Groundbreaking amendments have been proposed to Hong Kong's existing data protection laws.
- The introduction of mandatory breach notification
- New powers for the privacy commission to impose administrative fines for contraventions
- Increased transparency requirements in relation to data retention, where the period of retention for specific data types need to be disclosed
- Direct regulation of data processors, which would now be subject to obligations on the retention and security of personal data, and notification of breaches without undue delay
- Clarification of the definition of personal data, which would be expanded to include information relating to an identifiable person
- New doxxing laws, with powers for the commission to compel the removal of doxxing contents from platforms or websites, and carry out criminal investigation and prosecution.
Webinar - Working Out for the New Data Ecosystem and Legal Frameworks, by the Office of the Privacy Commissioner for Personal Data