HK’s role in cross-border data flow limited, lawyers say
Beijing has relaxed its requirements for businesses sending data outside the mainland in finalised rules, but Hong Kong’s role in the new regime remains limited, according to legal experts.
Hong Kong, which envisions itself as a regional data and innovation hub, did not play a major role in the mainland’s cross-border data flow even under the relaxed rules, said Gordon Milner, a partner at law firm Morrison & Foerster.
In a highly anticipated move, China’s internet watchdog last month issued final rules for companies exporting data. The Provisions on Facilitating and Regulating Cross-Border Data Flows exempted a range of cases where compliance measures were put in place previously, including some data transfers involving shopping, shipping, flight and hotel bookings, and employee information.
The relaxed rules, issued at a time when Beijing is moving to boost confidence in its private sector, were widely welcomed by business communities.
But a host of stringent requirements remain, including a security assessment for critical information infrastructure operators and for cases involving important data or a sizeable amount of personal information.
Although observers had warned such rules would damage Hong Kong’s status as a gateway to the mainland, the finalised rules did not grant the city any special treatment.
“Hong Kong is part of China, but under the ‘one country, two systems’ arrangement, it has its own separate legal jurisdiction, and it has its own privacy laws,” Milner said.
That was why transfers of personal information from the mainland to Hong Kong had been considered “data exports” for the purposes of China’s privacy laws, he added.
Companies looking to export data from the mainland to Hong Kong would need to go through the same compliance steps required for sending data elsewhere in the world, and the new provisions “don’t change that”, Milner said.
Hong Kong has made efforts to ease data flow within the Greater Bay Area, Beijing’s scheme aimed to integrate Hong Kong, Macau and nine cities in Guangdong province into an economic powerhouse.
That includes a pilot scheme for firms in the banking, credit referencing and healthcare sectors that allows enterprises to use a special contract to send data within the bay area instead of complying with other nationwide requirements.
But the biggest limitation of that scheme is it does not allow data to be transferred beyond the bay area. The current form of the standard bay area data flow contract could only be leveraged “to the extent that data flows are within the [economic bloc]”, said Alex Roberts, partner and head of China technology, media and telecommunications at Linklaters in Shanghai.
Milner said that for businesses operating within the bay area, “this may be worth looking at to reduce your red tape”.
However, “if your footprint is wider than that, it’s not going to be much help because under the [bay area] arrangements, you can’t further subsequently export personal information to the general area”, he added.
It remains to be seen how much of an incentive the bay area data scheme will be to multinational firms that have a “significant operational need to transfer data to territories other than the [bay area] and Hong Kong”, according to Roberts.