Processes personal data, in Hong Kong

Control of Exemption Clauses Ordinance (Cap. 71), ss. 7-8, 10-11 · Read the law's page

• Do not rely on a contract term or a notice to exclude or restrict your liability for death or personal injury resulting from negligence; such a term or notice has no effect (s. 7(1)).
• A term or notice that excludes or restricts your liability for other loss or damage resulting from negligence is effective only in so far as it satisfies the requirement of reasonableness, and a person's agreement to or awareness of it is not of itself voluntary acceptance of the risk (s. 7(2), (3)).
• Where the other party deals as consumer or on your written standard terms of business, a term that excludes or restricts your liability for your own breach, or that lets you perform differently from what was reasonably expected or not at all, is effective only in so far as it satisfies the requirement of reasonableness (s. 8).
• Do not use a term or notice in a guarantee of consumer goods to exclude or restrict liability for loss or damage from a defect that results from the negligence of a person concerned in the manufacture or distribution of the goods (s. 10(1)).
• Against a person dealing as consumer, you cannot exclude or restrict liability for breach of the seller's undertakings as to description, sample, quality or fitness for purpose under sections 15 to 17 of the Sale of Goods Ordinance (s. 11(2)).
• Against a business buyer, an exclusion of the sections 15 to 17 undertakings is effective only in so far as it satisfies the requirement of reasonableness (s. 11(3)).
• Sections 7 and 8 do not apply to a contract so far as it relates to the creation or transfer of a right or interest in a copyright, patent, trade mark, registered design, technical or commercial information or other intellectual property (Sch. 1, s. 1(c)).
• These limits bind only business liability, meaning liability for breach of obligations or duties arising from things done or omitted in the course of a business (s. 2(2)).

Personal Data (Privacy) Ordinance (Cap. 486), Schedule 1, principles 1 and 3 · Read the law's page

• Collect personal data, from any source, only for a lawful purpose directly related to your function or activity, only where necessary for or directly related to that purpose, and no more than is adequate and not excessive (Schedule 1, principle 1(1)).
• Collect personal data by lawful and fair means (Schedule 1, principle 1(2)).
• Do not use personal data for a new purpose, one other than the purpose at collection or a directly related one, without the data subject's prescribed consent (Schedule 1, principle 3).

Personal Data (Privacy) Ordinance (Cap. 486), s. 4 and Schedule 1, principles 1-5 · Read the law's page

• Collect personal data only for a lawful purpose directly related to a function or activity of the data user, only where collection is necessary for or directly related to that purpose, and no more than is adequate and not excessive for it (Schedule 1, principle 1(1)).
• Collect personal data by lawful and fair means (Schedule 1, principle 1(2)).
• When collecting personal data from the person it concerns, take all practicable steps to tell them on or before collection whether supplying it is obligatory or voluntary, the consequences of not supplying it, the purpose of use and the classes of persons it may be transferred to, and on or before first use their access and correction rights and the name or job title and address of the person who handles requests (Schedule 1, principle 1(3)).
• Take all practicable steps to keep personal data accurate, to stop using or to erase data you have reasonable grounds to believe is inaccurate, and not to keep it longer than necessary, including by contract or other means with any data processor you engage (Schedule 1, principle 2).
• Do not use personal data for a new purpose without the data subject's prescribed consent (Schedule 1, principle 3(1)).
• Take all practicable steps to protect personal data against unauthorized or accidental access, processing, erasure, loss or use, including by contract or other means with any data processor you engage (Schedule 1, principle 4).
• Take all practicable steps to let a person ascertain your policies and practices on personal data, the kind of personal data you hold and the main purposes it is used for (Schedule 1, principle 5).

Personal Data (Privacy) Ordinance (Cap. 486), ss. 18-19, 22-23, 26-27 and Schedule 1, principle 6 · Read the law's page

• Tell a person in writing within 40 days after receiving their data access request whether you hold their personal data, and supply a copy if you do (section 19(1)).
• If you cannot answer a data access request within 40 days, tell the requestor in writing before the period ends and answer as far as you can (section 19(2)).
• Within 40 days after receiving a data correction request, correct data you are satisfied is inaccurate, supply the requestor with the corrected data, and send it with your reasons to any third party you disclosed it to in the previous 12 months; or give reasons if you refuse, and let the requestor object to a refusal (sections 22-25 and Schedule 1, principle 6).
• Take all practicable steps to erase personal data you no longer need for the purpose it was used for, unless a law prohibits erasure or keeping it is in the public interest (section 26(1)).
• Keep a log book in Chinese or English of the reasons for refusing access or correction requests, and do not erase an entry for at least 4 years unless regulations prescribe another period (section 27).

Personal Data (Privacy) Ordinance (Cap. 486), ss. 50, 50A and 66 · Read the law's page

• Take the steps an enforcement notice specifies to remedy a contravention of the Ordinance by the date it specifies (sections 50 and 50A).
• Expect a claim for compensation, including for injury to feelings, from an individual who suffers damage from your contravention of a requirement of the Ordinance relating to their personal data (section 66).

Personal Data (Privacy) Ordinance (Cap. 486), Part 6A, ss. 35C-35L · Read the law's page

• Before using a person's personal data in direct marketing, tell them you intend to, that you may not unless they consent, the kinds of personal data and classes of marketing subjects, and give them a free channel to consent (section 35C).
• Do not use personal data in direct marketing without the data subject's consent, and confirm an oral consent in writing within 14 days (section 35E).
• Tell a data subject, when first using their personal data in direct marketing, that you must stop free of charge if they ask, and stop when they require it (sections 35F and 35G).
• Do not provide personal data to another person for use in direct marketing without the data subject's written consent, after giving the written information section 35J requires (sections 35J and 35K).
• Stop providing a data subject's personal data to others for direct marketing, and notify recipients in writing to stop using it, when the data subject requires it (section 35L).

Personal Data (Privacy) Ordinance (Cap. 486), s. 64 · Read the law's page

• Do not disclose a person's personal data without their relevant consent with an intent to cause them or a family member specified harm, or being reckless as to whether it would (section 64(3A)).
• Do not disclose personal data obtained from a data user without that data user's consent with an intent to obtain gain or to cause the data subject loss (section 64(1)).

Personal Data (Privacy) Ordinance (Cap. 486), s. 33 · Read the law's page

• Do not transfer personal data to a place outside Hong Kong unless the place is specified in a Gazette notice, you have reasonable grounds to believe a substantially similar law is in force there, the data subject consented in writing, or another condition in section 33(2) applies (section 33(2)).