Data Governance in Hong Kong
The first step is to define your vision and business case for developing a data governance program. The vision spells out your broad strategic objective and the business case provides the vehicle for implementing policies that align your organization to your data governance goals. A good business case is actionable, and should identify the people (roles), technologies and processes you need to support your governance activities.
The second step is to determine whether or not personal data is involved. In Hong Kong, personal data refers to identifiable natural persons and identifiers of such persons. This definition is markedly less onerous than the GDPR, but may not be comparable to a similar definition in other jurisdictions. This is important because obligations under the PDPO are triggered when the processing of personal data relates to an identified person.
If the identifiers are not sufficiently specific to make it possible for an individual to be recognised, then the processing of such data is not personal and therefore does not trigger the PDPO’s transfer and export provisions. This includes, for example, photographs taken at a concert which are not intended to identify the crowd, CCTV recordings of public spaces, or logs of entries and exits from car parks, that do not identify individual attendees.
For personal data that is considered to be transferred, the original data user must have expressly informed the data subject on or before the collection of his or her data of the purposes for which such data will be used and of the classes of persons to whom it will be transferred. This is commonly referred to as the “PICS” requirement. This obligation is often fulfilled by the provision of a PICS to the data subject upon or before collecting his or her personal data.
A data exporter should consider carefully the legal basis for transferring personal data to a data importer, and the underlying grounds for such a transfer. Where the underlying ground is based on consent, the data exporter should review the consent form to ensure that it clearly sets out the scope of the consent and the conditions to which the consent extends.
The MVNO Multibyte Info Group, an MVNO on the Three HK network, sells a 3G/4G prepaid SIM with data allowance for HK and mainland China. It costs HK$ 80 and has credit of HK$ 78, valid for 180 days. The SIM can be activated online or at any of their csl. shops, 7-Eleven, 1O1O, Van Go and Circle K kiosks. There are several add-ons, such as a HK$ 88 3-day Mainland China and Macau package with 5 GB for 8 days, and a HK$ 268 2-month HK+US+AUS+NZ package, both with FUP at 15 GB and throttled to 128 kbps beyond that. Tethering is supported on these packages, but voice and SMS are not. More information is available here.
