(O11) (Live Presentation and Webinar) Data Privacy

• Instructor: admin

Date:  31 October 2023 (Saturday)  Time: 9:30am-12:45pm   Language: English  Level: Elementary

Speaker:          Dr. Rita Cheung, MCAL Solicitors LLP

Lawyer CPD / ACCA CPD / SFC CPT / Insurers’ CPD Pts: 3     Fee: HK$1,790

Highlight :

1. Data Protection Principle 1 (Collection)

• What is personal data ‘collection’? Eastweek Publisher Limited v Privacy Commissioner for Personal Data [2000] HKCA 442, [2000] 2 HKLRD 83. Would installation of CCTV next to your flat amount to personal data ‘collection’? The point was tested in 張順清 v 個人資料私隱專員 (Appeal No. 7/2019) [2019] HKPCPDAAB 7.
• What amounts to an ‘excessive’, unfair or unlawful data collection? Cathay Pacific Airways Limited v Administrative Appeals Board [2008] 5 HKLRD 539

2. Data Protection Principle 2 (Accuracy)

• What is the content of the duty on a data user to ensure that the data is ‘accurate’ (subsection 1), and is not kept longer than is necessary (subsection 2)?
• How far will Data Protection Principle 2 (on retention of personal data), reading alongside with section 26 (on erasure of personal data), be interpreted as equivalent to a EU-style ‘right to be forgotten’?
• Whether Hong Kong has a right-to-be-forgotten has been a matter of uncertainty. X v Privacy Commissioner for Personal Data (Appeal No. 15/2019) [2019] HKPCPDAAB 15 has exploded the myth.

3. Data Protection Principle 3 (Use)

• What amounts to using (transferring or disclosing) personal data ‘for a new purpose’ without a data subject’s consent? David M Webb v Privacy Commissioner for Personal Data [2014] HKPCPDAAB 54
• Y v The Law Society of Hong Kong [2017] HKCFI 735, [2017] 2 HKLRD 950.
• The ‘crime prevention and detection’ exemption; ‘public interest’ exemption

4. Data Protection Principle 4 (Security)

• Loss of Notebook Computers Containing Personal Data of Election Committee Members and Electors [2017] HKPCPDIR 1 case as an illustration.

5. Data Protection Principle 6 (Access).

• How to make a data access request on behalf of your client?

6. EU General Data Protection Regulation (GDPR).

• Relevance to Hong Kong companies which offer goods or services to, or ‘monitor the behavior’ of, data subjects situated in the EU (GDPR, Article 3).