Importance of Data Protection Officer for Your Hong Kong Business

When it comes to protecting the privacy of individuals’ data, Hong Kong was a pioneer in passing comprehensive privacy laws and creating a separate privacy regulator. In contrast to the laws of several other nearby countries, Hong Kong legislations apply equally to the private and public sectors. To better regulate and enforce the use of personal data for direct marketing, Hong Kong updated the Personal Data (Privacy) Ordinance (PDPO) significantly in 2012. Financial institutions, insurers, and telecommunications companies are just a few examples of Hong Kong businesses that fall within the purview of industry-specific data privacy rules.

The Hong Kong Securities and Futures Commission (SFC) mandates compliance with the PDPO. By acting as a regulator in the sector, the SFC ensures that businesses and people with an SFC license adhere to privacy regulations. The Privacy Commissioner for Personal Data (PCPD), on the other hand, is the major regulator of PDPO. Data Protection Officers (DPOs) have the responsibility of ensuring the firm strictly adheres to all applicable laws and regulations and monitors the proper use of data regularly. Read on to know why data protection in a Hong Kong business is crucial.

Data Protection Officer (DPO) in Hong Kong

International norms governing the privacy of users’ personal information are in a period of flux. The laws that are now in force are constantly being updated by lawmakers as they impose stricter ones. There is a lot of volatility in data privacy laws. In today’s corporate environment, data security is of paramount importance, particularly for companies that deal with, process, or keep private information. To help build a data-secure business, you must understand the role of a data protection officer.

Who is DPO in Hong Kong?

A data protection officer is in charge of directing the development and execution of a company’s data protection policy. This individual is responsible for ensuring that a company complies with the General Data Protection Regulation (GDPR). His duties include overseeing Internet GDPR compliance, coordinating with clients and end users on privacy-related inquiries, coordinating with data protection authorities, and notifying the staff of amendments to data protection laws.

For businesses that gather and manage a lot of data, the DPO is in charge of ensuring sustainable compliance. They pay special attention to ways the business manages sensitive data, including names, addresses, phone numbers, credit card information, activity history, and other things hackers are interested in.

What is GDPR in Hong Kong?

Adopted in 2016, the EU General Data Protection Regulation (GDPR) replaced EU Directive 95/46/EC. This is done with effect from May 25, 2018, considering the security of individuals with respect to handling personal information and the mobility of such data. Organizations based in non-EU states are now explicitly required to comply with the GDPR under certain conditions, marking a major shift to the data protection environment outside the EU. 

The Hong Kong Personal Data (Privacy) Ordinance, Cap 486 of the Laws of Hong Kong (PDPO) protects personal data privacy. The Organization for Economic Cooperation and Development (OECD) Privacy Guidelines from 1980 and the EU Directive were also taken into consideration while the PDPO was being written. The GDPR adds a number of obligations that are not included in the PDPO since the former represents major advancements in data protection legislation from the EU Directive.

What is PDPO in Hong Kong?

The Office of the Privacy Commissioner for Personal Data is responsible for administering and executing the Hong Kong Personal Data (Privacy) Ordinance, which governs data protection. It regulates how users of personal data in the public and private sectors are allowed to acquire, store, process, utilize, and disclose such data inside Hong Kong. It is built on principles and is technology-neutral. The Data Protection Principles (“DPPs” or “DPP”) govern how data users gather, manage, and use personal data, along with additional compliance obligations. 

The goal of DPPs as a whole is to be certain that personal data is gathered fairly, with proper attention given to minimizing the quantity of data collected, and on a foundation that is supported by complete disclosure. Once obtained, personal information must be handled securely and maintained just as long as it takes to achieve the goals for which it was gathered. The data should only be used for purposes that were specified when they were collected if any. Data subjects may view and amend their data.

Key Differences Between GDPR and PDPO

The General Data Protection Regulation (GDPR) is the most significant piece of data privacy legislation ever passed, having far-reaching repercussions for not just EU member states but authorities around the globe. However, there is always a lot of curiosity when it comes to rules of data protection in Hong Kong business, which are outlined in the Personal Data (Privacy) Ordinance (PDPO) and its similarities or differences from GDPR. The following passages on GDPR vs PDPO will help you understand them better.

Application

The General Data Protection Regulation (GDPR) applies to organizations located in the European Union (EU) or outside of the EU that provide services or sell products to residents of the EU. The  Personal Data (Privacy) Ordinance governs the acquisition, storage, and use of personal information by companies operating in Hong Kong.

Personal data

According to the General Data Protection Regulation (GDPR), personal data is “any information belonging to an identified or identifiable natural person”. GDPR defines genetic and biometric data. The  Personal Data (Privacy) Ordinance does not distinguish between sensitive and non-sensitive personal data. It defines “personal data” as any data pertaining directly or indirectly to a live individual, in a form that allows access to or processing of the data.

Accountability and Governance

Businesses under GDPR must put in place both technological and organizational safeguards to guarantee compliance. They must also perform a data protection impact assessment (DPIA) on any processing of highly sensitive data. Certain businesses need a Data Protection Officer to be on duty at all times. 

On the other hand, PDPO lacks features for enforcing privacy and adherence to accountability principles. Nonetheless, they have established a Protection Management Programme to push Hong Kong businesses towards a culture of responsibility in regard to data privacy.

Data Breach Notification

Under GDPR, in the event of a data breach, users are obligated to inform the data protection authorities and, in the case of high-risk breaches, the data subjects directly. It is not required by law to notify the Privacy Commissioner or affected individuals when a data breach occurs, however doing so is strongly encouraged by the PDPO. As a result, the requirements are comparable with the exception that the GDPR “mandates” and the PDPO “suggests” breach notifications.

Sensitive Personal Data

Different types of personally identifiable information exist in GDPR. Only in exceptional cases may such sensitive data be processed. Whereas sensitive information is treated the same as non-sensitive information in Personal Data (Privacy) Ordinance.

Data Processor

GDPR requires data processors to keep processing records, safeguard data, preserve data only as needed, and report breaches. Technical solutions or contracts may do this. If a data processor experiences a breach, the data controller may also be held accountable under GDPR.

Hong Kong’s Personal Data (Privacy) Ordinance does not directly control data processors and does not have a privacy mark or certification system. The recommendation suggests a contractual or other method to prohibit data from being stored longer than required to avoid unauthorized entry, processing, or deletion when using a data processor. The data processor must take the same security precautions as the data owner.

Consent

GDPR requires data subject permission to be freely provided, precise, informed, and unequivocal by a statement or clear affirmative action. However, under the PDPO, notification is emphasized and stipulated permission is required if the data is utilized for new purposes, but consent is not required for data acquisition.

When Does GDPR Apply to Hong Kong Companies?

While GDPR was originally intended to apply only to EU nations, it has already been extended to businesses in Hong Kong. This means that it stays relevant to non-EU businesses that collect and handle personal data in connection with the sale of goods and services to EU residents.

Now more than ever, it is crucial for Hong Kong businesses to determine whether General Data Protection Regulation (GDPR) applies to them. As a result, if your organization deals with clients or consumers in the European Union, you must adhere to GDPR and monitor its progress for changes.

How is it Mandatory to Appoint a DPO for an HK Company?

Companies in Hong Kong are not required under the Personal Data (Protection) Ordinance (PDPO) to have a designated data protection officer. However, in order to meet compliance standards, businesses must employ data privacy and security measures that include more than adding security measures and monitoring traffic. He will see the overall picture, analyze the flow of data, and deconstruct the data security requirements that relate to the organization. In addition, companies in Hong Kong need a DPO to ensure continuous compliance with data security and safety regulations and smooth sailing through any audits.

Key Responsibilities of DPO in Hong Kong

Now that you know the value of a DPO and why you should hire one, you can think about the main responsibilities of a data protection officer. Keeping in mind these duties will help you ensure that your organization is always in compliance with data protection regulations.

• Putting the company’s Data Protection Policy into action and making sure it is followed by everyone
• Formulating policies and ensuring that they are strictly adhered to by all employees.
• Implementing in-house or off-site training programs for members of staff
• Providing guidance to, and keeping an eye on, the company’s data processors, as well as fostering the growth of promising team members
• Disseminating information to upper management when required, which typically involves sensitive material.
• Maintaining accurate data and adhering to destruction regulations of data

Qualities DPO Must Posses in Hong Kong

One of the most important personal qualities for a Data Protection Officer to have is the ability to interact with all levels of management and personnel. However, there are a few more things to remember before hiring one.

• Employees of multi-national enterprises will benefit from familiarity with foreign customs and regulations.
• Some examples of useful bachelor’s degrees include those in computer science, international commerce, and information security.
• Successful completion of a commercially accessible Data Protection Officer course is also helpful.
• The company’s data protection officer should be familiar with the company’s operations and the industry in which it operates.

Penalties For Not complying With GDPR or PDPO

Due to the sensitive nature of the data you manage, it is imperative that your business adheres to the requirements of the PDPO or GDPR. Heavy penalties will be imposed for non-compliance with the guidelines. The Office of the Privacy Commissioner for Personal Data (PCPD) will initiate an inquiry into a company’s PDPO violations by sending an enforcement notice requesting information. 

However, if the business disregards the enforcement notice, it would be subject to a punishment of between HK$50,000 and HK$100,000. Higher penalties, including fines of up to HK$1 million and jail terms of up to five years, apply for violations involving direct marketing.

Start Your Company In Hong Kong and Register With Startupr!

Setting up a company and maintaining data protection in Hong Kong is certainly an exhausting process. It is highly recommended that you receive professional assistance from an external service provider to keep all the requirements in place. With Startupr, you can experience hassle-free company incorporation tailor-made for your business needs all ONLINE. Whether you are looking for compliance assistance or guidance in hiring a qualified data protection officer for your business, you are at the right place along with all customized packages documented as per your need, we also provide some complimentary service as you sign with us. Get on a consultation call with us to know more!