The New Personal Data Protection Ordinance (PDPO)

Data is the raw information from which statistics can be created, with “data” commonly being interpreted to refer to its raw form itself whereas “statistics” denotes its interpretation. When collecting information for commercial application development or academic study in Hong Kong there are numerous sources available, including online databases, government publications and academic articles which you can tap.

At this point, it remains uncertain how Hong Kong’s new data protection law will be implemented in practice. One possibility would be extending the definition of personal data beyond what currently applies, potentially having significant ramifications for businesses that process such information. Other potential changes for the PDPO include increasing its scope to cover more data-related activities and mandating that companies that process personal data must designate an data protection officer.

The Personal Data Protection Ordinance (“PDPO”) applies to data users who control the collection, holding, processing or use of personal data within Hong Kong or beyond its boundaries. Even where processing occurs outside of Hong Kong, the PDPO requires that these users establish contractual or other arrangements with any subcontractors that process personal data and ensure compliance with PDPO requirements by those processors. It is illegal under PDPO to provide direct marketing data without consent from its subject and any applicable data subject(s); furthermore the Privacy Commissioner has authority under its jurisdiction to investigate and prosecute any such violations under its jurisdiction – for instance an estate agent was charged for using an individual’s HKID number without their express permission in 2021.