When will the Hong Kong data protection law get its facelift? An update on the proposed amendments to the Personal Data (Privacy) Ordinance

6 PROPOSED AMENDMENTS TO THE PDPO

(1) Mandatory data breach notification

Mandatory data breach notification will be introduced: the proposed threshold is if the breaches may have “a real risk of significant harm” and notification must be completed within a specified timeframe (e.g. as soon as practicable but not more than 5 business days).

(2) Data retention period

Express requirement on data users to specifically set out the retention periods for separate categories of personal data so that data subjects are clearly informed of the details of the retention policy.

(3) Sanctioning powers

To broaden the Privacy Commissioner’s power by enabling administrative fines (linked to the annual turnover of the data user concerned) to be directly imposed based on breaches of the requirements under the PDPO.

(4) Regulation of data processors

To directly regulate data processors under the PDPO e.g. in relation to data retention and security requirements, or notification requirements to the Privacy Commissioner. 

(5) Definition of personal data

To widen the definition to include “identifiable” person instead, given the current wide use of tracking and data analytics technology.

(6) Doxxing regulations

To introduce, among others, doxxing specific provisions and to empower the Privacy Commissioner to request the removal of doxxing contents from social media platforms or websites and to carry out investigations and prosecutions.