Data hk is a collection of information about an individual and/or organisation that is processed for the purpose of providing data products or services. It includes both information about an individual’s identity, and their personal and business activities, such as purchasing behaviour. Data hk also covers information that is collected and processed by organisations for marketing purposes. This can include details such as name, address, email and phone number. Direct marketing practices are a major area of investigation and prosecution for the Privacy Commissioner, although it is expected that this will become a lower priority area of enforcement in future.
Businesses that have control over the collection, processing and use of personal data should ensure that the data complies with all relevant aspects of the PDPO. This applies even if the data is processed outside Hong Kong. Moreover, the data user can be held liable for its agents or contractors’ breaches of PDPO obligations.
A mooted change to the definition of “personal data” would broaden the scope and increase compliance measures for businesses. However, until this happens, businesses should take a thorough look at their existing obligations. This is particularly the case for businesses using technologies that learn about individuals’ behaviours or processes information which may impact them personally.
