Table of Contents Table of Contents
Previous Page  190 / 192 Next Page
Show Menu
Previous Page 190 / 192 Next Page
Page Background

(a) a transfer of the business of property of, or any shares in, the data user;

(b) a change in the shareholdings of the data user; or

(c) an amalgamation of the data user with another body,

is exempt from the provisions of data protection principle 3 if each of the conditions

specified in subsection (2) is satisfied”.


The three conditions that must be satisfied in order for a data user to be able to rely on

the section 63B(1) exemption are stated in section 63B(2). They are:

(a) the personal data transferred or disclosed is not more than necessary for the purpose

of the due diligence exercise;

(b) the goods, facilities or services which are the same as or similar to those provided by

the data user to the data subject are to be provided to the data subject, on

completion of the proposed business transaction, by a party to the transaction or a

new body formed as a result of the transaction; and

(c) it is not practicable to obtain the prescribed consent of the data subject for the transfer

or disclosure.


In order to avail itself of the exemption, the data user must ensure that all of the above

conditions are satisfied. To curb against abuse, section 63B(3) provides that if the primary

purpose of the proposed business transaction is the transfer, disclosure or provision for

gain of the personal data itself, then the data user cannot rely on the exemption.


The term “provision for gain” is defined under subsection (6) which adopts essentially the

same definition under section 35A(2) of Part 6A of the Ordinance in relation to the new

direct marketing regulatory regime:

…means the provision of the data in return for money or other property, irrespective of

whether –

(a) the return is contingent on any condition; or

(b) the person who provides the data retains any control over the use of the data.


In order to safeguard the personal data used for the conduct of a due diligence

exercise, section 63B(4) imposes the following duty on the data transferee:

(a) it must only use the data for the purpose of due diligence;

(b) it must, as soon as practicable after the completion of the due diligence exercise –

(i) return the personal data to the data user; and

(ii) destroy any record of the personal data that is kept by the person.


A person who contravenes section 63B(4) commits an offence and is liable on

conviction to a fine at level five and to imprisonment for two years (section 63B(5)).

Section 63C— Emergency Situations