Tony Lam, deputy commissioner for personal data in Hong Kong
Transcripts:
I am the deputy commissioner for personal data in Hong Kong. The Office of the Privacy Commissioner for Personal Data is responsible for supervising and regulating the implementation of the personal data privacy ordinance in Hong Kong. Apart from the rule of being an enforcer or regulator, we are an educator and facilitator at the same time.
What are the challenges or some of the trends that the Hong Kong privacy regime see?
Our Personal Data Privacy Ordinance came into effect in 1996 and it was the first dedicated personal data privacy protection law in Asia. We modeled it from the OECD privacy guidelines in 1980 and the EU privacy directive in 1995. So, our regime basically reflects a lot of the data protection principles, such as data minimization, use specification, purpose limitation.
The way that businesses are being conducted now have been very different from what it was 25 years ago. For instance, we have big data, AI, automated decision making, etc. So, we will have to see how our laws should be reviewed or adapted in order to cater for the latest situation. And there were several major data breach cases in Hong Kong last year and we are reviewing the law to make recommendations to the government soon on how the law should be revised.
I am implementing a mandatory data breach notification system and some people have criticized that the current privacy law has inadequate deterrent effect. So we are seeing whether or not we should institute a mechanism of imposing administrative fines. There are also other areas which we are going to review, including the role of the data processor. Currently, under the law, data processor is only indirectly regulated through the data users. Whether or not we should impose a direct legal obligations on data processor in terms of the responsibility for retention and security. These are the sort of things which we are examining.
Now, we are already in the data driven economy, and in a data driven economy, data is money. So I think everyone of us knows how important it is to keep money safe and how to spend wisely. So treat personal data as your money, and put up a full system to protect it right at the beginning from the point of collection, use, transfer and disposal.
The Association of Corporate Counsel (ACC) hosted its inaugural APAC Meeting at the Island Shangri-la, Hong Kong, on 11 April. More than 240 in-house counsel delegates attended from locations across the Asia-Pacific region including Hong Kong, China, South Korea, Japan, Australia, Singapore, Thailand, India and the Philippines. Read our coverage here
