Hong Kong’s role in China’s cross-border data flow regime ‘limited’ despite relaxed rules, lawyers say

Hong Kong does not play a major role in China’s cross-border data flow even under the newly relaxed rules, said Gordon Milner, a partner at law firm Morrison & Foerster
Firms looking to export data from the mainland to Hong Kong will need to go through the same compliance steps required for sending data elsewhere in the world

Greater Bay Area

Xinmei Shen

Published: 8:00am, 25 Apr 2024

Why you can trust SCMP

Beijing has relaxed its requirements for businesses sending data outside mainland China in finalised rules, but Hong Kong’s role in the new regime remains limited, according to legal experts.

Hong Kong, which envisions itself as a regional data and innovation hub, does not play a major role in China’s cross-border data flow even under the newly relaxed rules, Gordon Milner, a partner at law firm Morrison & Foerster, said in an online briefing on Tuesday.

In a highly anticipated move, China’s internet watchdog last month issued final rules for companies exporting data. The Provisions on Facilitating and Regulating Cross-Border Data Flows rules exempted a range of cases that were previously proposed to require compliance measures, including some data transfers involving shopping, shipping, flight and hotel bookings and employee information.

The relaxed rules, issued at a time when China is moving to boost confidence in its private sector, were widely welcomed by business communities. But a host of stringent requirements remain, including a security assessment for critical information infrastructure operators, and for cases involving important data or a sizeable amount of personal information.

Guangdong unveils data transfer plans in bid to build GBA AI hub

Although observers had warned that such rules would damage Hong Kong’s status as a gateway to mainland China, the finalised rules did not grant the city any special treatment.

“Hong Kong is part of China, but under the One Country, Two Systems arrangement, it has its own separate legal jurisdiction, and it has its own privacy laws,” Milner said. That is why transfers of personal information from the mainland to Hong Kong have been considered “data exports” for the purposes of China’s privacy laws, he added.

Firms looking to export data from the mainland to Hong Kong will need to go through the same compliance steps required for sending data elsewhere in the world, and the new provisions “don’t change that”, Milner said.

Hong Kong has made efforts to ease data flow within the Greater Bay Area (GBA), a Chinese government scheme aimed to integrate the cities of Hong Kong, Macau, and nine in southern Guangdong province into an economic powerhouse.

That includes a pilot scheme for firms in the banking, credit referencing and healthcare sectors that allows enterprises to use a special contract to send data within the GBA, instead of complying with other nationwide requirements.

The biggest limitation of the GBA pilot scheme is that it does not allow data to be transferred beyond the GBA. Photo: Shutterstock Images

But the biggest limitation of that scheme is that it does not allow data to be transferred beyond the GBA. The current form of the standard GBA data flow contract can only be leveraged “to the extent that data flows are within the GBA region”, said Alex Roberts, partner and head of China Technology, Media and Telecommunications at Linklaters in Shanghai.

Milner said that for businesses operating within the GBA, “this may be worth looking at to reduce your red tape”. However, “if your footprint is wider than that, it’s not really going to be much help because under the GBA arrangements, you can’t further subsequently export personal information out to the general area”, he added.

It remains to be seen how much of an incentive the GBA data scheme will be to multinational corporations that have a “significant operational need to transfer data to territories other than the GBA and Hong Kong SAR”, according to Roberts.

Still, as the scheme expands to cover more sectors, it could renew demand for data centres, and spur data-related industries such as artificial intelligence, cloud computing, and data analytics that feed on data flows within the GBA regions, Roberts said. That could in turn boost Hong Kong’s digital economy, he added.

Post