EU General Data Protection Regulation

European Union (EU) - General Data Protection Regulation (GDPR)

The EU General Data Protection Regulation (GDPR), adopted in 2016, came into force on 25 May 2018, replacing the EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (EU Directive). The GDPR involves new provisions and enhanced rights. In the wake of technological developments and globalisation and the constitutionalisation of the fundamental right to data protection in the EU, the GDPR aims to harmonise the framework for the digital single market, put individuals in control of their data and formulate a modern data protection governance.

Why is the GDPR relevant to Hong Kong organisations/ businesses?

In Hong Kong, the Personal Data (Privacy) Ordinance, Cap 486 of the Laws of Hong Kong (PDPO) protects the privacy of individuals in relation to personal data. When the PDPO was drafted, reference was made to the relevant requirements under the OECD Privacy Guidelines 1980 and the EU Directive. Given that the GDPR constitutes significant developments of data protection law from the EU Directive, the new regulatory framework includes a number of requirements that are not found under the PDPO.

One of the key developments introduced under the GDPR to the data protection landscape outside the EU is the explicit requirement of compliance by organisations established in non-EU jurisdictions in specified circumstances. Given the diversified business or transaction models (e.g. online transactions), it is all the more important for businesses in Hong Kong to ascertain if the GDPR is applicable to them, and to keep up with the new developments.

Publication on the GDPR

To raise the awareness amongst organisations / businesses in Hong Kong of the possible impact of the new regulatory framework for data protection in the GDPR, the PCPD has issued the following publication:

Booklet:  An Update on European Union General Data Protection Regulation 2016 (May 2020 Revised Edition)

Guidance issued by other authorities

• European Data Protection Board
  • Guidelines on consent
  • Guidelines on personal data breach notification
  • Guidelines on automated individual decision-making and profiling
  • Guidelines on processing of personal data through video devices
  • Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
  • Guidelines 2/2018 on derogations of Article 49 under the GDPR (exemptions for cross-border transfer of personal data)
  • Guidelines on transparency
• European Commission
  • Overview of the data protection regime in the EU
  • Introduction to the requirements of the GDPR
• Information Commissioner's Office, United Kingdom
  • What is personal data?
  • Lawful basis for processing of personal data
  • Individual rights
  • Accountability and governance
  • Security of personal data

More Information on the GDPR

• Hong Kong Lawyer (June 2018 issue) - EU GDPR and HK PDPO: What's the Difference?
• PCPD's Media Statement (3 April 2018) - How Hong Kong Businesses Should Prepare for the EU General Data Protection