On 20 January 2020, the Constitutional and Mainland Affairs Bureau (CMAB) together with the Privacy Commissioner for Personal Data (Privacy Commissioner), published a consultation paper raising important data protection issues and proposing possible amendments to the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO), after having reviewed the existing data protection regime in Hong Kong. These include possibly introducing a mandatory data breach notification mechanism, requiring data users to specify a retention period for personal data collected, raising the sanctioning powers of the Privacy Commissioner as well as potentially making data processors more accountable.
The consultation paper seeks feedback from members of the Legislative Council and we expect that more specific proposals for reforms to the PDPO will be made in due course. The consultation paper did not indicate an express timeframe for the completion of this review process or when specific amendments to the PDPO would be proposed.
In light of the spate of major data breach incidents in Hong Kong, the rapid technological advancements resulting in new uses of personal data in new technologies as well as recent regulatory developments such as the enactment of the General Data Protection Regulation (GDPR) in the European Union (EU), the consultation caper recognised a need for enhancing the level of protection currently afforded under the PDPO, and bring it closer in line with international data protection standards. The Privacy Commissioner had considered the regulatory regimes in other jurisdictions such as Australia, Canada, the EU, New Zealand and Singapore.
For an overview of the key proposals please see our full article here.
Disclaimer
Herbert Smith Freehills LLP has a Formal Law Alliance (FLA) with Singapore law firm Prolegis LLC, which provides clients with access to Singapore law advice from Prolegis. The FLA in the name of Herbert Smith Freehills Prolegis allows the two firms to deliver a complementary and seamless legal service.