Cross-border data breach alerts in place, says Digital Policy Office

A reporting mechanism has been established between Hong Kong and the mainland to notify residents if their personal data is leaked across the border, the Digital Policy Office said.

The announcement came on Monday during a meeting of the Legislative Council’s Information Technology and Broadcasting Panel on Monday, as officials outlined efforts to facilitate cross-boundary data flow within the Greater Bay Area.

Acting Digital Policy Commissioner Daniel Cheung Yee-wai said individuals would be alerted if personal data transferred under the Standard Contract for Cross-boundary Flow of Personal Information within the GBA is compromised.

Mismatch credit rating creates hurdles for Hong Kong firms

Meanwhile, lawmaker Ray Wong Wing-wai highlighted challenges faced by Hong Kong companies expanding into the mainland, citing the absence of a unified cross-border credit rating standard.

He said Hong Kong’s TransUnion system is largely based on repayment records, while the mainland uses a broader big-data model incorporating tax, provident fund, and utility payment records.

Despite providing credit reports, Hong Kong firms may still face difficulties in securing approvals due to the lack of mutual recognition between systems.

“Many Hong Kong companies were required to pay for a risk premium or additional property collateral as it is hard for the mainland banks to assess the related risk,” Wong said.

He suggested that authorities, including the Hong Kong Monetary Authority and the People’s Bank of China, should work toward establishing an industry reference standard to enable a “one-stop financing service.”

Responding to the proposal, Under Secretary for Innovation, Technology and Industry Lillian Cheong Man-lei said the current Standard Contract framework focuses on personal data, but authorities will consider extending it to cover industry data.

She added that suggestions on standardizing banking data and credit ratings would be referred to the Financial Services and the Treasury Bureau.

Separately, on concerns over the definition of “important data” under cross-border transfer security assessments, Cheung said restrictions apply mainly to data related to national security or public interests.

He added that relaxed requirements introduced on March 22, 2024 have exempted certain everyday scenarios — including cross-border shopping, payments, account opening, and travel bookings — from such assessments.

 

𝗗𝗼𝘄𝗻𝗹𝗼𝗮𝗱 𝗧𝗵𝗲 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱 𝗔𝗽𝗽 ↓