HK rules shed light on personal data protection

The legal framework governing personal information in mainland China is quite limited, with most provisions addressing the issue scattered in the individual clauses of various regulations. Despite this, numerous large enterprises, in order to reduce compliance risks in their operation, have internally formulated policies for protecting customers’ personal information and, when entering into contracts with customers, will sign an agreement for protecting personal information. Hong Kong has substantial reference value when it comes to legislation and the regulation of information protection. This article will discuss personal information protection practice based on the six basic principles enumerated in Hong Kong’s Personal Data (Privacy) Ordinance and relevant cases published by Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD).

Data collection principle

First, a data user is required to collect personal data in a fair and lawful manner, and the purpose needs to be directly related to its function or activity. Second, the data user is required to take all practicable steps to inform the data subject of the purpose for collecting his or her personal data, and the classes of persons to whom the data may be transferred. Third, the collected data need to be actually required and may not exceed the adequate level.

For example, the mobile phone app for purchasing travel products (excluding airline tickets, passage tickets, train tickets, etc.) of a certain travel company required the consumer to provide his or her name, telephone number or e-mail address, date of birth and ID card number when registering as a user. The PCPD found that the provision of dates of birth and ID card numbers exceeded the adequate level for data collection, with the consumer’s name and telephone number or e-mail address adequate for the company to engage in the sale of its products, the accumulation of points, consumer confirmation and other such operational activities.

Maggie Qin is a partner and Jason Chan is a foreign legal consultant of AllBright Law Offices