Hong KongPersonal Data (Privacy) Ordinance, data protection principles 1 to 5
Personal Data (Privacy) Ordinance (Cap. 486), s. 4 and Schedule 1, principles 1-5
In force since .
A comprehensive regime rule binding public and private bodies.
- Private right of action
- Yes
- Enforcement body
- Privacy Commissioner for Personal Data
- Obligation class
- Consent, Disclosure, Retention, Security, Governance
As of .
What it requires
- Collect personal data only for a lawful purpose directly related to a function or activity of the data user, only where collection is necessary for or directly related to that purpose, and no more than is adequate and not excessive for it (Schedule 1, principle 1(1)).
- Collect personal data by lawful and fair means (Schedule 1, principle 1(2)).
- When collecting personal data from the person it concerns, take all practicable steps to tell them on or before collection whether supplying it is obligatory or voluntary, the consequences of not supplying it, the purpose of use and the classes of persons it may be transferred to, and on or before first use their access and correction rights and the name or job title and address of the person who handles requests (Schedule 1, principle 1(3)).
- Take all practicable steps to keep personal data accurate, to stop using or to erase data you have reasonable grounds to believe is inaccurate, and not to keep it longer than necessary, including by contract or other means with any data processor you engage (Schedule 1, principle 2).
- Do not use personal data for a new purpose without the data subject's prescribed consent (Schedule 1, principle 3(1)).
- Take all practicable steps to protect personal data against unauthorized or accidental access, processing, erasure, loss or use, including by contract or other means with any data processor you engage (Schedule 1, principle 4).
- Take all practicable steps to let a person ascertain your policies and practices on personal data, the kind of personal data you hold and the main purposes it is used for (Schedule 1, principle 5).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 4 bars a data user from doing an act or engaging in a practice that contravenes a data protection principle unless the Ordinance requires or permits it. Principle 1 limits collection of personal data to a lawful purpose directly related to a function or activity of the data user, requires the collection to be necessary or directly related and not excessive, and requires lawful and fair means.
Principle 2 requires practicable steps to keep personal data accurate and not to keep it longer than necessary, and principle 3 bars using it for a new purpose without the data subject's prescribed consent. Principle 4 requires practicable steps to protect personal data against unauthorized or accidental access, processing, erasure, loss or use, and principle 5 requires practicable steps to make a data user's policies and practices, the kinds of data held and their main purposes available.
A contravention of a data protection principle is not of itself an offence under section 64A; it is enforced through the Commissioner's enforcement notices and the compensation claim in section 66. Part 8 exempts some personal data from some principles, for example personal data an individual holds only for personal, family or household affairs or for recreation (section 52). The Ordinance binds the Government.
When LexLint raises it
When your app profile says your app processes personal data.