(O11) (Live Presentation and Webinar) Data Privacy

Date:  31 October 2023 (Saturday)  Time: 9:30am-12:45pm   Language: English  Level: Elementary

Speaker:          Dr. Rita Cheung, MCAL Solicitors LLP

Lawyer CPD / ACCA CPD / SFC CPT / Insurers’ CPD Pts: 3     Fee: HK$1,790

Highlight :

  1. Data Protection Principle 1 (Collection)
  • What is personal data ‘collection’? Eastweek Publisher Limited v Privacy Commissioner for Personal Data [2000] HKCA 442, [2000] 2 HKLRD 83. Would installation of CCTV next to your flat amount to personal data ‘collection’? The point was tested in 張順清 v 個人資料私隱專員 (Appeal No. 7/2019) [2019] HKPCPDAAB 7.
  • What amounts to an ‘excessive’, unfair or unlawful data collection? Cathay Pacific Airways Limited v Administrative Appeals Board [2008] 5 HKLRD 539
  1. Data Protection Principle 2 (Accuracy)
  • What is the content of the duty on a data user to ensure that the data is ‘accurate’ (subsection 1), and is not kept longer than is necessary (subsection 2)?
  • How far will Data Protection Principle 2 (on retention of personal data), reading alongside with section 26 (on erasure of personal data), be interpreted as equivalent to a EU-style ‘right to be forgotten’?
  • Whether Hong Kong has a right-to-be-forgotten has been a matter of uncertainty. X v Privacy Commissioner for Personal Data (Appeal No. 15/2019) [2019] HKPCPDAAB 15 has exploded the myth.
  1. Data Protection Principle 3 (Use)
  • What amounts to using (transferring or disclosing) personal data ‘for a new purpose’ without a data subject’s consent? David M Webb v Privacy Commissioner for Personal Data [2014] HKPCPDAAB 54
  • Y v The Law Society of Hong Kong [2017] HKCFI 735, [2017] 2 HKLRD 950.
  • The ‘crime prevention and detection’ exemption; ‘public interest’ exemption
  1. Data Protection Principle 4 (Security)
  • Loss of Notebook Computers Containing Personal Data of Election Committee Members and Electors [2017] HKPCPDIR 1 case as an illustration.
  1. Data Protection Principle 6 (Access).
  • How to make a data access request on behalf of your client?
  1. EU General Data Protection Regulation (GDPR).
  • Relevance to Hong Kong companies which offer goods or services to, or ‘monitor the behavior’ of, data subjects situated in the EU (GDPR, Article 3).
Curriculum is empty