data users are required under the Ordinance to notify individuals of such access/correction rights, on or before the first use of their personal data. As described in this blog entry, the Hong Kong Privacy Commissioner for Personal Data recently issued a guidance note titled “Proper Handling of Data Access Request and Charging of Data Access Request Fee by Data Users” to provide data users with guidance on how to comply with data access requests as well as how to calculate the fees to be charged in connection with such Access Requests.
The Hong Kong Personal Data (Privacy) Amendment Ordinance was passed on 27 June 2012. This ends a nearly three year process initially spurred by the need to bring the existing legislation in line with technological and other advancements that occurred since it was enacted in 1996.
Organisations in Hong Kong are required under the Personal Data (Privacy) Ordinance to erase personal data when the data is no longer required for the purpose for which it was collected.
The Hong Kong Privacy Commissioner for Personal Data recently has published a Guidance Note, entitled “Guidance on Personal Data Erasure and Anonymisation,” which is relevant to compliance under the Ordinance.
Late last year, the Hong Kong Privacy Commissioner for Personal Data published a Guidance Note to assist data users with properly handling and protecting personal data contained in portable storage devices, including USB memory sticks, tablet/notebook computers, mobile/smart phones, personal digital assistants, portable hard drives and optical discs such as DVDs. This post reviews practical recommendations set forth by the Privacy Commissioner to help data users manage the security risks associated with the use of portable storage devices.
On 14 February 2012, the Hong Kong Privacy Commissioner published a report on an investigation into a car park management firm that owns 50 car parks in Hong Kong, regarding its collection of motorists’ registration particulars from the Transport Department’s Register of Vehicles, and the subsequent use of this information for direct marketing purposes. Imperial’s actions were found to contravene Data Protection Principles (“DPPs”) 1(2) (relating to manner of collection of personal data) and 3 (relating to use of personal data) of Schedule 1 to the Personal Data (Privacy) Ordinance (Cap. 486).
Hogan Lovells privacy attorneys examine the challenges of deploying geolocation services in five jurisdictions, including France, Spain, Germany, the United States and Hong Kong.
The Hong Kong Personal Data (Privacy) Amendment Bill (the “Bill”) was introduced into the Legislative Council on 13 July 2011. The Bill, which is the culmination of a lengthy consultation process into the reform of the Personal Data (Privacy) Ordinance, aims to bring the Ordinance in line with technological and other advancements that have occurred since the Ordinance was enacted 15 years ago, and is in part a response to the mounting public concern in relation to a number of high profile instances of misuse of personal data in Hong Kong.
On July 7, the Hong Kong Privacy Commissioner for Personal Data issued a consultation document setting out the mechanism for a Data User Return Scheme that require certain business sectors to publicize information about their data practices to create greater accountability and transparency of data protection practices of corporations as well as an enhancement of their data privacy protection standards. Gabriela Kennedy and Zuzana Hecko, of the Intellectual Property, Media and Technology group of Hogan Lovells’ Hong Kong office, provide their synopsis.
In Hong Kong, the Privacy Commissioner for Personal Data recently exercised his rights under Section 36 of the Personal Data Ordinance and conducted an inspection of the data system of TransUnion Limited, Hong Kong’s major credit reference agency. While the inspection did not reveal any major data breaches or issues, the Commissioner has reported deficiencies in TransUnion’s personal data system and made a number of recommendations for improvement.