Hong Kong Data Privacy Ordinance Section 33 transfer of data: alive and kicking
There has been a spate of articles over the last few days in response to the Data Privacy Commissioner in Hong Kong issuing a guidance note to section 33 of Hong Kong’s Personal (Data) Privacy Ordinance which deals with the prohibition on the transfer of personal data outside of Hong Kong.
As many will know section 33 has been lying dormant on the statute books for 20 years but in late 2014 the Privacy Commissioner indicated to the government that it should be considering implementing section 33. To date the government has not revealed if or when it will implement.
In the context of the provision of the pre-employment background screening services that HireRight provide, would the bringing into force of section 33 have any impact? It is HireRight’s view currently that it would not. The reason for this is that HireRight follows best practice in processing personal data by obtaining the consent of any candidate prior to any such processing. That consent includes informing candidates that their data may be transferred outside of the jurisdiction in which they are located. Candidate consent is one of the exceptions to the prohibition on the transfer of data outside of Hong Kong under section 33.
It should also be noted that there will be 50 countries listed on a “White List” prepared by the Privacy Commissioner that will be deemed “safe” to transfer data to. It seems unlikely that the USA and European and Asian countries that have established privacy laws will not be on that list.
Please be advised that this is being provided for informational purposes only. It is not intended to be comprehensive and should not be construed or relied upon as legal advice. As with all legal issues, we recommend you consult your legal counsel.