A Comparative Study between the PDPO and the European Union’s General Data Protection Regulation’s Data Transfer Provisions

This paper is formed on the basis that the law in Hong Kong in the form of the PDPO was introduced in 1995, before the internet revolution substantially altered the scale and type of the data which is routinely uploaded by individuals. Nevertheless, Section 33 of the PDPO, which deals with cross-border data transfers, has never been in force. Given the monumental increase in personal data now uploaded and processed online, the vast amounts of personal data transferred out of jurisdiction, and the huge technological increases in data analysis and processing techniques, this legislation might be outdated. This led to amendments being made in 2012 in order to update the law. The adequacy of these new provisions will be compared to the law introduced within the European Union under the GDPR, which will serve as a basis for comparison when determining the adequacy of Hong Kong’s data protection regime.