Hong KongPersonal Data (Privacy) Ordinance, collection and use of personal data gathered from other sources
Personal Data (Privacy) Ordinance (Cap. 486), Schedule 1, principles 1 and 3
In force since .
A personal data rule binding public and private bodies.
- Obligation class
- Consent, Prohibition
As of .
What it requires
- Collect personal data, from any source, only for a lawful purpose directly related to your function or activity, only where necessary for or directly related to that purpose, and no more than is adequate and not excessive (Schedule 1, principle 1(1)).
- Collect personal data by lawful and fair means (Schedule 1, principle 1(2)).
- Do not use personal data for a new purpose, one other than the purpose at collection or a directly related one, without the data subject's prescribed consent (Schedule 1, principle 3).
These lines are LexLint's reading of the law's text, as of .
What this law does
Principle 1 provides that personal data shall not be collected unless it is collected for a lawful purpose directly related to a function or activity of the data user, the collection is necessary for or directly related to that purpose, and the data is adequate but not excessive. Principle 1(2) requires collection by means that are lawful and fair in the circumstances. The notice duties in principle 1(3) apply where the person from whom personal data is or is to be collected is the data subject.
Principle 3 provides that personal data shall not, without the prescribed consent of the data subject, be used for a new purpose, meaning any purpose other than the purpose for which the data was to be used at the time of collection or a directly related purpose.
When LexLint raises it
When your app profile says your app processes personal data, crawls the web or trains models.