The EU General Data Protection Regulation (GDPR), adopted in 2016, came into force on 25 May 2018. The GDPR involves new provisions and enhanced rights. In the wake of technological developments and globalisation and the constitutionalisation of the fundamental right to data protection in the EU, the GDPR aims to harmonise the framework for the digital single market, put individuals in control of their data and formulate a modern data protection governance.
Why is the GDPR relevant to Hong Kong organisations/ businesses?
In Hong Kong, the Personal Data (Privacy) Ordinance, Laws of Hong Kong (Cap 486) (PDPO) protects the privacy of individuals in relation to personal data. When the PDPO was drafted, reference was made to the relevant requirements under the OECD Privacy Guidelines 1980 and the EU Directive. In consequence, the PDPO and the GDPR share a number of common features. Given that the GDPR constitutes significant developments, if not changes, of data protection law from the EU Directive, the new regulatory framework includes a number of requirements that are not found under the PDPO.
One of the key developments introduced under the GDPR to the data protection landscape outside the EU is the explicit requirement of compliance by organisations established in non-EU jurisdictions in specified circumstances. Given the diversified business or transaction models (e.g. online transactions), it is all the more important for businesses in Hong Kong to ascertain if the GDPR is applicable to them, and to keep up with the new developments.
To raise the awareness amongst organisations / businesses in Hong Kong of the possible impact of the new regulatory framework for data protection in the GDPR, the PCPD has issued the following publication:
European Union General Data Protection Regulation 2016
(Effective 25 May 2018)