Beijing has relaxed its requirements for businesses sending data outside mainland China in finalized rules, but Hong Kong’s role in the new regime remains limited, according to legal experts. Hong Kong, which envisions itself as a regional data and innovation hub, does not play a major role in China’s cross-border data flow even under the newly relaxed rules, Gordon Milner, a partner at law firm Morrison & Foerster, said in an online briefing on Tuesday. The relaxed rules, issued at a time when China is moving to boost confidence in its private sector, were widely welcomed by business communities. But a host of stringent requirements remain, including a security assessment for critical information infrastructure operators, and for cases involving important data or a sizeable amount of personal information. “Hong Kong is part of China, but under the One Country, Two Systems arrangement, it has its own separate legal jurisdiction, and it has its own privacy laws,” Milner said. That is why transfers of personal information from the mainland to Hong Kong have been considered “data exports” for the purposes of China’s privacy laws, he added. Firms looking to export data from the mainland to Hong Kong will need to go through the same compliance steps required for sending data elsewhere in the world, and the new provisions “don’t change that”, Milner said. That includes a pilot scheme for firms in the banking, credit referencing, and healthcare sectors that allows enterprises to use a special contract to send data within the GBA, instead of complying with other nationwide requirements. But the biggest limitation of that scheme is that it does not allow data to be transferred beyond the GBA. The current form of the standard GBA data flow contract can only be leveraged “to the extent that data flows are within the GBA region”, said Alex Roberts, partner and head of China Technology, Media, and Telecommunications at Linklaters in Shanghai. Milner said that for businesses operating within the GBA, “this may be worth looking at to reduce your red tape”. However, “if your footprint is wider than that, it’s not really going to be much help because under the GBA arrangements, you can’t further subsequently export personal information out to the general area”, he added. It remains to be seen how much of an incentive the GBA data scheme will be to multinational corporations that have a “significant operational need to transfer data to territories other than the GBA and Hong Kong SAR”, according to Roberts. Still, as the scheme expands to cover more sectors, it could renew demand for data centers, and spur data-related industries such as artificial intelligence, cloud computing, and data analytics that feed on data flows within the GBA regions, Roberts said. That could in turn boost Hong Kong’s digital economy, he added.
Beijing Eases Cross-Border Data Transfer Rules, but Hong Kong’s Role Remains Limited
