Hong Kong
Answer ... (a) Data processing
There is no statutory definition of ‘data processing’. The term is defined literally and refers to the processing or handling of data.
(b) Data processor
Natural or legal persons that process personal data on behalf of data users and not for their own purposes pursuant to Schedule 1, Principle 2(4) of the Personal Data (Privacy) Ordinance (PDPO).
(c) Data controller
There is no statutory definition of ‘data controller’. Its equivalent term under the PDPO is ‘data user’ which, in relation to personal data, means a person that, either alone, jointly or in common with other persons, controls the collection, holding, processing or use of data under Section 2 of the PDPO.
(d) Data subject
In relation to personal data, a ‘data subject’ is the individual who is the subject of the data under Section 2 of the PDPO.
(e) Personal data
Any data:
- relating directly or indirectly to a living individual;
- from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and
- in a form in which access to or processing of the data is practicable under Section 2 of the PDPO.
(f) Sensitive personal data
There is no statutory definition of ‘sensitive personal data’ (non-binding guidelines further detailed in question 5.3 below advocate that identity card numbers and biometric data be considered ‘sensitive’).
(g) Consent
Consent must be express and voluntary. The definition excludes any consent that has been withdrawn by written notice to the person to whom the consent was given, but includes acts done pursuant to the consent before the consent was revoked per Section 2 of the PDPO.
Hong Kong
Answer ... The main focus of the 2021 amendment to the PDPO is ‘doxxing’, defined in the PDPO as the disclosure of personal data of another person without consent, done recklessly or with intent to cause specified harm to the person or their family members. The scope and definition of ‘specified harm’ includes:
- harassment;
- molestation;
- pestering;
- threat;
- intimidation;
- bodily or psychological harm; and
- damage to property.