The Six Steps in a Data Transfer Process

Data science is a fast-growing field with many career opportunities. Unlike traditional IT roles, which are more focused on specific business functions like marketing or finance, data scientists can work across a wide range of industries and job types. In Hong Kong, there is an increasing demand for data scientists who can help companies make sense of big data and turn it into actionable insights. If you are interested in becoming a data scientist, it is worth considering attending a professional development course to gain the necessary skills.

Padraig Walsh, partner in the Data Privacy practice group at Tanner De Witt, explains that a key element of understanding data transfer in Hong Kong is interpreting and applying the first principles – that is, the basic interpretation of what constitutes personal data, and what the obligations of the data user are in relation to collecting, holding, processing or using it. This article discusses the six steps in a data transfer process, but it is important to remember that these are just guidelines and will be interpreted differently in different jurisdictions.

The first step in a data transfer process is to verify the lawful basis for the proposed personal data transfer. In Hong Kong, this is achieved through reviewing the PICS and determining whether it provides sufficient information about the purposes for which the personal data may be collected or transferred. If this is not the case, then the data user must obtain the voluntary and express consent of the data subject.

It is also important to determine whether the personal data is actually being transferred, particularly since a lot of countries have different definitions for what constitutes “personal data.” For example, a photograph of a crowd at a concert may not be considered personal data in Hong Kong, provided that it does not identify any individuals. Similar examples include CCTV recordings, logs of persons entering car parks, and records of meetings that do not identify individual speakers or participants.

If it is determined that the personal data being transferred does not meet the standards set out in the PDPO, then the data exporter should identify and adopt supplementary measures to bring the level of protection up to Hong Kong standards. This could include technical measures such as encryption, anonymisation or pseudonymisation, and contractual measures such as a requirement to provide a level of protection comparable to that of the PDPO.

While Hong Kong still has a way to go before it becomes an established centre for data science, the job market is growing rapidly and demand far exceeds supply. If you are looking to pursue a challenging and rewarding career, now is the time to invest in your future. Contact us to arrange a complimentary 1-on-1 Career Consultation today.