Other BriefingsEU Data Processing Law May Affect Hong Kong from May 2018: Are You Ready?
Op/Ed by Michael Mudd, Managing Partner, Asia Policy Partners LLC
The EU – via the EU Commission – has enacted two key regulations relating to data processing: the General Data Protection Regulation (GDPR) and the Network and Information Security Directive (NISD). While both came into force in April 2016, they will not apply until May 25, 2018.
When the GDPR comes into full force, any company based in Hong Kong, or anywhere else for that matter, will need to have governance policies in place if they solicit or target, collect, store or process any data on a citizen of the EU. Despite the ‘Brexit’ filing, this also means UK citizens for the foreseeable future.
A recent survey by the UK Chartered Institute of Marketing indicated that only five percent of marketers say they wholly understand what the GDPR means for their business.
Half say they don’t know anything about it at all and a surprising 16 percent do not think GDPR is relevant to them. Heavy fines await businesses that are not compliant – fines for breaking the regulations are capped at US$23.3 million or four percent of global turnover, whichever is higher.
RELATED: China’s New Cybersecurity Law: Clarifications, Implementation Delay Announced
Precedent for GDPR enforcement
A couple of recent examples indicate that even before the GDPR comes into force, individual Privacy Commissioners are enforcing their own laws more vigorously. The UK Information Commissioners Office has fined UK-based airline Flybe and Honda Motor Europe a total of US $107,800 for misuse of customer data.
Flybe was fined US$91,800 for simply sending an email to three million customers asking if the details on their records were correct. Honda was fined US$17,000 for sending nearly 300,000 emails about customer preferences. Both were viewed as unsolicited marketing, and therefore broke the law.
On February 2, 2017, the Italian Commissioner accused a company of misusing data they controlled in a financial scheme that involved both Hong Kong and China. The company allegedly made money transfers on behalf of individuals without their knowledge or consent to avoid money laundering laws.
This resulted in a fine of over US$6 million, comprising over US$10,000 for each offense, multiplied by the 583 victims, plus a further US$58,000 fine – a record fine for a UK company operating in Italy. This is the largest data privacy fine ever issued by a European data protection authority for a breach of the EU’s data protection framework.
What does this mean for companies in Hong Kong?
What does this mean for the board of a listed company in Hong Kong? If they have a branch office in Europe, quite a lot.
If a company actively solicits, via email targeting or a website that is in a European language, they may be subject to the regulation, which would require compliance as they are deemed to be a ‘data controller’. As well as ensuring data they gather on individuals meets the purpose of processing, businesses must also ensure that they document the legal basis of processing (such as the use), that the processing is “necessary” for the performance of a contract, or that the purposes reflect the legitimate interests of the data controller or a third party.
The GDPR also has provision for data portability: an EU citizen or resident may request the return of all data held, or direct the entity holding the data to move it to another entity.
The EU law will mandate that many large organizations appoint a Data Protection Officer (DPO) to have an overall view of where data is located and set controlled parameters on who has access to it. The DPO will have to work with chief information security officers IT departments to monitor and control data movement across the company and its use. Data may be located at different locations – and countries – within the organization with no central control, so this will give challenges to bring all into line.
Organizations addressing the GDPR and other regulations must first take steps to re-architect their data provisioning to have any chance of compliance. Like the UK, this has not been recognized as a matter of urgency yet in Hong Kong, or the wider region, and there are now under eight months left to get the controls in place to avoid the severe penalties.
Information Technology Solutions from Dezan Shira & Associates
Data management policies need reform before May 2018
Hong Kong has one of the strongest personal privacy regimes in Asia, and globally. Its regime is fairly close to the GDPR in a number of key regulations, but not all: the PC is examining this with a view of achieving equivalency.
However, a board has a fiduciary duty and needs to ensure that shareholders are protected, no matter where data is stored or processed, and that includes when using an outsourced service, including Cloud computing services. Moreover, the data controller cannot outsource their responsibility.
Hong Kong companies therefore need to put in place data management policies that will protect data that is held on EU citizens or face prosecution. The technology industry is creating innovations to address compliance with the GDPR and other regulations under the general description of ‘RegTech’.
The boards of Hong Kong companies need to be aware of this and take action sooner rather than later to protect their shareholders (and themselves) before they get a letter from an EU privacy commissioner after May 2018.
Editor’s note: This article first appeared in Computerworld Hong Kong and may be viewed here. This article has been updated to reflect the latest developments.
|
|
Dezan Shira & Associates Brochure
Dezan Shira & Associates is a pan-Asia, multi-disciplinary professional services firm, providing legal, tax and operational advisory to international corporate investors. Operational throughout China, ASEAN and India, our mission is to guide foreign companies through Asia’s complex regulatory environment and assist them with all aspects of establishing, maintaining and growing their business operations in the region. This brochure provides an overview of the services and expertise Dezan Shira & Associates can provide.
An Introduction to Doing Business in China 2017
This Dezan Shira & Associates 2017 China guide provides a comprehensive background and details of all aspects of setting up and operating an American business in China, including due diligence and compliance issues, IP protection, corporate establishment options, calculating tax liabilities, as well as discussing on-going operational issues such as managing bookkeeping, accounts, banking, HR, Payroll, annual license renewals, audit, FCPA compliance and consolidation with US standards and Head Office reporting.
In this issue of China Briefing magazine, we provide foreign investors with best practices for implementing internal controls in China. We explain what makes China’s internal control environment distinct, and why China-based operations need to prioritize internal control. We then outline how to execute an internal control review to gauge organizational resiliency and identify gaps in control points, and introduce practical internal controls for day-to-day operations. Finally, we explore why ERP systems are becoming increasingly integral to companies’ internal control regimes.
- Previous Article Bitcoin Market Unfazed by China Ban
- Next Article A Complete Guide to 2017 Minimum Wage Levels Across China
