What Hong Kong can learn from the European Union to enable better data sharing in the Greater Bay Area

Policymakers in the Greater Bay Area should establish a closed-loop regional network within which the free movement of digital goods and services can be carefully monitored

Adam Au

Published: 6:45am, 20 Jan, 2021

Why you can trust SCMP

On December 24, many multinational companies in Britain breathed a collective sigh of relief after a deal was struck with the European Union to extend a grace period to permit the free flow of data between the two regions. The saga highlights the urgency of including data transfers in all national and regional trade treaties.

In Hong Kong, the discussion on sharing data for the greater good is finally gaining momentum. In fact, the groundwork may have been laid by the pandemic. Driven by social distancing, Hongkongers are warming to the idea of sharing their data virtually in the name of convenience.

Further, with the clock ticking on Greater Bay Area integration, Hong Kong is under pressure to upgrade its data governance framework to fit in with China’s overall expansive digital strategy. Thus, a preference for controlled data exchange with our innovative neighbours might finally come of age.

Cross-border data flows need not be unfettered. Instead of choosing either extreme – an isolated data island or unconstrained data flows – policymakers in the Greater Bay Area should establish a closed-loop regional network within which the free movement of digital goods and services can be carefully monitored.

To implement this, data protection standards across regions must be rooted in the basic tenet of privacy protection reciprocity. Data owners must be assured that their information is protected by a privacy and security management system or other appropriate safeguard no less stringent than those outlined by their own laws. The flow of extremely sensitive data within the region must be strictly controlled.

02:35

China's ambitious plan to develop it own ‘Greater Bay Area’

Cross-border law enforcement must also be normalised. Chinese regulators should be encouraged to develop bilateral regional agreements, and other binding principles and accreditation frameworks that support a fast-track exemption route for Greater Bay Area companies that serve customers across regions.

Lately, there has been an objective need for countries to grant local courts the ability to exercise jurisdiction over foreign defendants. For example, China’s Personal Information Protection Law (Draft) gives the court extraterritorial power to regulate cross-border processing of Chinese nationals’ information for the purpose of providing products or services to them.

In contrast, there are currently no restrictions on the transfer of personal data outside Hong Kong under Hong Kong’s Personal Data (Privacy) Ordinance. Any attempt to establish a two-way economic network will fail if we do not account for extraterritorial protections.

Perhaps it is too early to adopt an all-encompassing law that applies to all three distinct legal systems in the Greater Bay Area. To rectify this constraint, similar to the function of the European Data Protection Board, the Greater Bay Area could establish an independent data protection authority that contributes to the application of agreed data protection principles across the region and promotes cooperation.

Passengers arrive at Lo Wu MTR station in Hong Kong from Shenzhen on February 3, 2020. Data owners must be assured that their data is protected by a privacy and security management system or other appropriate safeguard no less stringent than those outlined by the laws in their own jurisdictions. Photo: AFP

Looking forward, the need to reduce legal fragmentation between various highly integrated economies only adds to the case for each region to harmonise new privacy laws.

China is home to more than 700 million internet users. As its tech companies go global, access to more diverse data sets through international hubs such as Hong Kong can make them more competitive.

The liberation of data flows would also boost Hong Kong’s struggling economy. In the face of increasing digitisation of the economy, relaxing the rules on data sharing would help Hong Kong companies understand when and where innovation is needed.

New beginnings: how Hong Kong can reboot its economy

Data exchanges are often structured so that the benefits of disclosure are instant and tangible, while the costs are delayed and even amorphous. As many recent scandals have shown, the consequences of privacy leaks can be long-lasting reputational and economic damage. But if data movements are marshalled properly, the resulting benefits can outweigh the risks.

More data flowing across borders can lead to better innovation, which in return would raise public receptiveness and generate more data that further improves innovation and enables smoother economic integration. The key is to forestall any privacy vulnerabilities early on.

With a treasure trove of useful data up for grabs, it is in China, not the West, that the future of a true digital economy is being staked out.

Adam Au is the head of legal at a Hong Kong-based health care group