Promoting the Value of Data in Hong Kong
Hong Kong is a highly developed city that has a strong international reputation as an open and business-friendly environment. Its economy is heavily based on services, and it has a high level of technology and innovation. In recent years, it has focused on building a data infrastructure that will allow the government and businesses to use data more effectively. The city is working towards becoming a global leader in data-driven innovation.
The HK Government has a long history of data protection and has passed legislation to protect personal information. The Data Protection Act (PDPO) establishes the rights of individuals and specifies obligations to data users through six data protection principles. It was first passed in 1996 and has been significantly amended in 2012 and 2021.
PDPO imposes data protection standards on all organisations that handle personal information in Hong Kong, whether private or public. This includes organisations that offer goods or services and those that collect personal information, as well as those that process, hold, or share it. It also covers the use of personal information for direct marketing. The PDPO also prohibits the unauthorized disclosure of personal information, known as “doxxing”.
To comply with the PDPO, data users must be transparent about how they will use data and notify the data subject of their purposes. They must also provide the data subject with a list of all data they collect, and the categories of persons to whom it will be shared. This is known as the personal information collection statement (PICS) and must be provided to data subjects before collecting their data.
In addition to regulating the use of personal information, the PDPO requires that all organisations that store it have adequate technical and administrative measures in place to protect the data against unauthorised access or loss. These measures should be reviewed and updated on a regular basis. They should also be tested to ensure that they are effective.
A study carried out by the Office of the Privacy Commissioner in 2012 found that most companies in Hong Kong have inadequate security measures and are not using them to their full potential. The results of this survey led to a number of recommendations, including that the PDPO be amended to include mandatory breach notification and a duty on data users to regularly review their security arrangements.
The HK Government is looking to promote the value of data in Hong Kong by attracting global leading companies and technology pioneers, creating a resource sharing platform, accelerating scientific research transformation and nurturing digital talent. It is also promoting open data policies and encouraging government departments to share more of their data. It hopes this will encourage more data applications and enhance the development of Hong Kong as a global data hub.