The Hong Kong Personal Data (Privacy) Ordinance Has Been Amended: Are Your Data Protection Practices and Policies Adequate?
11 July 2012
The Personal Data (Privacy) Amendment Ordinance (the "Amendment Ordinance") was passed on 27 June 2012. This ends a nearly three year process initially spurred by the need to bring the Personal Data (Privacy) Ordinance (the "Ordinance") in line with technological and other advancements that occurred since the Ordinance was enacted in 1996. The process was accelerated by mounting public concern in relation to a number of high profile instances of misuse of personal data in Hong Kong, including the revelation of sale of personal data by the operator of widely used Octopus stored value cards in 2010.
The most significant changes relate to the use, transfer and sale of personal data for direct marketing and powers of the Privacy Commissioner for Personal Data (the "Commissioner"). A number of other changes relating to offences, penalties for breaches of the Ordinance and exemptions from various provisions of the Ordinance, have also been introduced. Some of the provisions of the Amendment Ordinance will come into effect on 1 October 2012. A number will come into effect at a later date. These include provisions relating to use/transfer/sale of personal data for direct marketing purposes and the legal assistance scheme provided by the Commissioner, all of which are expected to be implemented in the first half of 2013. The rationale for the staggered implementation of the Amendment Ordinance is that adequate preparation time is needed in order to allow procedural changes, IT system enhancement, and the development of guidance notes and other educational materials that would assist companies to comply with the new law.
The Commissioner (and his predecessor) has been actively involved throughout all stages of the amendment process, by making numerous submissions during the consultation stage as well as lobbying the Bills Committee for further changes following the introduction of the draft bill. Although he has welcomed the amendments, the Commissioner remains concerned by the grandfathering arrangements applicable to the new direct marketing requirements and has indicated he will keep a close watch on developments.
We highlight below the major changes brought about by the Amendment Ordinance.